Skip to content

fix: workflow env options permission - #4975

Merged
leozhang2018 merged 4 commits into
koderover:mainfrom
Cynthia-0203:fix/workflow-env-options-permission
Sep 15, 2026
Merged

leozhang2018 merged 4 commits into
koderover:mainfrom
Cynthia-0203:fix/workflow-env-options-permission

Conversation

@Cynthia-0203

@Cynthia-0203 Cynthia-0203 commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

What this PR does / Why we need it:

Workflow presets returned all configured environments without considering the current user's environment permissions, allowing unauthorized environments to be selected.

What is changed and how it works?

  • Resolve the user's regular, production, and collaboration-mode environment permissions.
  • Filter workflow env_options and clear unauthorized environment selections.
  • Validate the selected environment again when creating a workflow task to prevent API bypasses.

Does this PR introduce a user-facing change?

  • API change
  • database schema change
  • upgrade assistant change
  • change in non-functional attributes such as efficiency or availability
  • fix of a previous issue

This change is Reviewable

Signed-off-by: Cynthia <chenchen@koderover.com>
Signed-off-by: Cynthia <chenchen@koderover.com>
@Cynthia-0203 Cynthia-0203 changed the title Fix/workflow env options permission fix: workflow env options permission Sep 10, 2026
…creation

Signed-off-by: Cynthia <chenchen@koderover.com>
Signed-off-by: Cynthia <chenchen@koderover.com>
@leozhang2018
leozhang2018 merged commit fab68f3 into koderover:main Sep 15, 2026
4 checks passed
leozhang2018 added a commit that referenced this pull request Sep 15, 2026
…rmission-release-5.0.0

cp: cherry pick #4975 to release 5.0.0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants