UI: inconsistent authentication when viewing logs
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
### Nomad version
Clients and servers are both running 1.6.0
### Operating system and Environment details
Clients and servers are running Ubuntu 22.04
### Issue
Users who have the `read-logs` capability assigned for a specific namespace are able to view the logs for an allocation when clicking "View Logs" from the overall job status page (/ui/jobs/jobname@namespace) but are unable to view the logs when going clicking "Logs" from the allocations page (/ui/allocations/allocation/task).
Admins who have permission on the whole cluster, rather than a specific namespace, do not run into this issue.
### Reproduction steps
Apply the following ACL policy:
```
namespace "project" {
policy = "read"
capabilities = [
"alloc-lifecycle",
"read-logs",
]
variables {
path "*" {
capabilities = [
"destroy",
"read",
"write",
]
}
}
}
```
Ensure there is a task running, generate a test token for the above policy, and then:
* From the "Jobs" page (/ui/jobs?namespace=project) select a job
* From the job details page (/ui/jobs/jobname@project) select "View Logs" on a running task
* Note that you can see current logs
* Now click the "Go to Task Page" at the top right of logs pane, this will take you to the tasks allocation page (/ui/allocations/allocation/task)
* Click the "Logs" button at the top
* Note that you get the "Not Authorized" page
#### Expected Result
The user is able to view the tasks logs.
#### Actual Result
The user gets a not authorized response.
### Nomad UI logs
When viewing the developer tools console we do see an unrecoverable error being logged.
```
description: undefined
errors: Array(1)
0:
detail: "Permission denied"
status: "403"
title: "The backend responded with an error"
message: "Ember Data Request GET /v1/node/ returned a 403\nPayload (text/xml)\nPermission denied"
```
Reviewing the network pane I can see the 403 requests to the node endpoints.
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the issue with the namespace-scoped read-logs policy, comparing View Logs from /ui/jobs/jobname@namespace with Logs from /ui/allocations/allocation/task. Start by tracing the allocation-page request that reaches /v1/node/ and returns 403, then compare its authentication context with the working job-details flow. Done means both paths display task logs for the scoped token without an unauthorized response.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api, authentication, frontend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100