feat: limit access to job file endpoints to only the same user as requester

internal/pkg/heimdall/job.go

@@ -350,8 +350,20 @@ func (h *Heimdall) getJobFile(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	j, ok := jobStatusResult.(*job.Job)
+	if !ok {
+		writeAPIError(w, ErrUnknownJobID, nil)
+		return
+	}
+
 	if filename == resultFile {
-		if j, ok := jobStatusResult.(*job.Job); !ok || j.Status != jobStatus.Succeeded {
+		// only allow same user to access the job result file
+		if j.User != getUsername(r) {
+			writeAPIError(w, ErrCallerNotAllowed, nil)
+			return
+		}
+		// if failed, we don't have a result file to return
+		if j.Status != jobStatus.Succeeded {
 			writeAPIError(w, ErrResultNotReady, nil)
 			return
 		}

internal/pkg/heimdall/job_dal.go

@@ -248,12 +248,12 @@ type sortColumn struct {
 }
 
 type resolvedSort struct {
-	orderKey  string     
-	column    sortColumn 
-	sorted    bool       
-	expr      string     
-	direction string     
-	cmp       string     
+	orderKey  string
+	column    sortColumn
+	sorted    bool
+	expr      string
+	direction string
+	cmp       string
 }
 
 func resolveSortColumns(f *database.Filter) resolvedSort {
@@ -517,7 +517,7 @@ func (h *Heimdall) getJobStatus(ctx context.Context, j *jobRequest) (any, error)
 
 	r := &job.Job{}
 
-	if err := row.Scan(&r.Status, &r.Error, &r.UpdatedAt); err != nil {
+	if err := row.Scan(&r.Status, &r.Error, &r.UpdatedAt, &r.User); err != nil {
 		if err == sql.ErrNoRows {
 			getJobStatusMethod.LogAndCountError(ErrUnknownJobID, "query")
 			return nil, ErrUnknownJobID

internal/pkg/heimdall/queries/job/status_select.sql

@@ -1,7 +1,8 @@
 select
     j.job_status_id,
     j.job_error,
-    j.updated_at
+    j.updated_at,
+    j.username
 from
     jobs j
 where

internal/pkg/object/command/sparkeks/sparkeks.go

@@ -106,9 +106,9 @@ type commandContext struct {
 }
 
 type jobParameters struct {
-	Properties map[string]string `yaml:"properties,omitempty" json:"properties,omitempty"`
-	EntryPoint string `yaml:"entry_point,omitempty" json:"entry_point,omitempty"`
-	ApplicationType string `yaml:"application_type,omitempty" json:"application_type,omitempty"`
+	Properties      map[string]string `yaml:"properties,omitempty" json:"properties,omitempty"`
+	EntryPoint      string            `yaml:"entry_point,omitempty" json:"entry_point,omitempty"`
+	ApplicationType string            `yaml:"application_type,omitempty" json:"application_type,omitempty"`
 }
 
 type jobContext struct {
@@ -482,7 +482,6 @@ func updateS3ToS3aURI(uri string) string {
 	return strings.ReplaceAll(uri, s3Prefix, s3aPrefix)
 }
 
-
 // getS3FileURI finds a file in an S3 directory that matches the given extension.
 func getS3FileURI(ctx context.Context, awsConfig aws.Config, directoryURI, matchingExtension string) (string, error) {
 	s3Parts := rxS3.FindAllStringSubmatch(directoryURI, -1)

pkg/object/job/job.go

@@ -10,21 +10,21 @@ import (
 )
 
 type Job struct {
-	object.Object      `yaml:",inline" json:",inline"`
-	Status             status.Status        `yaml:"status,omitempty" json:"status,omitempty"`
-	IsSync             bool                 `yaml:"is_sync,omitempty" json:"is_sync,omitempty"`
-	StoreResultSync    bool                 `yaml:"store_result_sync,omitempty" json:"store_result_sync,omitempty"`
-	Error              string               `yaml:"error,omitempty" json:"error,omitempty"`
-	CommandCriteria    *set.Set[string]     `yaml:"command_criteria,omitempty" json:"command_criteria,omitempty"`
-	ClusterCriteria    *set.Set[string]     `yaml:"cluster_criteria,omitempty" json:"cluster_criteria,omitempty"`
-	CommandID          string               `yaml:"command_id,omitempty" json:"command_id,omitempty"`
-	CommandName        string               `yaml:"command_name,omitempty" json:"command_name,omitempty"`
-	ClusterID          string               `yaml:"cluster_id,omitempty" json:"cluster_id,omitempty"`
-	ClusterName        string               `yaml:"cluster_name,omitempty" json:"cluster_name,omitempty"`
-	CanceledBy         string               `yaml:"canceled_by,omitempty" json:"canceled_by,omitempty"`
-	JobAttributes map[string]Attribute `yaml:"job_attributes,omitempty" json:"job_attributes,omitempty"`
-	Result             *result.Result       `yaml:"result,omitempty" json:"result,omitempty"`
-	outputs            map[string]string
+	object.Object   `yaml:",inline" json:",inline"`
+	Status          status.Status        `yaml:"status,omitempty" json:"status,omitempty"`
+	IsSync          bool                 `yaml:"is_sync,omitempty" json:"is_sync,omitempty"`
+	StoreResultSync bool                 `yaml:"store_result_sync,omitempty" json:"store_result_sync,omitempty"`
+	Error           string               `yaml:"error,omitempty" json:"error,omitempty"`
+	CommandCriteria *set.Set[string]     `yaml:"command_criteria,omitempty" json:"command_criteria,omitempty"`
+	ClusterCriteria *set.Set[string]     `yaml:"cluster_criteria,omitempty" json:"cluster_criteria,omitempty"`
+	CommandID       string               `yaml:"command_id,omitempty" json:"command_id,omitempty"`
+	CommandName     string               `yaml:"command_name,omitempty" json:"command_name,omitempty"`
+	ClusterID       string               `yaml:"cluster_id,omitempty" json:"cluster_id,omitempty"`
+	ClusterName     string               `yaml:"cluster_name,omitempty" json:"cluster_name,omitempty"`
+	CanceledBy      string               `yaml:"canceled_by,omitempty" json:"canceled_by,omitempty"`
+	JobAttributes   map[string]Attribute `yaml:"job_attributes,omitempty" json:"job_attributes,omitempty"`
+	Result          *result.Result       `yaml:"result,omitempty" json:"result,omitempty"`
+	outputs         map[string]string
 }
 
 // Attribute kinds for JobAttributes. Kind tells the UI how to render Value.