Allow workflow run control mutations to be called with API key auth (#22924)
## Context A customer wants to control workflow runs from an external system / their own automation calling the API. Today the workflow mutations are gated by `UserAuthGuard`, which requires an interactive logged-in user (`request.user`). API-key requests set `request.workspace` but never `request.user`, so they can't call them. ## Change `UserAuthGuard` was applied at the class level on `WorkflowTriggerResolver`, blanketing all five mutations even though only `runWorkflowVersion` actually consumes the user (it looks up the workspace member to stamp `createdBy`). This drops `UserAuthGuard` from the class and keeps it only on `runWorkflowVersion`. As a result, these become callable with API-key auth: - `stopWorkflowRun` - `retryWorkflowRun` - `activateWorkflowVersion` - `deactivateWorkflowVersion` None of these ever referenced the user, so no logic depends on it. `runWorkflowVersion` stays user-only because it needs a workspace member to attribute `createdBy`. Permissioning is unchanged: `SettingsPermissionGuard(WORKFLOWS)` stays at the class level and already resolves the permission for API keys via `apiKeyId`, so a key still needs the WORKFLOWS permission. ## Notes / open questions - No actor is recorded for these operations today (they only change run/version state), so exposing them to API keys doesn't drop any audit that existed. Attributing API-key-initiated actions would be a follow-up. - If there's a deliberate product stance that workflow control should stay user-only, this is a policy change worth confirming.
This commit is contained in:
+1
-1
@@ -33,7 +33,6 @@ import { WorkspaceMemberWorkspaceEntity } from 'src/modules/workspace-member/sta
|
||||
@CoreResolver()
|
||||
@UseGuards(
|
||||
WorkspaceAuthGuard,
|
||||
UserAuthGuard,
|
||||
SettingsPermissionGuard(PermissionFlagType.WORKFLOWS),
|
||||
)
|
||||
@UsePipes(ResolverValidationPipe)
|
||||
@@ -73,6 +72,7 @@ export class WorkflowTriggerResolver {
|
||||
}
|
||||
|
||||
@Mutation(() => RunWorkflowVersionDTO)
|
||||
@UseGuards(UserAuthGuard)
|
||||
async runWorkflowVersion(
|
||||
@AuthUser() user: AuthContextUser,
|
||||
@AuthWorkspace() workspace: WorkspaceEntity,
|
||||
|
||||
Reference in New Issue
Block a user