Permission error occured when accessing the JobCommits

[k1won]

My actions before raising this issue

• Read/searched the docs

• Searched past issues

• Related : REST API /api/jobs/<id>/commits #4368

Expected Behaviour

• returns the list of tracked changes for the job

Current Behaviour

• permission error occured (except admin account)

HTTP 403 Forbidden
Allow: GET, HEAD, OPTIONS
Content-Type: application/vnd.cvat+json
Vary: Accept

{
    "detail": "You do not have permission to perform this action."
}

Possible Solution

• add additional 'key:value'(('commits', 'GET'): 'view:commits') to the get_scopes() method in JobPermission class like below. (apps.iam.permissions.py)

    @staticmethod
    def get_scopes(request, view, obj):
        scope = {
            ('list', 'GET'): 'list', # TODO: need to add the method
            ('retrieve', 'GET'): 'view',
            ('partial_update', 'PATCH'): 'update',
            ('update', 'PUT'): 'update', # TODO: do we need the method?
            ('destroy', 'DELETE'): 'delete',
            ('annotations', 'GET'): 'view:annotations',
            ('annotations', 'PATCH'): 'update:annotations',
            ('annotations', 'DELETE'): 'delete:annotations',
            ('annotations', 'PUT'): 'update:annotations',
            ('data', 'GET'): 'view:data',
            ('issues', 'GET'): 'view',
            ('commits', 'GET'): 'view:commits'
        }.get((view.action, request.method))

• add additional rule variable(VIEW_COMMITS:="view:commits") to the utils.rego

VIEW_DATA := "view:data"
VIEW_COMMITS := "view:commits"  <<---
UPLOAD_DATA := "upload:data"

• update permission rule to the jobs.rego

allow {
    { utils.VIEW, utils.VIEW_ANNOTATIONS, utils.VIEW_DATA, utils.VIEW_COMMITS }[input.scope]
    utils.is_sandbox
    is_job_staff
}

allow {
    { utils.VIEW, utils.VIEW_ANNOTATIONS, utils.VIEW_DATA, utils.VIEW_COMMITS }[input.scope]
    input.auth.organization.id == input.resource.organization.id
    utils.has_perm(utils.USER)
    organizations.has_perm(organizations.MAINTAINER)
}

allow {
    { utils.VIEW, utils.VIEW_ANNOTATIONS, utils.VIEW_DATA, utils.VIEW_COMMITS }[input.scope]
    input.auth.organization.id == input.resource.organization.id
    organizations.has_perm(organizations.WORKER)
    is_job_staff
}

Steps to Reproduce (for bugs)

1. create a task
2. open the job
3. create some shapes and save
4. access the /api/jobs/{id}/commits endpoint

Context

Your Environment

• Git hash commit (git log -1): b0e6074
• Docker version docker version (e.g. Docker 17.0.05):
• Are you using Docker Swarm or Kubernetes?
• Operating System and version (e.g. Linux, Windows, MacOS): ubuntu 18.04
• Code example or link to GitHub repo or gist to reproduce problem:
• Other diagnostic information / logs:
  Logs from `cvat` container

Next steps

You may join our Gitter channel for community support.

[nmanovic]

@k1won , thanks again for your contribution! It looks like I tested these changes only with admin account.

[k1won]

@nmanovic , Do you want me to send a PR to fix this issue?
If you want, I can handle it.

[nmanovic]

@k1won , if you can help us again, please do that. We like contributions. It is the power of our community and it makes our team bigger and stronger.

[k1won]

@nmanovic , OK. No problem.
I will send a PR soon.