Phabricator automation bot requires security groups permissions
Categories
(Conduit :: Phabricator, defect)
Tracking
(Not tracked)
People
(Reporter: aryx, Unassigned)
References
(Blocks 1 open bug)
Details
In bug 1791152, eeejay reports BMO returned a request error 401 when he tried to fill out the uplift request form in Phabricator. Might be related to the bug being restricted.
|
||
Comment 1•3 years ago
|
||
Sheehan, do you have a moment to look at this? We can work together to debug if needed.
|
||
Comment 2•3 years ago
|
||
(In reply to David Lawrence [:dkl] from comment #1)
Sheehan, do you have a moment to look at this? We can work together to debug if needed.
Can you give me access to bug 1791152 so I can see more information about the error? If if is related to the bug being restricted I assume the Phabricator Automation bot is having trouble posting a comment to Bugzilla on submit. It likely needs more permissions to do so.
|
|
||
Comment 3•3 years ago
|
||
(In reply to Connor Sheehan [:sheehan] from comment #2)
Can you give me access to bug 1791152 so I can see more information about the error?
Done
|
|
||
Comment 4•3 years ago
|
||
Looking at the group permissions for phab-bot@bmo.tld, this user will need access to many more bugs than it currently has.
|
|
||
Comment 5•3 years ago
|
||
(In reply to Connor Sheehan [:sheehan] from comment #4)
Looking at the group permissions for
phab-bot@bmo.tld, this user will need access to many more bugs than it currently has.
Hmm. I would rather not add phab-bot to any or all security groups that may be needed now or in the future. In case the credentials of phab-bot are leaked somehow. We would need to figure out a different method of giving phab-bot the needed access to do just the functions needed. Maybe a special case for that account to be able to add comments to a secure bug using the API after some sort of secondary verification.
|
Reporter | |
Comment 6•3 years ago
|
||
See bug 1349019 for a write-only kind of bug access.
|
|
||
Comment 7•3 years ago
|
||
dveditz, any issue with giving phab-bot security bug access so that this will no longer be an issue? I think just giving it access to client-security-triage-team would be sufficient.
|
||
Comment 8•3 years ago
|
||
How has this worked in the past?
Why isn't it using eejay's creds to submit the comment?
Phabricator adds attachments to secure bugs without problem... could this functionality be done the same way?
We do have some bots with that level of access so it's possible, but where does this one run and what can it do?
|
|
||
Comment 9•3 years ago
|
||
(In reply to Daniel Veditz [:dveditz] from comment #8)
How has this worked in the past?
Why isn't it using eejay's creds to submit the comment?
Phabricator adds attachments to secure bugs without problem... could this functionality be done the same way?We do have some bots with that level of access so it's possible, but where does this one run and what can it do?
This is a newer function of Phabricator where it adds a special comment to the bug report directly from the Phabricator code when an uplift occurs. We store the API key the BMO phab-bot account in Phabricator config settings so it is using that account to make the comment. We do not store any API keys for BMO for individual people so we cannot make the comment as the actual user. In order to do that we would need to add a new bespoke API endpoint just for that purpose. Connect as phab-bot and then internally make the comment look like it came from the individual.
Right now attachments are added by a background process running on BMO called phabbugz. It monitors changes from Phabricators FEED and adds attachments to bugs as appropriate. I suppose we could do something like that for uplift comments but we would have to look into how much work that would be.
|
|
||
Comment 10•3 years ago
|
||
(In reply to David Lawrence [:dkl] from comment #9)
Right now attachments are added by a background process running on BMO called phabbugz. It monitors changes from Phabricators FEED and adds attachments to bugs as appropriate. I suppose we could do something like that for uplift comments but we would have to look into how much work that would be.
I'm going to move the Bugzilla updating/commenting/etc code out of Phabricator and into the phabbugz daemon. This will work around the permissions issue, and move all the logic around "take this action when the uplift form is submitted" into one location.
Description
•