BUG FIX: Only allow workspace authors to update the dl_config

[amadeovezz]

Problem

There was a security issue where dl_config.yaml (which contains the user's task token) was being updated every time any user viewed a workspace via the get_workspace endpoint.

This is mainly a permission problem: If user A creates a workspace, then user B views it, the workspace would run with user B's token/permissions instead of user A's

[graft]

Is it possible to inject these values into the environment, rather than into a file in the filesystem? It would be equally accessible to Snakemake and would be less persistent.

I'd also favor issuing the task token to etna-agent rather than a specific user; since the task token is so stripped-down (one project with a very specific permission) the user is immaterial, except maybe for showing up in the event log.

[graft]

OK after further discussion with Dan:

• Makes sense to maintain the workspace author as the only person that can run the workspace, since we want workspace privacy for noodling
• Task Token permissions will work as follows:
  • Workspace may be configured as "restricted" (default: off)
    • If it is, access to the workspace requires 'restricted' bit to run
    • If it is not, the task token permission cannot include "restricted"
  • Workspace may be configured as "read-only" (default: off)
    • If it is, the task token permission is degraded to "viewer", and any client requests within the workflow making library changes will fail
    • If it is not, the task token permission will be set to 'editor'

[graft]

(err, the above is just a discussion suggestion, not "will happen")

[amadeovezz]

okay - so a bit confused here, we good with the current approach or do we want to rework it?

[dtm2451]

We're good with this approach!