fix: sign cloudery token under 'settings' subject#28
Merged
Conversation
Drive's installed permission doc grants only GET on io.cozy.nextcloud.migrations. The Stack ignores a JWT's `scope` claim for app-audience tokens and authorizes from the named webapp's perm doc, so every PUT against the tracking doc came back 403: setRunning failed mid-migration, and the recovery flushAndFail write 403'd in turn, leaving the doc stuck in pending. The Settings app owns the migration UI and has ALL verbs on the doctype, so piggybacking there gives the service the writes it actually needs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
subject, not from the JWT'sscope. Drive's doc hasGETonly onio.cozy.nextcloud.migrations, so every tracking-doc PUT (setRunning, flushProgress, flushAndFail) returned 403 and migrations died at start without recording the failure.settings, whose manifest carries full CRUD onio.cozy.nextcloud.migrationsalongside theio.cozy.filesandio.cozy.settingsrules the rest of the run needs.