[ENH] add job submission/job reading endpoints #1187
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| def get_job_status(job_id: str): | ||
| try: | ||
| cached_job = _load_job(job_id) | ||
| except JobStoreError as exc: | ||
| _abort_with_job_store_error(exc) | ||
|
|
||
| if cached_job is None: | ||
| abort(404, description="job not found") |
There was a problem hiding this comment.
The get_job_status handler reads job data from Redis and returns status/logs without ever calling _ensure_authenticated_user() or verifying that the requester matches cached_job["user_id"]. This means any unauthenticated client—or an authenticated user with a different account—can fetch another user’s job status and logs as long as they know the job ID. Both submit_job and list_jobs enforce ownership, so this route is an inconsistent and likely accidental gap that leaks potentially sensitive job data. Require authentication here and reject requests where the job’s user_id does not match the current user before calling the compose runner or returning data.
Useful? React with 👍 / 👎.
|
related to #1188 |
No description provided.