fix(engine-jobs): scope job-log reads and clears to the current tenant (#6606) - #6678
Merged
delchev merged 4 commits intoAug 12, 2026
Merged
Conversation
eclipse-dirigible#6606) GET /services/jobs/logs/{job} and POST /services/jobs/clear/{job} built their query-by-example filter from a bare new JobLog(), so both read and delete matched every tenant's rows: users saw other tenants' execution logs (which may carry sensitive error messages) and clearing a job wiped the audit trail across all tenants. The write side already stamped the tenant via createJobLog(); reuse it as the query probe (exactly what the two TODO comments suggested) so findByJob and deleteAllByJobName filter by JOBLOG_TENANT_ID. Mirrors the eclipse-dirigible#6607 TaskState fix. Add a tenant-isolation regression test (mocked TenantContext) asserting a tenant neither reads nor clears another tenant's job logs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
eclipse-dirigible#6606) GET /services/jobs/logs/{job} and POST /services/jobs/clear/{job} built their query-by-example filter from a bare new JobLog(), so both read and delete matched every tenant's rows: users saw other tenants' execution logs (which may carry sensitive error messages) and clearing a job wiped the audit trail across all tenants. The write side already stamped the tenant via createJobLog(); reuse it as the query probe (exactly what the two TODO comments suggested) so findByJob and deleteAllByJobName filter by JOBLOG_TENANT_ID. Mirrors the eclipse-dirigible#6607 TaskState fix. Add JobLogServiceTest covering the tenant-isolation regression (mocked TenantContext, a tenant neither reads nor clears another tenant's logs) plus the log-creation methods and their statuses, leading-slash normalization on find/delete, the default-tenant fallback when the context is uninitialized, and the jobFinished/jobFailed paths. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…/NicoleNG18/dirigible into fix/6606-job-logs-tenant-scoping # Conflicts: # components/engine/engine-jobs/src/test/java/org/eclipse/dirigible/components/jobs/service/JobLogServiceTest.java
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Fixes #6606.
With multi-tenancy enabled (the default), two job-log endpoints leaked and mutated data across tenants:
GET /services/jobs/logs/{job}returned execution logs for every tenant.POST /services/jobs/clear/{job}deleted logs for every tenant.Both
JobLogService.findByJob(...)andJobLogService.deleteAllByJobName(...)built their query-by-example filter from a barenew JobLog(), so theJOBLOG_TENANT_IDcolumn was never part of the probe. A user could see another tenant's logs (which may carry sensitive error messages) and clearing one job wiped the audit trail for all tenants at once.The fix
The write path already stamps the tenant via the private
createJobLog()helper (TenantContext, falling back to the@DefaultTenantwhen the context is uninitialized). The reads/deletes simply needed to reuse it as the query probe — which is exactly what the two// createJobLog() if we want only logs for the current tenant otherwise new JobLog()comments pointed at:This mirrors the sibling #6607
TaskStateServicefix. No by-id read/delete path exists for job logs, so no extra cross-tenant guard is needed here (unlike TaskState).No frontend changes — the UI already displays tenant identifiers.
Tests
New
JobLogServiceTest(HTTP-free, mockedTenantContext), 8 cases:readsAndClearsAreTenantScoped— regression for Job execution logs are read and cleared across tenants #6606: a tenant neither reads nor clears another tenant's logs.jobTriggeredPersistsTriggeredLog,logMethodsSetTheirStatus— log creation + status mapping (TRIGGRED/LOGGED/ERROR/WARN/INFO).findByJobNormalizesLeadingSlash,deleteAllByJobNameNormalizesLeadingSlash— leading-slash normalization on both paths.logsFallBackToDefaultTenantWhenContextUninitialized— default-tenant fallback.jobFinishedPersistsFinishedLogAndUpdatesJob,jobFailedPersistsFailedLogAndUpdatesJob— the finish/fail paths flip the owningJobstatus.Tests run: 8, Failures: 0, Errors: 0.mvn formatter:validateand the release-profile javadoc build both pass onengine-jobs.🤖 Generated with Claude Code