fix(server-common): enforce read authorization on referenced task lookup - #1005
Open
ehsavoie wants to merge 1 commit into
Open
fix(server-common): enforce read authorization on referenced task lookup#1005ehsavoie wants to merge 1 commit into
ehsavoie wants to merge 1 commit into
Conversation
ehsavoie
force-pushed
the
reference_tasks
branch
from
August 3, 2026 16:33
51a5f87 to
054c9bf
Compare
- Authorize referenceTaskIds through TaskAuthorizationProvider before populating RequestContext; fail with TaskNotFoundError on denial - Rename validateRequestedTask → authorizeTaskAccess, passing ServerCallContext for auth checks in streaming/subscribe paths - Replace DefaultRequestHandler.create() with Builder pattern - Make populate-referred-tasks configurable (a2a.request-context) - Standardize fail-closed authorization in both TaskStore impls Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>
ehsavoie
force-pushed
the
reference_tasks
branch
from
August 3, 2026 16:33
054c9bf to
46c0960
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Filter referenced tasks (referenceTaskIds) through TaskAuthorizationProvider before populating the RequestContext, so callers cannot read tasks they are not authorized to access.
Pass ServerCallContext to validateRequestedTask so the authorization decorator can check read permissions when streaming or subscribe requests reference an existing task. Without this, an unauthorized caller could probe for task existence via sendStreamingMessage or subscribeToTask.