Skip to content

Commit 1a490cb

Browse files
dtdt
committed
jobs: remove deprecated custom per-job auth
This was deprecated a couple releases ago in favor of using more standard approaches of either a) telling users to grant or revoke membership in a role that has ownership of a job to manage access to that job or b) features built on top of jobs can have their own control statements that perform their own auth checks before modifying or creating jobs if they so choose. With this having been deprecated for a couple of major releases now with the public docs suggesting using role membership instead, it can now be deleted to simplify the auth checks the jobs system needs to perform, paving the way for replacing the complex logic in the vtable for SHOW JOBS with a simple view instead. Release note (ops change): Non-admin users no longer have access to changefeed jobs they do not own and which are not owned by a role of which they are a member, regardless of whether they have the CHANGEFEED privilege on the table or tables those jobs may be watching. Admin users, or those with global SHOWJOB / CONTROLJOB privileges can still interact with all jobs, regardless of ownership. Epic: CRDB-48791.
1 parent b2e185d commit 1a490cb

File tree

13 files changed

+37
-213
lines changed

13 files changed

+37
-213
lines changed

‎pkg/ccl/changefeedccl/alter_changefeed_stmt.go‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -113,11 +113,8 @@ func alterChangefeedPlanHook(
113113
if err != nil {
114114
return err
115115
}
116-
getLegacyPayload := func(ctx context.Context) (*jobspb.Payload, error) {
117-
return &jobPayload, nil
118-
}
119-
err = jobsauth.AuthorizeAllowLegacyAuth(
120-
ctx, p, jobID, getLegacyPayload, jobPayload.UsernameProto.Decode(), jobPayload.Type(), jobsauth.ControlAccess, globalPrivileges,
116+
err = jobsauth.Authorize(
117+
ctx, p, jobID, jobPayload.UsernameProto.Decode(), jobsauth.ControlAccess, globalPrivileges,
121118
)
122119
if err != nil {
123120
return err

‎pkg/ccl/changefeedccl/alter_changefeed_test.go‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ func TestAlterChangefeedAddTargetPrivileges(t *testing.T) {
8282
`CREATE TABLE table_b (id int, type type_a)`,
8383
`CREATE TABLE table_c (id int, type type_a)`,
8484
`CREATE USER feedCreator`,
85+
`CREATE ROLE feedowner`,
86+
`GRANT feedowner TO feedCreator`,
8587
`GRANT SELECT ON table_a TO feedCreator`,
8688
`GRANT CHANGEFEED ON table_a TO feedCreator`,
8789
`CREATE EXTERNAL CONNECTION "first" AS 'kafka://nope'`,
@@ -123,22 +125,24 @@ func TestAlterChangefeedAddTargetPrivileges(t *testing.T) {
123125
row.Scan(&jobID)
124126
userDB.Exec(t, `PAUSE JOB $1`, jobID)
125127
waitForJobState(userDB, t, catpb.JobID(jobID), `paused`)
128+
userDB.Exec(t, `ALTER JOB $1 OWNER TO feedowner`, jobID)
126129
})
127130

128131
// user1 is missing the CHANGEFEED privilege on table_b and table_c.
129132
withUser(t, "user1", func(userDB *sqlutils.SQLRunner) {
130133
userDB.ExpectErr(t,
131-
"user user1 requires the CHANGEFEED privilege on all target tables to be able to run an enterprise changefeed",
134+
"user user1 does not have privileges for job",
132135
fmt.Sprintf("ALTER CHANGEFEED %d ADD table_b, table_c set sink='external://second'", jobID),
133136
)
134137
})
135138
rootDB.Exec(t, `GRANT CHANGEFEED ON table_b TO user1`)
136139
withUser(t, "user1", func(userDB *sqlutils.SQLRunner) {
137140
userDB.ExpectErr(t,
138-
"user user1 requires the CHANGEFEED privilege on all target tables to be able to run an enterprise changefeed",
141+
"user user1 does not have privileges for job",
139142
fmt.Sprintf("ALTER CHANGEFEED %d ADD table_b, table_c set sink='external://second'", jobID),
140143
)
141144
})
145+
rootDB.Exec(t, `GRANT feedowner TO user1`)
142146
rootDB.Exec(t, `GRANT CHANGEFEED ON table_c TO user1`)
143147
withUser(t, "user1", func(userDB *sqlutils.SQLRunner) {
144148
userDB.Exec(t,
@@ -175,19 +179,27 @@ func TestAlterChangefeedAddTargetPrivileges(t *testing.T) {
175179
row.Scan(&jobID)
176180
userDB.Exec(t, `PAUSE JOB $1`, jobID)
177181
waitForJobState(userDB, t, catpb.JobID(jobID), `paused`)
182+
userDB.Exec(t, `ALTER JOB $1 OWNER TO feedowner`, jobID)
178183
})
179184

180185
// user2 is missing the SELECT privilege on table_b and table_c.
181186
withUser(t, "user2", func(userDB *sqlutils.SQLRunner) {
182187
userDB.ExpectErr(t,
183-
"pq: user user2 with CONTROLCHANGEFEED role option requires the SELECT privilege on all target tables to be able to run an enterprise changefeed",
188+
"pq: user user2 does not have privileges for job",
184189
fmt.Sprintf("ALTER CHANGEFEED %d ADD table_b, table_c set sink='kafka://bar'", jobID),
185190
)
186191
})
187192
rootDB.Exec(t, `GRANT SELECT ON table_b TO user2`)
188193
withUser(t, "user2", func(userDB *sqlutils.SQLRunner) {
189194
userDB.ExpectErr(t,
190-
"pq: user user2 with CONTROLCHANGEFEED role option requires the SELECT privilege on all target tables to be able to run an enterprise changefeed",
195+
"pq: user user2 does not have privileges for job",
196+
fmt.Sprintf("ALTER CHANGEFEED %d ADD table_b, table_c set sink='kafka://bar'", jobID),
197+
)
198+
})
199+
rootDB.Exec(t, `GRANT feedowner TO user2`)
200+
withUser(t, "user2", func(userDB *sqlutils.SQLRunner) {
201+
userDB.ExpectErr(t,
202+
"requires the SELECT privilege on all target tables",
191203
fmt.Sprintf("ALTER CHANGEFEED %d ADD table_b, table_c set sink='kafka://bar'", jobID),
192204
)
193205
})
@@ -1859,6 +1871,7 @@ func TestAlterChangefeedAccessControl(t *testing.T) {
18591871
})
18601872
rootDB.Exec(t, "PAUSE job $1", currentFeed.JobID())
18611873
waitForJobState(rootDB, t, currentFeed.JobID(), `paused`)
1874+
rootDB.Exec(t, "ALTER JOB $1 OWNER TO feedowner", currentFeed.JobID())
18621875

18631876
// Verify who can modify the existing changefeed.
18641877
asUser(t, f, `userWithAllGrants`, func(userDB *sqlutils.SQLRunner) {
@@ -1872,10 +1885,10 @@ func TestAlterChangefeedAccessControl(t *testing.T) {
18721885
userDB.ExpectErr(t, "pq: user jobcontroller requires the CHANGEFEED privilege on all target tables to be able to run an enterprise changefeed", fmt.Sprintf(`ALTER CHANGEFEED %d DROP table_b`, currentFeed.JobID()))
18731886
})
18741887
asUser(t, f, `userWithSomeGrants`, func(userDB *sqlutils.SQLRunner) {
1875-
userDB.ExpectErr(t, "pq: user userwithsomegrants does not have CHANGEFEED privilege on relation table_b", fmt.Sprintf(`ALTER CHANGEFEED %d ADD table_b`, currentFeed.JobID()))
1888+
userDB.ExpectErr(t, "does not have privileges for job", fmt.Sprintf(`ALTER CHANGEFEED %d ADD table_b`, currentFeed.JobID()))
18761889
})
18771890
asUser(t, f, `regularUser`, func(userDB *sqlutils.SQLRunner) {
1878-
userDB.ExpectErr(t, "pq: user regularuser does not have CHANGEFEED privilege on relation (table_a|table_b)", fmt.Sprintf(`ALTER CHANGEFEED %d ADD table_b`, currentFeed.JobID()))
1891+
userDB.ExpectErr(t, "does not have privileges for job", fmt.Sprintf(`ALTER CHANGEFEED %d ADD table_b`, currentFeed.JobID()))
18791892
})
18801893
closeCf()
18811894

‎pkg/ccl/changefeedccl/authorization.go‎

Lines changed: 0 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@ import (
1111

1212
"github.com/cockroachdb/cockroach/pkg/ccl/changefeedccl/changefeedbase"
1313
"github.com/cockroachdb/cockroach/pkg/cloud/externalconn"
14-
"github.com/cockroachdb/cockroach/pkg/jobs/jobsauth"
15-
"github.com/cockroachdb/cockroach/pkg/jobs/jobspb"
1614
"github.com/cockroachdb/cockroach/pkg/sql"
1715
"github.com/cockroachdb/cockroach/pkg/sql/catalog"
1816
"github.com/cockroachdb/cockroach/pkg/sql/pgwire/pgcode"
@@ -135,45 +133,3 @@ func authorizeUserToCreateChangefeed(
135133

136134
return nil
137135
}
138-
139-
// AuthorizeChangefeedJobAccess determines if a user has access to the changefeed job denoted
140-
// by the supplied jobID and payload.
141-
func AuthorizeChangefeedJobAccess(
142-
ctx context.Context,
143-
a jobsauth.AuthorizationAccessor,
144-
jobID jobspb.JobID,
145-
getLegacyPayload func(ctx context.Context) (*jobspb.Payload, error),
146-
) error {
147-
payload, err := getLegacyPayload(ctx)
148-
if err != nil {
149-
return err
150-
}
151-
specs, ok := payload.UnwrapDetails().(jobspb.ChangefeedDetails)
152-
if !ok {
153-
return errors.Newf("could not unwrap details from the payload of job %d", jobID)
154-
}
155-
156-
if len(specs.TargetSpecifications) == 0 {
157-
return pgerror.Newf(pgcode.InsufficientPrivilege, "job contains no tables on which the user has %s privilege", privilege.CHANGEFEED)
158-
}
159-
160-
for _, spec := range specs.TargetSpecifications {
161-
err := a.CheckPrivilegeForTableID(ctx, spec.TableID, privilege.CHANGEFEED)
162-
if err != nil {
163-
// When performing SHOW JOBS or SHOW CHANGEFEED JOBS, there may be old changefeed
164-
// records that reference tables which have been dropped or are being
165-
// dropped. In this case, we would prefer to skip the permissions check on
166-
// the dropped descriptor.
167-
if pgerror.GetPGCode(err) == pgcode.UndefinedTable || errors.Is(err, catalog.ErrDescriptorDropped) {
168-
continue
169-
}
170-
171-
return err
172-
}
173-
}
174-
return nil
175-
}
176-
177-
func init() {
178-
jobsauth.RegisterAuthorizer(jobspb.TypeChangefeed, AuthorizeChangefeedJobAccess)
179-
}

‎pkg/ccl/changefeedccl/changefeed_test.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3740,6 +3740,7 @@ func TestChangefeedJobControl(t *testing.T) {
37403740
asUser(t, f, `adminUser`, func(userDB *sqlutils.SQLRunner) {
37413741
userDB.Exec(t, "PAUSE job $1", currentFeed.JobID())
37423742
waitForJobState(userDB, t, currentFeed.JobID(), "paused")
3743+
userDB.Exec(t, "ALTER JOB $1 OWNER TO feedowner", currentFeed.JobID())
37433744
})
37443745
asUser(t, f, `userWithAllGrants`, func(userDB *sqlutils.SQLRunner) {
37453746
userDB.Exec(t, "RESUME job $1", currentFeed.JobID())
@@ -3750,10 +3751,10 @@ func TestChangefeedJobControl(t *testing.T) {
37503751
waitForJobState(userDB, t, currentFeed.JobID(), "running")
37513752
})
37523753
asUser(t, f, `userWithSomeGrants`, func(userDB *sqlutils.SQLRunner) {
3753-
userDB.ExpectErr(t, "user userwithsomegrants does not have CHANGEFEED privilege on relation table_b", "PAUSE job $1", currentFeed.JobID())
3754+
userDB.ExpectErr(t, "does not have privileges for job", "PAUSE job $1", currentFeed.JobID())
37543755
})
37553756
asUser(t, f, `regularUser`, func(userDB *sqlutils.SQLRunner) {
3756-
userDB.ExpectErr(t, "user regularuser does not have CHANGEFEED privilege on relation (table_a|table_b)", "PAUSE job $1", currentFeed.JobID())
3757+
userDB.ExpectErr(t, "does not have privileges for job", "PAUSE job $1", currentFeed.JobID())
37573758
})
37583759
closeCf()
37593760

‎pkg/ccl/changefeedccl/helpers_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1736,6 +1736,7 @@ func ChangefeedJobPermissionsTestSetup(t *testing.T, s TestServer) {
17361736

17371737
`CREATE USER adminUser`,
17381738
`GRANT ADMIN TO adminUser`,
1739+
`CREATE ROLE feedowner`,
17391740

17401741
`CREATE USER otherAdminUser`,
17411742
`GRANT ADMIN TO otherAdminUser`,
@@ -1747,6 +1748,7 @@ func ChangefeedJobPermissionsTestSetup(t *testing.T, s TestServer) {
17471748
`CREATE USER jobController with CONTROLJOB`,
17481749

17491750
`CREATE USER userWithAllGrants`,
1751+
`GRANT feedowner TO userWithAllGrants`,
17501752
`GRANT CHANGEFEED ON table_a TO userWithAllGrants`,
17511753
`GRANT CHANGEFEED ON table_b TO userWithAllGrants`,
17521754

‎pkg/ccl/changefeedccl/show_changefeed_jobs_test.go‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -568,7 +568,6 @@ func TestShowChangefeedJobsAuthorization(t *testing.T) {
568568
require.NoError(t, err)
569569
jobID = successfulFeed.(cdctest.EnterpriseTestFeed).JobID()
570570
}
571-
rootDB := sqlutils.MakeSQLRunner(s.DB)
572571

573572
// Create a changefeed and assert who can see it.
574573
asUser(t, f, `feedCreator`, func(userDB *sqlutils.SQLRunner) {
@@ -579,7 +578,7 @@ func TestShowChangefeedJobsAuthorization(t *testing.T) {
579578
userDB.CheckQueryResults(t, `SELECT job_id FROM [SHOW CHANGEFEED JOBS]`, [][]string{{expectedJobIDStr}})
580579
})
581580
asUser(t, f, `userWithAllGrants`, func(userDB *sqlutils.SQLRunner) {
582-
userDB.CheckQueryResults(t, `SELECT job_id FROM [SHOW CHANGEFEED JOBS]`, [][]string{{expectedJobIDStr}})
581+
userDB.CheckQueryResults(t, `SELECT job_id FROM [SHOW CHANGEFEED JOBS]`, [][]string{})
583582
})
584583
asUser(t, f, `userWithSomeGrants`, func(userDB *sqlutils.SQLRunner) {
585584
userDB.CheckQueryResults(t, `SELECT job_id FROM [SHOW CHANGEFEED JOBS]`, [][]string{})
@@ -590,16 +589,6 @@ func TestShowChangefeedJobsAuthorization(t *testing.T) {
590589
asUser(t, f, `regularUser`, func(userDB *sqlutils.SQLRunner) {
591590
userDB.CheckQueryResults(t, `SELECT job_id FROM [SHOW CHANGEFEED JOBS]`, [][]string{})
592591
})
593-
594-
// Assert behavior when one of the tables is dropped.
595-
rootDB.Exec(t, "DROP TABLE table_b")
596-
// Having CHANGEFEED on only table_a is now sufficient.
597-
asUser(t, f, `userWithSomeGrants`, func(userDB *sqlutils.SQLRunner) {
598-
userDB.CheckQueryResults(t, `SELECT job_id FROM [SHOW CHANGEFEED JOBS]`, [][]string{{expectedJobIDStr}})
599-
})
600-
asUser(t, f, `regularUser`, func(userDB *sqlutils.SQLRunner) {
601-
userDB.CheckQueryResults(t, `SELECT job_id FROM [SHOW CHANGEFEED JOBS]`, [][]string{})
602-
})
603592
}
604593

605594
// Only enterprise sinks create jobs.

‎pkg/crosscluster/producer/replication_manager.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -442,7 +442,7 @@ func (r *replicationStreamManagerImpl) AuthorizeViaJob(
442442
}
443443

444444
if err := jobsauth.Authorize(
445-
ctx, planHook, jobspb.JobID(streamID), planHook.User(), jobspb.TypeReplicationStreamProducer, jobsauth.ControlAccess, globalPrivileges,
445+
ctx, planHook, jobspb.JobID(streamID), planHook.User(), jobsauth.ControlAccess, globalPrivileges,
446446
); err != nil {
447447
return err
448448
}

‎pkg/jobs/jobsauth/BUILD.bazel‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ go_library(
1313
"//pkg/sql/pgwire/pgerror",
1414
"//pkg/sql/privilege",
1515
"//pkg/sql/roleoption",
16-
"@com_github_cockroachdb_errors//:errors",
1716
],
1817
)
1918

‎pkg/jobs/jobsauth/authorization.go‎

Lines changed: 0 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ package jobsauth
77

88
import (
99
"context"
10-
"fmt"
1110

1211
"github.com/cockroachdb/cockroach/pkg/jobs/jobspb"
1312
"github.com/cockroachdb/cockroach/pkg/security/username"
@@ -16,7 +15,6 @@ import (
1615
"github.com/cockroachdb/cockroach/pkg/sql/pgwire/pgerror"
1716
"github.com/cockroachdb/cockroach/pkg/sql/privilege"
1817
"github.com/cockroachdb/cockroach/pkg/sql/roleoption"
19-
"github.com/cockroachdb/errors"
2018
)
2119

2220
// An AccessLevel is used to indicate how strict an authorization check should
@@ -31,23 +29,6 @@ const (
3129
ControlAccess
3230
)
3331

34-
var authorizers = make(map[jobspb.Type]Authorizer)
35-
36-
// Authorizer is a function which returns a pgcode.InsufficientPrivilege error if
37-
// authorization for the job denoted by jobID and payload fails.
38-
type Authorizer func(
39-
ctx context.Context, a AuthorizationAccessor, jobID jobspb.JobID, getLegacyPayload func(ctx context.Context) (*jobspb.Payload, error),
40-
) error
41-
42-
// RegisterAuthorizer registers a AuthorizationCheck for a certain job type.
43-
func RegisterAuthorizer(typ jobspb.Type, fn Authorizer) {
44-
if _, ok := authorizers[typ]; ok {
45-
panic(fmt.Sprintf("cannot register two authorizers for the type %s", typ))
46-
}
47-
48-
authorizers[typ] = fn
49-
}
50-
5132
// AuthorizationAccessor is an interface for checking authorization on jobs.
5233
type AuthorizationAccessor interface {
5334
// CheckPrivilegeForTableID mirrors sql.AuthorizationAccessor.
@@ -118,26 +99,6 @@ func Authorize(
11899
a AuthorizationAccessor,
119100
jobID jobspb.JobID,
120101
owner username.SQLUsername,
121-
typ jobspb.Type,
122-
accessLevel AccessLevel,
123-
global GlobalJobPrivileges,
124-
) error {
125-
126-
legacyAuthErrFunc := func(ctx context.Context) (*jobspb.Payload, error) {
127-
return nil, errors.New("legacy authorization check not implemented")
128-
}
129-
return AuthorizeAllowLegacyAuth(ctx, a, jobID, legacyAuthErrFunc, owner, typ, accessLevel, global)
130-
}
131-
132-
// AutherizeAllowLegacyAuth functions like Authorize, and also provides
133-
// the deprecated job-specific custom authorization check allows access.
134-
func AuthorizeAllowLegacyAuth(
135-
ctx context.Context,
136-
a AuthorizationAccessor,
137-
jobID jobspb.JobID,
138-
getLegacyPayload func(ctx context.Context) (*jobspb.Payload, error),
139-
owner username.SQLUsername,
140-
typ jobspb.Type,
141102
accessLevel AccessLevel,
142103
global GlobalJobPrivileges,
143104
) error {
@@ -186,9 +147,6 @@ func AuthorizeAllowLegacyAuth(
186147
return nil
187148
}
188149

189-
if check, ok := authorizers[typ]; ok {
190-
return check(ctx, a, jobID, getLegacyPayload)
191-
}
192150
return pgerror.Newf(pgcode.InsufficientPrivilege,
193151
"user %s does not have privileges for job %d",
194152
a.User(), jobID)

‎pkg/jobs/jobsauth/authorization_test.go‎

Lines changed: 2 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -149,21 +149,6 @@ func (a *testAuthAccessor) User() username.SQLUsername {
149149
return a.user
150150
}
151151

152-
func makeChangefeedPayload(owner string, tableIDs []descpb.ID) *jobspb.Payload {
153-
specs := make([]jobspb.ChangefeedTargetSpecification, len(tableIDs))
154-
for i, tableID := range tableIDs {
155-
specs[i] = jobspb.ChangefeedTargetSpecification{
156-
TableID: tableID,
157-
}
158-
}
159-
return &jobspb.Payload{
160-
Details: jobspb.WrapPayloadDetails(jobspb.ChangefeedDetails{
161-
TargetSpecifications: specs,
162-
}),
163-
UsernameProto: username.MakeSQLUsernameFromPreNormalizedString(owner).EncodeProto(),
164-
}
165-
}
166-
167152
func makeBackupPayload(owner string) *jobspb.Payload {
168153
return &jobspb.Payload{
169154
Details: jobspb.WrapPayloadDetails(jobspb.BackupDetails{}),
@@ -246,38 +231,6 @@ func TestAuthorization(t *testing.T) {
246231
payload: makeBackupPayload("user2"),
247232
accessLevel: jobsauth.ControlAccess,
248233
},
249-
{
250-
name: "changefeed-privilege-on-all-tables",
251-
user: username.MakeSQLUsernameFromPreNormalizedString("user1"),
252-
roleOptions: map[roleoption.Option]struct{}{},
253-
admins: map[string]struct{}{},
254-
changeFeedPrivileges: map[descpb.ID]struct{}{0: {}, 1: {}, 2: {}},
255-
256-
payload: makeChangefeedPayload("user2", []descpb.ID{0, 1, 2}),
257-
accessLevel: jobsauth.ControlAccess,
258-
},
259-
{
260-
name: "changefeed-privilege-on-some-tables",
261-
user: username.MakeSQLUsernameFromPreNormalizedString("user1"),
262-
roleOptions: map[roleoption.Option]struct{}{},
263-
admins: map[string]struct{}{},
264-
changeFeedPrivileges: map[descpb.ID]struct{}{0: {}, 1: {}},
265-
266-
payload: makeChangefeedPayload("user2", []descpb.ID{0, 1, 2}),
267-
accessLevel: jobsauth.ControlAccess,
268-
userErr: pgerror.New(pgcode.InsufficientPrivilege, "foo"),
269-
},
270-
{
271-
name: "changefeed-priv-on-some-tables-with-dropped",
272-
user: username.MakeSQLUsernameFromPreNormalizedString("user1"),
273-
roleOptions: map[roleoption.Option]struct{}{},
274-
admins: map[string]struct{}{},
275-
changeFeedPrivileges: map[descpb.ID]struct{}{0: {}, 1: {}},
276-
droppedDescriptors: map[descpb.ID]struct{}{2: {}},
277-
278-
payload: makeChangefeedPayload("user2", []descpb.ID{0, 1, 2}),
279-
accessLevel: jobsauth.ControlAccess,
280-
},
281234
{
282235
name: "viewjob-required-for-read-access",
283236
user: username.MakeSQLUsernameFromPreNormalizedString("user1"),
@@ -354,10 +307,9 @@ func TestAuthorization(t *testing.T) {
354307
ctx := context.Background()
355308
globalPrivileges, err := jobsauth.GetGlobalJobPrivileges(ctx, testAuth)
356309
assert.NoError(t, err)
357-
err = jobsauth.AuthorizeAllowLegacyAuth(
310+
err = jobsauth.Authorize(
358311
ctx, testAuth, 0,
359-
func(ctx context.Context) (*jobspb.Payload, error) { return tc.payload, nil },
360-
tc.payload.UsernameProto.Decode(), tc.payload.Type(), tc.accessLevel, globalPrivileges,
312+
tc.payload.UsernameProto.Decode(), tc.accessLevel, globalPrivileges,
361313
)
362314
assert.Equal(t, pgerror.GetPGCode(tc.userErr), pgerror.GetPGCode(err))
363315
})

0 commit comments

Comments
 (0)