{"action":"created","issue":{"url":"https://api.github.com/repos/OctopusDeploy/Issues/issues/4307","repository_url":"https://api.github.com/repos/OctopusDeploy/Issues","labels_url":"https://api.github.com/repos/OctopusDeploy/Issues/issues/4307/labels{/name}","comments_url":"https://api.github.com/repos/OctopusDeploy/Issues/issues/4307/comments","events_url":"https://api.github.com/repos/OctopusDeploy/Issues/issues/4307/events","html_url":"https://github.com/OctopusDeploy/Issues/issues/4307","id":298848421,"number":4307,"title":"Subscriptions permission bug with Machine events","user":{"login":"thebigmoosey","id":819605,"avatar_url":"https://avatars1.githubusercontent.com/u/819605?v=4","gravatar_id":"","url":"https://api.github.com/users/thebigmoosey","html_url":"https://github.com/thebigmoosey","followers_url":"https://api.github.com/users/thebigmoosey/followers","following_url":"https://api.github.com/users/thebigmoosey/following{/other_user}","gists_url":"https://api.github.com/users/thebigmoosey/gists{/gist_id}","starred_url":"https://api.github.com/users/thebigmoosey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thebigmoosey/subscriptions","organizations_url":"https://api.github.com/users/thebigmoosey/orgs","repos_url":"https://api.github.com/users/thebigmoosey/repos","events_url":"https://api.github.com/users/thebigmoosey/events{/privacy}","received_events_url":"https://api.github.com/users/thebigmoosey/received_events","type":"User","site_admin":false},"labels":[{"id":509292211,"url":"https://api.github.com/repos/OctopusDeploy/Issues/labels/area/modelling","name":"area/modelling","color":"006b75","default":false},{"id":62440875,"url":"https://api.github.com/repos/OctopusDeploy/Issues/labels/bug","name":"bug","color":"eb6420","default":true}],"state":"closed","locked":false,"assignee":{"login":"NickJosevski","id":119096,"avatar_url":"https://avatars1.githubusercontent.com/u/119096?v=4","gravatar_id":"","url":"https://api.github.com/users/NickJosevski","html_url":"https://github.com/NickJosevski","followers_url":"https://api.github.com/users/NickJosevski/followers","following_url":"https://api.github.com/users/NickJosevski/following{/other_user}","gists_url":"https://api.github.com/users/NickJosevski/gists{/gist_id}","starred_url":"https://api.github.com/users/NickJosevski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NickJosevski/subscriptions","organizations_url":"https://api.github.com/users/NickJosevski/orgs","repos_url":"https://api.github.com/users/NickJosevski/repos","events_url":"https://api.github.com/users/NickJosevski/events{/privacy}","received_events_url":"https://api.github.com/users/NickJosevski/received_events","type":"User","site_admin":false},"assignees":[{"login":"NickJosevski","id":119096,"avatar_url":"https://avatars1.githubusercontent.com/u/119096?v=4","gravatar_id":"","url":"https://api.github.com/users/NickJosevski","html_url":"https://github.com/NickJosevski","followers_url":"https://api.github.com/users/NickJosevski/followers","following_url":"https://api.github.com/users/NickJosevski/following{/other_user}","gists_url":"https://api.github.com/users/NickJosevski/gists{/gist_id}","starred_url":"https://api.github.com/users/NickJosevski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NickJosevski/subscriptions","organizations_url":"https://api.github.com/users/NickJosevski/orgs","repos_url":"https://api.github.com/users/NickJosevski/repos","events_url":"https://api.github.com/users/NickJosevski/events{/privacy}","received_events_url":"https://api.github.com/users/NickJosevski/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2018-02-21T05:40:03Z","updated_at":"2018-03-02T00:23:27Z","closed_at":"2018-03-02T00:21:29Z","author_association":"NONE","body":"We have a bug in our permission system when querying the [Event] table for machines, when your team has restricted scope permissions to one or many environments and/or tenants.\r\n\r\nBecause machines can be scoped to one or many environments (and/or tenants), you can end up with `NULL` entries in the [EnvironmentId] and [TenantId] column for the [Event] table's machine entries, and instead these multiple values are entered into the [RelatedDocumentIds] column (and corresponding [EventRelatedDocument] table), which is correct from a data modelling point-of-view.\r\n\r\nThe problem comes when our `ScopedPermissionRequiredRule` tries to apply permissions, it assumes there's a single [EnvironmentId] and [TenantId] column, so when the query executes, it finds no events and returns an empty collection.\r\n\r\nE.g. see the following machine events in the [Event] table:\r\n\r\n![event-permission-problems-with-machines](https://user-images.githubusercontent.com/819605/36464571-535eda7e-171c-11e8-91e2-8e2c0ed6f484.png)\r\n\r\nOur `ScopedPermissionRequiredRule` is being applied by our subscriptions code (and various other places possibly?) as follows:\r\n\r\n```\r\nvar rule = new ScopedPermissionRequiredRule(typeof(Event), Permission.EventView);\r\nvar userEventsQuery = rule.Customize(eventsQuery, userContext);\r\n``` \r\nhttps://github.com/OctopusDeploy/OctopusDeploy/blob/66e21a7ab26d8bdd37d2c26521587ad011128813/source/Octopus.Server/Schedules/EventNotifications/NotificationCreator.cs#L162\r\n\r\nwhich will end up adding query conditions based on the user's teams, so you end up with query conditions like this:\r\n\r\n```\r\n((([EnvironmentId] = 'Environments-21' OR [EnvironmentId] = 'Environments-2') AND ([TenantId] = 'Tenants-21')))\r\n```\r\n\r\nwhich don't match any machine-related events in the [Event] table (because this data is instead in the [EventRelatedDocument] table), so the user receives no subscription email and/or webhook = 💥 :)\r\n\r\n## Proposed Solution\r\n\r\nWe add a new `ScopedPermissionRequiredRule` specifically for dealing with the [Event] table's corresponding [EventRelatedDocument] table, which will contain ALL the possible environment and/or tenant ids related to the machine event.\r\n\r\nSource: https://secure.helpscout.net/conversation/527641163?folderId=801354\r\nand we also have a private Slack thread from the community Slack from the user who reported this, with additional screenshots. \r\n\r\n## Related Follow-up Issue\r\n\r\nFrom the customer:\r\n> I have noticed another permission related issue. When I added myself to the tenant restricted team, check health of a server returns no result even though I'm still on the admin team. As soon as I removed myself from that restricted team, health check returns with proper result again. Might be related? Or it's a different issue.\r\n\r\nThis sounds like the same permission problem is occurring during health checks. Could we investigate this while we're here, OR if this sounds like a completely separate issue, we can create a related issue."},"comment":{"url":"https://api.github.com/repos/OctopusDeploy/Issues/issues/comments/369778108","html_url":"https://github.com/OctopusDeploy/Issues/issues/4307#issuecomment-369778108","issue_url":"https://api.github.com/repos/OctopusDeploy/Issues/issues/4307","id":369778108,"user":{"login":"NickJosevski","id":119096,"avatar_url":"https://avatars1.githubusercontent.com/u/119096?v=4","gravatar_id":"","url":"https://api.github.com/users/NickJosevski","html_url":"https://github.com/NickJosevski","followers_url":"https://api.github.com/users/NickJosevski/followers","following_url":"https://api.github.com/users/NickJosevski/following{/other_user}","gists_url":"https://api.github.com/users/NickJosevski/gists{/gist_id}","starred_url":"https://api.github.com/users/NickJosevski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NickJosevski/subscriptions","organizations_url":"https://api.github.com/users/NickJosevski/orgs","repos_url":"https://api.github.com/users/NickJosevski/repos","events_url":"https://api.github.com/users/NickJosevski/events{/privacy}","received_events_url":"https://api.github.com/users/NickJosevski/received_events","type":"User","site_admin":false},"created_at":"2018-03-02T00:23:27Z","updated_at":"2018-03-02T00:23:27Z","author_association":"NONE","body":"Release Note: Fixed subscriptions and web hooks that were not firing for users who had scoped permissions."}}
{"actor":{"display_login":"NickJosevski"}}