fix: restrict compute log streaming to job owners and authorized viewers

[AdriGeorge]

Restrict compute log access to the job owner and additional viewers, using the authenticated user's address.

Summary by CodeRabbit

• Bug Fixes
  • Job log streams are now available only to authenticated callers with a non-empty address who own the job or have been granted viewer access.
  • Requests without an authenticated address receive an authorization error and no log stream.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: af648754-c103-466d-bfff-c0e59b4f17bf

📥 Commits

Reviewing files that changed from the base of the PR and between a22dbb0 and efe1c9e.

📒 Files selected for processing: 3

• src/components/c2d/compute_engine_base.ts
• src/components/c2d/compute_engine_docker.ts
• src/components/core/compute/getStreamableLogs.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The log-streaming handler now requires an authenticated address and passes it to the compute engine. The Docker engine returns no stream for an empty address and checks whether the caller is the job owner or an additional viewer.

Changes: Log stream access

Layer / File(s)	Summary
Authenticated log-stream access src/components/c2d/compute_engine_base.ts, src/components/core/compute/getStreamableLogs.ts, src/components/c2d/compute_engine_docker.ts	The engine method now accepts a consumer address. The handler returns HTTP 401 if the authenticated address is missing and passes the address to the engine. The Docker engine returns null for an empty address and permits streaming only for the job owner or an additional viewer.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant ComputeGetStreamableLogsHandler
  participant C2DEngineDocker
  Caller->>ComputeGetStreamableLogsHandler: Request log stream
  ComputeGetStreamableLogsHandler->>ComputeGetStreamableLogsHandler: Require authenticated address
  ComputeGetStreamableLogsHandler->>C2DEngineDocker: getStreamableLogs(jobId, consumerAddress)
  C2DEngineDocker->>C2DEngineDocker: Check owner or additional viewer
  C2DEngineDocker-->>ComputeGetStreamableLogsHandler: Stream or null

Loading

Merge Risk: ⚪ Minimal · up to efe1c

Log access is restricted to the job owner or an authorized viewer, and denied requests are handled without a stream. No concrete merge-blocking risk was found.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: restricting compute log streaming to job owners and authorized viewers.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}