netgroup-polito / CrownLabs / 40742616293

37%

master: 37%

Pull #1227

github

feat(operators): only workspace managers can set jobPriorityClass in the tenant webhook

CalculateWorkspacesDiff compared the workspace entries of a tenant by name
and role only, so a change to jobPriorityClass alone was not seen as a
change, and a tenant could raise their own job priority.

- CalculateWorkspacesDiff now compares whole entries: an entry is changed
  when it is added or removed, or when its role or jobPriorityClass
  differs. In HandleWorkspaceEdit, only a manager of that workspace can
  set or change a member's jobPriorityClass, as for the role.
- HandleSelfEdit refuses any change to jobPriorityClass in the tenant's
  own entries, including a new entry that sets it. Removing an entry
  works as before.
- Bypass groups are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

16 of 205 new or added lines in 4 files covered. (7.8%)

6550 of 17869 relevant lines covered (36.66%)

8.24 hits per line