Added permission checking to event bus so that it only report changes for

objects that the user has current read permission.

diff --git a/services/api/lib/eventbus.rb b/services/api/lib/eventbus.rb
index 30b400cbe5245a77b8eebd00b3fcfba733fc45b9..26674b708837bf1ea1bffff74580e1986a1f1653 100644 (file)
--- a/services/api/lib/eventbus.rb
+++ b/services/api/lib/eventbus.rb
@@ -2,6 +2,13 @@ require 'eventmachine'
 require 'oj'
 require 'faye/websocket'
 
+module Faye
+  class WebSocket
+    attr_accessor :user
+    attr_accessor :last_log_id
+  end
+end
+
 class EventBus
   include CurrentApiClient
 
@@ -18,9 +25,16 @@ class EventBus
       return
     end
 
+    ws.user = current_user
+
     sub = @channel.subscribe do |msg|
       Log.where(id: msg.to_i).each do |l|
-        ws.send(l.as_api_response.to_json)
+        if rsc = ArvadosModel::resource_class_for_uuid(l.object_uuid)
+          rsc.readable_by(ws.user).where(uuid: l.object_uuid).each do
+            ws.send(l.as_api_response.to_json)
+          end
+        end
+        ws.last_log_id = msg.to_i
       end
     end