What does this MR do and why?
Scopes user-scoped runner listings by the user's organizations so that multi-org users only see runners from organizations they belong to. The finder additionally accepts an optional organization_id parameter to narrow results to a specific organization.
Problem: The user-scoped path (User#ci_available_runners via GET /runners, currentUser { runners }) unions runners from all groups/projects the user has access to across all organizations. Once a user has multi-org membership, this query returns runners from every organization where they hold the required role -- with no filtering by organization.
Paths not affected:
-
Admin paths (
Ci::Runner.all): Return all runners on the cell -- correct by design (admins are cell-scoped)
-
Project/group-scoped paths: Safe by construction -- runners are derived through hierarchy joins scoped to a single group/project, and access is guarded by declarative policy checks (
can?(@current_user, :read_runners, @group/@project)) which verify the user has the required role on that specific resource
Design: two-layer organization filtering
Organization filtering is applied in two layers as a defense-in-depth measure:
-
Model layer (User#ci_available_runners): Always scopes results to runners belonging to the user's own organizations via .in_organization(organizations.pluck(:id)). The pluck resolves org IDs on the main DB first, avoiding cross-database subqueries. This ensures a user can never see runners from an organization they don't belong to, regardless of what the caller passes.
-
Finder layer (Ci::RunnersFinder#user_runners): When an organization_id parameter is provided (e.g. from Current.organization), narrows results further to that specific organization. This is the presentation filter for "show me runners in the current org context."
The model layer acts as a security boundary, while the finder layer provides the UX-level scoping. Even if a caller passes a malicious organization_id, the model layer prevents data leakage.
Changes
-
app/models/ci/runner.rb -- Add .in_organization(organization_id) scope. Accepts a scalar ID or an array. Instance runners (which have NULL organization_id by design) are naturally excluded by the WHERE clause
-
app/models/user.rb -- ci_available_runners now chains .in_organization(organizations.pluck(:id)) to scope results to the user's own organizations. Uses pluck to resolve IDs on main DB, avoiding cross-database subqueries with the CI DB
-
app/finders/ci/runners_finder.rb -- Add user_runners method that optionally narrows results further by organization_id param when provided
Database queries
Since ci_runners lives on the CI database while organizations/organization_users live on the main database, organizations.pluck(:id) is resolved on the main DB first. The resulting array of org IDs is then passed as literals to the CI DB query. Normally, this will be a single value, since users normally belong to a single organization.
1. Original query -- no org filter (query plan):
SELECT COUNT(*) FROM ((SELECT "ci_runners".* FROM "ci_runners"
INNER JOIN "ci_runner_projects" ON "ci_runner_projects"."runner_id" = "ci_runners"."id"
WHERE "ci_runner_projects"."project_id" = ANY ('{...}'::integer[]))
UNION
(WITH "cte_namespace_ids" AS MATERIALIZED (
SELECT "ci_namespace_mirrors"."namespace_id" FROM "ci_namespace_mirrors"
WHERE ((traversal_ids[1]) = ANY ('{36425,36427,5268246}'::integer[])))
SELECT "ci_runners".* FROM "ci_runners"
INNER JOIN "ci_runner_namespaces" ON "ci_runner_namespaces"."runner_id" = "ci_runners"."id"
WHERE ci_runner_namespaces.namespace_id IN (SELECT namespace_id FROM cte_namespace_ids)))
ci_runners;
2. Model layer -- scoped to user's organizations (query plan):
SELECT COUNT(*) FROM (...same union...) ci_runners
WHERE "ci_runners"."organization_id" IN (<user's org IDs from main DB>);
3. Both layers -- model + finder organization_id param (query plan):
SELECT COUNT(*) FROM (...same union...) ci_runners
WHERE "ci_runners"."organization_id" IN (<user's org IDs>) AND "ci_runners"."organization_id" = 1;
References
Screenshots or screen recordings
Not applicable -- backend service change only.
How to set up and validate locally
- Open a Rails console and create test data:
org_a = Organizations::Organization.first
org_b = create(:organization)
group_a = create(:group, organization: org_a)
group_b = create(:group, organization: org_b)
runner_a = create(:ci_runner, :group, groups: [group_a])
runner_b = create(:ci_runner, :group, groups: [group_b])
user = create(:user, owner_of: [group_a, group_b])
- Verify the model scopes to the user's organizations:
user.ci_available_runners.to_sql
# => includes WHERE organization_id IN (1, <org_b.id>)
- Verify the finder narrows by organization_id:
Ci::RunnersFinder.new(current_user: user, params: { user: user, organization_id: org_a.id }).execute
# => returns only runner_a
- Run the specs:
bundle exec rspec spec/models/ci/runner_spec.rb -e 'in_organization' --format documentation
bundle exec rspec spec/finders/ci/runners_finder_spec.rb -e 'organization' --format documentation
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist.
It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Changelog: other
