Restrict access to shared running workspaces

[jldec]

This issue specifically covers MVC access restriction on shared running workspaces
Any of the following would be a reasonable first step.

• A modification of the default behavior to limit access to users who can access the underlying repo (similar to Epic: Restrict access to snapshot URLs #8257)
• A team-level configuration flag turning the feature on/off for all workspaces associated with a team
• A team-level configuration flag limiting shared access to members of a team

[jldec]

Note workspace aspect (from comment)

Running workspace access is mediated by ws-proxy, who has no notion of the authentication on server side. We'd need to introduce guest tokens (which we conceived of when we introduced the owner token, hence the name).

cc: @atduarte , @gtsiolis

[csweichel]

A team-level configuration flag limiting shared access to members of a team

(expansion on #13188 (comment))

When we originally built the workspace sharing feature we made provisions for this.

To implement team-level sharing (or any other form of "scoped" runtime sharing), we'd extend the current workspace admission spec with a "team" mode. This would cause ws-manager to produce a guest token (in addition to today's owner token) which is valid until the admission is changed to a different mode. The fetchWorkspaceToken call would then return this guest token to anyone authorised to access the workspace.

[csweichel]

• A modification of the default behavior to limit access to users who can access the underlying repo (similar to Epic: Restrict access to snapshot URLs #8257)
• A team-level configuration flag turning the feature on/off for all workspaces associated with a team

Both features, IMHO live well in the scope of a "policy skateboard" we should be thinking about.

[csweichel]

A short term fix would be to introduce a query token that needs to be passed in order to access a shared workspace. I.e. knowing the URL is not enough.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.