Users are not authorized to view Cohort Pathway executions

[t-abdul-basser]

Expected behavior

Users are authorized to view Cohort Pathway executions and can view them.

Actual behavior

Users are not authorized to view Cohort Pathway executions and can not view them.

Steps to reproduce behavior

1. Login to Atlas
2. In Cohort Pathway > Execution, click on View latest result or Executions
3. Failed authorized popover message appears.

Error Message:

See no. 3 above.

Supporting Materials:

Version: Atlas 2.14.1
Environment: Linux/Kubernetes (Kind Cluster)

Is this something that you have come across before @anthonysena @chrisknoll?

[chrisknoll]

I've made some PRs to optimize permissions and support wildcard perms, but it's not in a hotfix (or otherwise) release. The 2.14 version of atlas you're using had a fix related to refesh token, but I am not sure if that would impact you here (refresh token is called when you create an entity and you need to update permissions for the new item).

In java console, can you confirm if it says the requested URI got a 403 result (that would be an auth error).

A more involved approach: we can debug the client side code but the 'bundled' form is a bit harder to debug...if you have a dev environment that you can reproduce, then that would be easier, but if you want to do something to trace code in your live environment, you can change some things on your server to run in non-bundled mode so you can set breakpoints easier.

To do that, just change the following (from https://github.com/OHDSI/Atlas/blob/master/index.html#L118):

	<!-- non-bundled mode -->
	<script data-main="js/main" src="js/require.js"></script>

	<!-- bundled mode -->
	<!-- <script data-main="js/assets/bundle/bundle" src="js/require.js"></script>-->

If you swap the HTML comment to comment out the bundled mode and uncomment non-bundled (as shown above) you should get the App downloaded in non-bundled state letting you set breakpoints.

The security checks are performed in authAPI.js.

However! Looking through this code, I can't seem to find anything related to CohortPathways which might mean that Pathways is doing something different than the other pages (sadface) so....if you can do the above steps to get the specific place where the permission check is failing, that can help us figure out where to start on a fix.

[t-abdul-basser]

Thanks @chrisknoll: I have begun to trace this. I will reach out again shortly. Thanks again.