🚀 Feature: Scaffolder task list permissions

[drodil]

🔖 Feature description

The scaffolder task read permissions do not allow the creation of complex permissions. Currently, it's only on/off with the taskReadPermission, and no possibility to add conditions.

🎤 Context

We would like to limit the listed tasks so that:

1. The user can see his own runs
2. The template owner can see all runs of that template
3. If the user doesn't have read access to the template entity, the task should be hidden

The number 3 is not really that big of an issue as the template name seems to be hidden in the task list if the user does not have access to it but it still allows user to see the output + logs of the run.

✌️ Possible Implementation

Add additional conditions for the taskReadPermission. At least the following rules should be available:

• isTaskCreator - should filter based on the createdBy column using the current user entity ref
• hasCreatedBy - should filter based on the createdBy column in the SerializedTask
• hasTemplateEntityRef - should filter based on the spec.templateInfo.entityRef in the spec column of SerializedTask. This requires some JSON query magic
• hasTemplateAccess - should also filter by template entityRef but include only template references the user has access to. Probably requires a catalog call to get the entity refs.

Additionally, some other rules that could be done:

• hasStatus - should filter by task status

👀 Have you spent some time to check if this feature request has been raised before?

• I checked and didn't find similar issue

🏢 Have you read the Code of Conduct?

• I have read the Code of Conduct

Are you willing to submit PR?

None

[stephenglass]

PR #25969 is relevant however there are still some changes requested