fix(security): scope workflow run dispatch and MCP run logs to the token's tags

2026-09-09 08:32:32 +00:00
parent 705085d3c7
commit 5fcfb40084
5 changed files with 47 additions and 6 deletions
@@ -581,7 +581,7 @@ func deleteWorkflow(c *gin.Context) {
 //	@Security		bearerAuth
 //	@Router			/workflows/{id}/run [post]
 func runWorkflow(c *gin.Context) {
-	runID, err := services.TriggerWorkflow(auth.InstanceID(c), c.Param("id"), actorFromCtx(c))
+	runID, err := services.TriggerWorkflow(auth.InstanceID(c), c.Param("id"), actorFromCtx(c), auth.ServerScope(c))
 	if err != nil {
 		if errors.Is(err, services.ErrNoTargets) {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "this workflow matches no servers"})