jobs don't need root tag

api/jobs/handlers.py

@@ -288,9 +288,12 @@ class JobsHandler(base.RequestHandler):
         return Queue.get_statistics()
 
     def next(self):
-        if not self.superuser_request:
+
+        user = config.db.users.find_one({'_id': self.uid})
+        if not self.superuser_request and not user.get('root'):
             self.abort(403, 'Request requires superuser')
 
+
         tags = self.request.GET.getall('tags')
         if len(tags) <= 0:
             tags = None
@@ -314,9 +317,12 @@ class JobHandler(base.RequestHandler):
     """Provides /Jobs/<jid> routes."""
 
     def get(self, _id):
-        if not self.superuser_request:
+
+        user = config.db.users.find_one({'_id': self.uid})
+        if not self.superuser_request and not user.get('root'):
             self.abort(403, 'Request requires superuser')
 
+
         return Job.get(_id)
 
     def get_config(self, _id):
@@ -398,10 +404,11 @@ class JobHandler(base.RequestHandler):
 
     def add_logs(self, _id):
         """Add to a job's logs"""
-
-        if not self.superuser_request:
+        user = config.db.users.find_one({'_id': self.uid})
+        if not self.superuser_request and not user.get('root'):
             self.abort(403, 'Request requires superuser')
 
+
         doc = self.request.json
 
         try:

test/integration_tests/python/test_jobs.py

@@ -61,8 +61,9 @@ def test_jobs(data_builder, as_user, as_admin, as_root):
     assert r.json()['logs'] == []
 
     # try to add job log w/o root
+    # needed to use as_user because root = true for as_admin
     job_logs = [{'fd': 1, 'msg': 'Hello'}, {'fd': 2, 'msg': 'World'}]
-    r = as_admin.post('/jobs/' + job1_id + '/logs', json=job_logs)
+    r = as_user.post('/jobs/' + job1_id + '/logs', json=job_logs)
     assert r.status_code == 403
 
     # try to add job log to non-existent job
@@ -87,7 +88,8 @@ def test_jobs(data_builder, as_user, as_admin, as_root):
     assert r.ok
 
     # try to update job (user may only cancel)
-    r = as_admin.put('/jobs/' + job1_id, json={'test': 'invalid'})
+    # root = true for as_admin, until thats fixed, using user
+    r = as_user.put('/jobs/' + job1_id, json={'test': 'invalid'})
     assert r.status_code == 403
 
     # try to cancel job w/o permission (different user)