Package io.jenkins.plugins.batchcontrol.ops

Class ConfigureWithoutGrantMonitor

java.lang.Object
hudson.model.AbstractModelObject
hudson.model.AdministrativeMonitor
io.jenkins.plugins.batchcontrol.ops.ConfigureWithoutGrantMonitor
All Implemented Interfaces:
ExtensionPoint, ModelObject, SearchableModelObject, SearchItem, org.kohsuke.stapler.StaplerProxy
@Extension @Restricted(org.kohsuke.accmod.restrictions.NoExternalUse.class) public class ConfigureWithoutGrantMonitor extends AdministrativeMonitor
Warns administrators when change control cannot actually control changes (SPEC item 8): change control is on, but either the global authorization strategy is not a Batch Control strategy (so grants can never apply, D-35a), or some known non-admin user holds Item/Configure, Item/Create, Item/Delete or Item/Move (D-59) directly from the strategy — a standing change permission that bypasses the JIT grant process.

The scan uses the strategy's root ACL, which carries no grant scope (S-13), so what it finds is always a native entry, never an open grant. It is also the scan's limit (S-07): per-item native permissions (matrix-auth job, folder and agent properties, role-strategy item roles) are not visible on the root ACL and are not detected. The monitor is best effort, not an inventory.

Candidate users come from User.getAll() plus, for matrix-family strategies, the strategy's own granted sids (read reflectively — matrix-auth is an optional dependency). The scan is capped at 100 candidates and every impersonation failure is swallowed: this is a best-effort warning, never an enforcement point.

S-05: isActivated() is evaluated by Jenkins on (almost) every admin page render, and the candidate scan performs up to 100 synchronous security-realm lookups (remote round-trips on LDAP/AD). The scan result is therefore cached per strategy strategy instance with a 5L-minute TTL (monotonic System.nanoTime()): a strategy swap recomputes immediately (identity key), a change-control toggle invalidates explicitly, and permission edits inside the same strategy show up within the TTL. The cheap pre-checks (switch off, wrong strategy) are never cached.