Authorize operation details by admin scope and isolate scoped clients

pigway_frame_flow/api/app.py

@@ -815,11 +815,12 @@ def create_app(settings=None, start_worker=True):
         tags=["Operations"],
         dependencies=[Depends(require("history:read"))],
     )
-    def operations(limit: int = Query(default=50, ge=1, le=200)):
+    def operations(request: Request, limit: int = Query(default=50, ge=1, le=200)):
         return [
             service.operation(x["id"])
             for x in db.all(
-                "SELECT id FROM operations ORDER BY created_at DESC LIMIT ?", (limit,)
+                "SELECT id FROM operations WHERE (? OR client_id=?) ORDER BY created_at DESC LIMIT ?",
+                ("admin" in request.state.permissions, request.state.client_id, limit),
             )
         ]
 
@@ -831,7 +832,10 @@ def create_app(settings=None, start_worker=True):
     )
     def operation(operation_id: str, request: Request):
         op = service.operation(operation_id)
-        if request.state.client_id not in ("admin", op["client_id"]):
+        if (
+            "admin" not in request.state.permissions
+            and request.state.client_id != op["client_id"]
+        ):
             raise FlowError(E.FORBIDDEN, "Operation belongs to another client", 403)
         return op