Fix permissions checks for stopping prebuilds (#20043)

Author: filiptronicek

components/server/src/prebuilds/prebuild-manager.ts

@@ -213,13 +213,14 @@ export class PrebuildManager {
 
     async cancelPrebuild(ctx: TraceContext, userId: string, prebuildId: string): Promise<void> {
         const prebuild = await this.workspaceDB.trace(ctx).findPrebuildByID(prebuildId);
-        if (prebuild) {
-            await this.auth.checkPermissionOnProject(userId, "write_prebuild", prebuild.projectId!);
-        }
         if (!prebuild) {
             throw new ApplicationError(ErrorCodes.NOT_FOUND, `prebuild ${prebuildId} not found`);
         }
-        await this.workspaceService.stopWorkspace(userId, prebuild.buildWorkspaceId, "stopped via API");
+
+        await this.auth.checkPermissionOnProject(userId, "write_prebuild", prebuild.projectId!);
+        await this.workspaceService.stopWorkspace(userId, prebuild.buildWorkspaceId, "stopped via API", undefined, {
+            skipPermissionCheck: true,
+        });
     }
 
     async getPrebuild(

components/server/src/workspace/workspace-service.ts

@@ -333,8 +333,11 @@ export class WorkspaceService {
         workspaceId: string,
         reason: string,
         policy?: StopWorkspacePolicy,
+        options: { skipPermissionCheck?: boolean } = {},
     ): Promise<void> {
-        await this.auth.checkPermissionOnWorkspace(userId, "stop", workspaceId);
+        if (!options.skipPermissionCheck) {
+            await this.auth.checkPermissionOnWorkspace(userId, "stop", workspaceId);
+        }
 
         const workspace = await this.doGetWorkspace(userId, workspaceId);
         const instance = await this.db.findRunningInstance(workspace.id);

components/supervisor/pkg/supervisor/tasks.go

@@ -34,7 +34,7 @@ func (sub *tasksSubscription) Updates() <-chan []*api.TaskStatus {
 	return sub.updates
 }
 
-const maxSubscriptions = 10
+const maxSubscriptions = 100
 
 func (tm *tasksManager) Subscribe() *tasksSubscription {
 	tm.mu.Lock()