Merge pull request #295 from keboola/odin-SOX-193

Fix execution token permissisons

Author: odinuv

src/JobFactory/Job.php

@@ -378,6 +378,9 @@ private function createPrivilegedToken(string $applicationToken): string
     {
         $tokens = new Tokens($this->getStorageClientWrapper()->getBasicClient());
         $options = new TokenCreateOptions();
+        $options->setDescription(sprintf('Execution Token for job %s', $this->getId()));
+        $options->setCanManageBuckets(true);
+        $options->setCanReadAllFileUploads(true);
         $options->setExpiresIn(self::EXECUTION_TOKEN_TIMEOUT_SECONDS);
         $token = $tokens->createTokenPrivilegedInProtectedDefaultBranch($options, $applicationToken);
 

tests/JobFactory/JobTest.php

@@ -829,6 +829,9 @@ public function testGetExecutionTokenDecryptedWithFeatureBranchDefault(): void
                 [
                     'canManageProtectedDefaultBranch' => true,
                     'expiresIn' => 604800,
+                    'description' => 'Execution Token for job 123456456',
+                    'canReadAllFileUploads' => true,
+                    'canManageBuckets' => true,
                 ],
                 $applicationToken
             )