Fix troubleshoot_job policy for self-hosted models and update Cloud Connector gem
Summary
We identified a missing troubleshoot_job feature in the Cloud Connector gem and a bug in the policy defined in troubleshoot_job_policy_helper.rb. The current implementation does not properly handle self-hosted models — specifically, the service name is missing, which leads to authorization issues for customers.
This issue does not affect engineers internally, as we have CLOUD_CONNECTOR_SELF_SIGN_TOKENS=1 enabled. However, this variable is not available or recommended for customer use.
Steps to Resolve
-
Add troubleshoot_jobto the Self-Hosted Models config in the Cloud Connector gem -
Bump the gem version to pull the updated config:
version.rb -
Update the policy check in troubleshoot_job_policy_helper.rbto account for self-hosted models:allowed_to_use?(:troubleshoot_job, :self_hosted_models) -
Upgrade the cloud connector gem in the Rails app to the bumped version -
Backport the Rails-side changes to 17.10 (pending the decision) (Decision is not to backport this #527128 (comment 2427766507))
Important Note
Please do not rely on CLOUD_CONNECTOR_SELF_SIGN_TOKENS=1. While it allows internal testing by granting full access, it should not be used in production or by customers.
Edited by Mohamed Hamda