feature: Exec permission denied now marks the action as "blocked" and adds a log message. Timeouts also add a documentation link to the command output. Tags always set. (#398)

internal/executor/executor.go

@@ -315,7 +315,18 @@ func stepRateCheck(req *ExecutionRequest) bool {
 }
 
 func stepACLCheck(req *ExecutionRequest) bool {
-	return acl.IsAllowedExec(req.Cfg, req.AuthenticatedUser, req.Action)
+	canExec := acl.IsAllowedExec(req.Cfg, req.AuthenticatedUser, req.Action)
+
+	if !canExec {
+		req.logEntry.Output = "ACL check failed. Blocked from executing."
+		req.logEntry.Blocked = true
+
+		log.WithFields(log.Fields{
+			"actionTitle": req.logEntry.ActionTitle,
+		}).Warnf("ACL check failed. Blocked from executing.")
+	}
+
+	return canExec
 }
 
 func stepParseArgs(req *ExecutionRequest) bool {
@@ -359,6 +370,7 @@ func stepRequestAction(req *ExecutionRequest) bool {
 	req.logEntry.ActionTitle = sv.ReplaceEntityVars(req.EntityPrefix, req.Action.Title)
 	req.logEntry.ActionIcon = req.Action.Icon
 	req.logEntry.ActionId = req.Action.ID
+	req.logEntry.Tags = req.Tags
 
 	req.executor.logmutex.Lock()
 
@@ -479,9 +491,9 @@ func stepExec(req *ExecutionRequest) bool {
 		// The context timeout should kill the process, but let's make sure.
 		req.executor.Kill(req.logEntry)
 		req.logEntry.TimedOut = true
+		req.logEntry.Output += "This OliveTin action timed out after " + fmt.Sprintf("%v", req.Action.Timeout) + " seconds. If you need more time for this action, set a longer timeout. See https://docs.olivetin.app/timeout.html for more help."
 	}
 
-	req.logEntry.Tags = req.Tags
 	req.logEntry.DatetimeFinished = time.Now()
 
 	return true