From 33fb08cf3d08c4a6b86f32b3ae8bf2df8c1adcaa Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Fri, 6 Feb 2026 07:18:38 +0100 Subject: [PATCH] fix: make notify_event trigger functions SECURITY DEFINER (#7826) Co-authored-by: Claude Opus 4.6 --- ...5_notify_triggers_security_definer.down.sql | 12 ++++++++++++ ...555_notify_triggers_security_definer.up.sql | 18 ++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 backend/migrations/20260206060555_notify_triggers_security_definer.down.sql create mode 100644 backend/migrations/20260206060555_notify_triggers_security_definer.up.sql diff --git a/backend/migrations/20260206060555_notify_triggers_security_definer.down.sql b/backend/migrations/20260206060555_notify_triggers_security_definer.down.sql new file mode 100644 index 0000000000..29cd3a7a48 --- /dev/null +++ b/backend/migrations/20260206060555_notify_triggers_security_definer.down.sql @@ -0,0 +1,12 @@ +ALTER FUNCTION notify_config_change() SECURITY INVOKER; +ALTER FUNCTION notify_global_setting_change() SECURITY INVOKER; +ALTER FUNCTION notify_global_setting_delete() SECURITY INVOKER; +ALTER FUNCTION notify_webhook_change() SECURITY INVOKER; +ALTER FUNCTION notify_workspace_envs_change() SECURITY INVOKER; +ALTER FUNCTION notify_workspace_premium_change() SECURITY INVOKER; +ALTER FUNCTION notify_team_plan_status_change() SECURITY INVOKER; +ALTER FUNCTION notify_runnable_version_change() SECURITY INVOKER; +ALTER FUNCTION notify_http_trigger_change() SECURITY INVOKER; +ALTER FUNCTION notify_token_invalidation() SECURITY INVOKER; +ALTER FUNCTION notify_workspace_key_change() SECURITY INVOKER; +ALTER FUNCTION notify_workspace_rate_limit_change() SECURITY INVOKER; diff --git a/backend/migrations/20260206060555_notify_triggers_security_definer.up.sql b/backend/migrations/20260206060555_notify_triggers_security_definer.up.sql new file mode 100644 index 0000000000..137aa8183e --- /dev/null +++ b/backend/migrations/20260206060555_notify_triggers_security_definer.up.sql @@ -0,0 +1,18 @@ +-- Make all notify_event trigger functions SECURITY DEFINER so that +-- INSERT INTO notify_event runs as the function owner (typically the +-- superuser that created the function) rather than the invoking role. +-- This prevents "permission denied for table notify_event" errors when +-- windmill_user or windmill_admin fire these triggers. + +ALTER FUNCTION notify_config_change() SECURITY DEFINER; +ALTER FUNCTION notify_global_setting_change() SECURITY DEFINER; +ALTER FUNCTION notify_global_setting_delete() SECURITY DEFINER; +ALTER FUNCTION notify_webhook_change() SECURITY DEFINER; +ALTER FUNCTION notify_workspace_envs_change() SECURITY DEFINER; +ALTER FUNCTION notify_workspace_premium_change() SECURITY DEFINER; +ALTER FUNCTION notify_team_plan_status_change() SECURITY DEFINER; +ALTER FUNCTION notify_runnable_version_change() SECURITY DEFINER; +ALTER FUNCTION notify_http_trigger_change() SECURITY DEFINER; +ALTER FUNCTION notify_token_invalidation() SECURITY DEFINER; +ALTER FUNCTION notify_workspace_key_change() SECURITY DEFINER; +ALTER FUNCTION notify_workspace_rate_limit_change() SECURITY DEFINER;