From 3528054801f85bd1ab796911288c428c1698ca30 Mon Sep 17 00:00:00 2001 From: Guilhem Lemouel Date: Wed, 9 Sep 2026 12:43:40 +0200 Subject: [PATCH] docs: name the real deploy path and stop restating the RLS constraint `update_path` is not a symbol in this repo; a script move goes through `create_script`. The re-assert's comment re-derived the disclosure argument that already sits on `resolve_moved_to_in`, where a caller would break it. Co-Authored-By: Claude Opus 5 (1M context) --- backend/tests/fixtures/drafts_moved_rls.sql | 6 +++--- backend/windmill-api/src/drafts.rs | 7 ------- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/backend/tests/fixtures/drafts_moved_rls.sql b/backend/tests/fixtures/drafts_moved_rls.sql index 104fcb27c5..3dea7a8d64 100644 --- a/backend/tests/fixtures/drafts_moved_rls.sql +++ b/backend/tests/fixtures/drafts_moved_rls.sql @@ -2,9 +2,9 @@ -- -- Models a script that has already been moved out of a folder the saver can -- reach (`mvrls_visible`, where test-user-2 is a writer) and into one they have --- no permission on (`mvrls_secret`). A script move archives the row in place and --- creates a new one carrying the old hash in `parent_hashes`, so this is exactly --- the state `update_path` leaves behind. +-- no permission on (`mvrls_secret`). A script move goes through `create_script`, +-- which archives the row in place and inserts a successor carrying the old hash +-- in `parent_hashes` — the state reproduced here. INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms, created_by) VALUES ('test-workspace', 'mvrls_visible', 'Visible', '{"u/test-user"}', diff --git a/backend/windmill-api/src/drafts.rs b/backend/windmill-api/src/drafts.rs index bce16460c3..31360a04f8 100644 --- a/backend/windmill-api/src/drafts.rs +++ b/backend/windmill-api/src/drafts.rs @@ -791,13 +791,6 @@ async fn update_draft( // // Run on the connection we already hold: acquiring a second from the // same pool while this transaction is open is the two-connection stall. - // That connection is RLS-scoped, and has to be: the write gate cleared - // the OLD path, and this asks where the item WENT. On a raw pool - // connection this answers from rows the pre-check cannot see, so a - // destination in a folder the caller has no permission on would both be - // disclosed to them and permanently refuse their save — where the - // pre-check's "can't see where it went ⇒ save normally" fallback says it - // should land. if applied.is_some() && !deployed_still_at(&mut tx, &w_id, kind, path).await? { if let Some((moved_to, moved_by, moved_patch)) = resolve_moved_to_in(&mut tx, &authed.username, &w_id, kind, path, value.0.get())