starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-22 00:01:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

add DISABLE_WORKSPACE_FORK environment variable (#7238)

Browse Source 
Add environment variable to disable workspace forking for non-superadmin users.
When DISABLE_WORKSPACE_FORK is set to "true", only superadmins can create
workspace forks. Non-superadmin users will receive an error stating that
the endpoint requires superadmin privileges.

Changes:
- Added DISABLE_WORKSPACE_FORK env var (defaults to false)
- Modified create_workspace_fork to check superadmin permission when env is set
- Modified create_workspace_fork_branch to check superadmin permission when env is set

Fixes #7236

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
This commit is contained in:
Ruben Fiszel
2025-11-27 11:11:18 +01:00
committed by GitHub
parent 04831c5143
commit 577017eb0d
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api/src/workspaces.rs
+15
View File
@@ -2345,6 +2345,13 @@ lazy_static::lazy_static! {
}
};
pub static ref DISABLE_WORKSPACE_FORK: bool = {
match std::env::var("DISABLE_WORKSPACE_FORK") {
Ok(val) => val == "true",
Err(_) => false,
}
};
}
async fn create_workspace_require_superadmin() -> String {
@@ -3059,6 +3066,10 @@ async fn create_workspace_fork_branch(
)));
}
if *DISABLE_WORKSPACE_FORK {
require_super_admin(&db, &authed.email).await?;
}
Ok(Json(
handle_fork_branch_creation(&authed.email, &authed.username, &db, &w_id, &nw.id).await?,
))
@@ -3076,6 +3087,10 @@ async fn create_workspace_fork(
)));
}
if *DISABLE_WORKSPACE_FORK {
require_super_admin(&db, &authed.email).await?;
}
let mut tx: Transaction<'_, Postgres> = db.begin().await?;
// Generate unique forked workspace ID with wm-fork prefix