From 577017eb0d6f26e5c6d1e1ac8da24064e2a995b2 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 27 Nov 2025 11:11:18 +0100
Subject: [PATCH] add DISABLE_WORKSPACE_FORK environment variable (#7238)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add environment variable to disable workspace forking for non-superadmin users.
When DISABLE_WORKSPACE_FORK is set to "true", only superadmins can create
workspace forks. Non-superadmin users will receive an error stating that
the endpoint requires superadmin privileges.

Changes:
- Added DISABLE_WORKSPACE_FORK env var (defaults to false)
- Modified create_workspace_fork to check superadmin permission when env is set
- Modified create_workspace_fork_branch to check superadmin permission when env is set

Fixes #7236

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/windmill-api/src/workspaces.rs | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/backend/windmill-api/src/workspaces.rs b/backend/windmill-api/src/workspaces.rs
index 217d48dc7d..9fbba5cc48 100644
--- a/backend/windmill-api/src/workspaces.rs
+++ b/backend/windmill-api/src/workspaces.rs
@@ -2345,6 +2345,13 @@ lazy_static::lazy_static! {
         }
     };
 
+    pub static ref DISABLE_WORKSPACE_FORK: bool = {
+        match std::env::var("DISABLE_WORKSPACE_FORK") {
+            Ok(val) => val == "true",
+            Err(_) => false,
+        }
+    };
+
 }
 
 async fn create_workspace_require_superadmin() -> String {
@@ -3059,6 +3066,10 @@ async fn create_workspace_fork_branch(
         )));
     }
 
+    if *DISABLE_WORKSPACE_FORK {
+        require_super_admin(&db, &authed.email).await?;
+    }
+
     Ok(Json(
         handle_fork_branch_creation(&authed.email, &authed.username, &db, &w_id, &nw.id).await?,
     ))
@@ -3076,6 +3087,10 @@ async fn create_workspace_fork(
         )));
     }
 
+    if *DISABLE_WORKSPACE_FORK {
+        require_super_admin(&db, &authed.email).await?;
+    }
+
     let mut tx: Transaction<'_, Postgres> = db.begin().await?;
 
     // Generate unique forked workspace ID with wm-fork prefix