starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-25 16:03:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: gate per-user draft-only rows in listings on include_draft_only flag

Browse Source
This commit is contained in:
Diego Imbert
2026-06-05 01:38:40 +02:00
parent bb60641ff6
commit 75e2d99e44
3 changed files with 35 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api-flows/src/flows.rs
+12 -5
View File
@@ -219,11 +219,18 @@ async fn list_flows(
tx.commit().await?;
// Draft-only rows: drafts the authed user has at paths with no
// deployed flow. Concatenated after the deployed page so the home
// page surfaces them too. Fields not in the draft JSON fall back to
// sensible defaults. Only included when no filters narrow the list
// and we're on page 0 — keeps pagination semantics clean.
if offset == 0
// deployed flow. Gated on the same `include_draft_only` flag that
// controls deployed `draft_only` rows above so picker callers
// (workspace pickers, script selectors, ...) get the deployed
// listing only — the home page opts in explicitly.
//
// Concatenated after the deployed page so the home page surfaces
// them too. Fields not in the draft JSON fall back to sensible
// defaults. Skipped when filters narrow the list or we're past
// page 0 — keeps pagination semantics clean.
if lq.include_draft_only.unwrap_or(false)
&& !authed.is_operator
&& offset == 0
&& lq.path_start.is_none()
&& lq.path_exact.is_none()
&& lq.edited_by.is_none()
backend/windmill-api-scripts/src/scripts.rs
+12 -6
View File
@@ -329,12 +329,18 @@ async fn list_scripts(
tx.commit().await?;
// Draft-only rows: drafts the authed user has at paths with no
// deployed script. Concatenated after the deployed page so the home
// page surfaces them too. Fields not in the draft JSON fall back to
// sensible defaults (the editor can still open the draft from
// /scripts/edit/{path}). Only included when no other filters narrow
// the list — pagination beyond page 0 also skips them.
if offset == 0
// deployed script. Gated on the same `include_draft_only` flag
// that controls deployed `draft_only` rows above so picker callers
// (workspace pickers, script selectors, ...) get the deployed
// listing only — the home page opts in explicitly.
//
// Concatenated after the deployed page so the home page surfaces
// them too. Fields not in the draft JSON fall back to sensible
// defaults. Skipped when filters narrow the list or we're past
// page 0 — keeps pagination semantics clean.
if lq.include_draft_only.unwrap_or(false)
&& !authed.is_operator
&& offset == 0
&& lq.path_start.is_none()
&& lq.path_exact.is_none()
&& lq.created_by.is_none()
backend/windmill-api/src/apps.rs
+11 -5
View File
@@ -451,11 +451,17 @@ async fn list_apps(
tx.commit().await?;
// Draft-only rows: drafts (of either `app` or `raw_app` kind) the
// authed user has at paths with no deployed app. Concatenated after
// the deployed page so the home page surfaces them too. Fields not
// in the draft JSON fall back to defaults. Only included when no
// filters narrow the list and we're on page 0.
if offset == 0
// authed user has at paths with no deployed app. Gated on the same
// `include_draft_only` flag that controls deployed `draft_only`
// rows above so picker callers get the deployed listing only — the
// home page opts in explicitly.
//
// Concatenated after the deployed page so the home page surfaces
// them too. Fields not in the draft JSON fall back to defaults.
// Skipped when filters narrow the list or we're past page 0.
if lq.include_draft_only.unwrap_or(false)
&& !authed.is_operator
&& offset == 0
&& lq.path_start.is_none()
&& lq.path_exact.is_none()
&& lq.label.is_none()