starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-27 08:02:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Alexander Petric
2026-10-23 18:49:17 -04:00
committed by GitHub
co-authored by Claude Opus 5
parent 8af484292f
commit 812ff6ea5e
13 changed files with 105 additions and 299 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api-integration-tests/tests/operator_manage_rights.rs
-59
View File
@@ -406,62 +406,3 @@ async fn test_operators_draft_resources_and_variables(db: Pool<Postgres>) -> any
Ok(())
}
/// The two endpoints that make the API server run `pg_dump`/`psql` against a database a request
/// names are closed to a role that cannot run code.
///
/// Both polarities on each route: a 403 alone would equally be a route that does not exist or one
/// refusing the source for some other reason, and the admin's 400 shows the gate is about the role
/// rather than the request. The source is deliberately unresolvable, so the gate is the only thing
/// that can answer 403 and no database is ever reached.
#[sqlx::test(migrations = "../migrations", fixtures("base", "permissions_test"))]
#[serial]
async fn test_dumping_a_database_needs_the_code_right(db: Pool<Postgres>) -> anyhow::Result<()> {
initialize_tracing().await;
windmill_common::roles::invalidate_all_roles_cache();
let server = ApiServer::start(db.clone()).await?;
let port = server.addr.port();
let api = format!("http://localhost:{port}/api/w/{WS}");
let cases = [
(
"workspaces/export_pg_schema",
json!({"source": "u/operator/not-a-source"}),
"export a database schema",
),
(
"workspaces/import_pg_database",
json!({"source": "u/operator/not-a-source", "target": "u/operator/not-a-source",
"fork_behavior": "schema_only"}),
"import a database",
),
];
for (route, body, action) in cases {
let resp = operator_client()
.post(format!("{api}/{route}"))
.json(&body)
.send()
.await?;
let status = resp.status();
let text = resp.text().await?;
assert_eq!(status, 403, "{route}: {text}");
assert!(
text.contains(&format!("Your role cannot {action} in this workspace")),
"{route} refused for another reason: {text}"
);
let resp = reqwest::Client::new()
.post(format!("{api}/{route}"))
.header("Authorization", "Bearer SECRET_TOKEN")
.json(&body)
.send()
.await?;
let status = resp.status();
let text = resp.text().await?;
assert_eq!(status, 400, "{route}: {text}");
assert!(text.contains("Invalid source format"), "{route}: {text}");
}
Ok(())
}