From a59b6c597cd431134e4ea88ebc38abd7da7406d2 Mon Sep 17 00:00:00 2001 From: Guilhem Lemouel Date: Mon, 26 Oct 2026 10:25:37 -0700 Subject: [PATCH] fix: offer a dev workspace in the fork form only to admins of the base Co-Authored-By: Claude Opus 5.5 (1M context) --- .../workspaceSettings/CreateWorkspaceInner.svelte | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte index 57ca1d37e4..afade2fb5d 100644 --- a/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte +++ b/frontend/src/lib/components/workspaceSettings/CreateWorkspaceInner.svelte @@ -214,11 +214,20 @@ ) ) let availableDevLabels = $derived(DEV_WORKSPACE_LABELS.filter((l) => !chainTakenLabels.has(l))) + // The server requires admin of the base, which may not be the current workspace, and the + // workspace list's `role` does not say who is admin. + const baseAdminResource = resource( + () => (baseCanHostDev && !$superadmin ? baseWorkspaceId : undefined), + async (ws) => (ws ? (await UserService.whoami({ workspace: ws })).is_admin : undefined) + ) // Offer dev designation only once the server confirms there's no dev yet (returns null); stay // conservative (no offer) while the check is loading (current is undefined). With every label // taken the chain is full and there is nothing left to designate. let canDesignateDevWorkspace = $derived( - baseCanHostDev && availableDevLabels.length > 0 && devWorkspaceResource.current === null + baseCanHostDev && + availableDevLabels.length > 0 && + devWorkspaceResource.current === null && + (!!$superadmin || baseAdminResource.current === true) ) let devWorkspaceLabel = $state('dev')