From cdd6fb2ca7cf15fbe22a3684b92dd5cf447c9092 Mon Sep 17 00:00:00 2001 From: Guilhem Lemouel Date: Mon, 26 Oct 2026 10:53:08 -0700 Subject: [PATCH] fix: keep restricted roles from creating a fork through a session move The move's fork gate checked only the workspace's forking rule. A role missing a capability would get the default role in a fork it creates, so the gate also refuses restricted roles, as the workspace picker does. Co-Authored-By: Claude Opus 5.5 (1M context) --- .../lib/components/sessions/WorkspaceFamilyPicker.svelte | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte b/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte index feffc09405..8d175e57ea 100644 --- a/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte +++ b/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte @@ -19,6 +19,7 @@ } from '$lib/utils/workspaceHierarchy' import { useForkableWorkspaces } from '$lib/utils/useForkableWorkspaces.svelte' import { canCreateFork } from '$lib/utils/editInFork' + import { capabilitiesIn, isRestricted } from '$lib/roleCapabilities' import { forkAccentStyle } from '$lib/utils/forkColor' import { WorkspaceService } from '$lib/gen' import { useSessionReadOnly } from './sessionPermissions.svelte' @@ -190,6 +191,13 @@ ? forksOf !== 'admins' && !rootRulesetsResource.loading && !rootUserInfoResource.loading && + // A restricted role would get the default role in the fork it creates. + !isRestricted( + capabilitiesIn( + rootUserInfo, + $userWorkspaces.find((w) => w.id === forksOf) + ) + ) && (!isRuleActiveInRulesets(rootRulesets, 'DisableWorkspaceForking') || canUserBypassRuleKindInRulesets(rootRulesets, 'DisableWorkspaceForking', rootUserInfo)) : $workspaceStore !== 'admins' &&