starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-08 08:04:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: update on_behalf_of_email in app policy on offboarding (#8858)

Browse Source 
* fix: update on_behalf_of_email in app policy on offboarding

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* sqlx

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
hugocasa
2026-04-17 12:11:12 +00:00
committed by GitHub
co-authored by Claude Opus 4.7
parent 51b09ace45
commit d99a176b6a
3 changed files with 53 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/.sqlx/query-03648be1558b3c968388ef0a511590efccff0d7e3490b1a7e8110c64bf7e9467.json
Generated
+17
View File
@@ -0,0 +1,17 @@
{
"db_name": "PostgreSQL",
"query": "UPDATE app SET policy = jsonb_set(\n jsonb_set(policy, ARRAY['on_behalf_of'], to_jsonb($1::text)),\n ARRAY['on_behalf_of_email'], to_jsonb($4::text)\n ) WHERE policy->>'on_behalf_of' = ('u/' || $2) AND workspace_id = $3",
"describe": {
"columns": [],
"parameters": {
"Left": [
"Text",
"Text",
"Text",
"Text"
]
},
"nullable": []
},
"hash": "03648be1558b3c968388ef0a511590efccff0d7e3490b1a7e8110c64bf7e9467"
}
backend/.sqlx/query-cc8326c8ea6aa1c81977d920da595da2385252be0b5c2ede7cc8fb8579b1c431.json
Generated
-16
View File
@@ -1,16 +0,0 @@
{
"db_name": "PostgreSQL",
"query": "UPDATE app SET policy = jsonb_set(policy, ARRAY['on_behalf_of'], to_jsonb($1::text)) WHERE policy->>'on_behalf_of' = ('u/' || $2) AND workspace_id = $3",
"describe": {
"columns": [],
"parameters": {
"Left": [
"Text",
"Text",
"Text"
]
},
"nullable": []
},
"hash": "cc8326c8ea6aa1c81977d920da595da2385252be0b5c2ede7cc8fb8579b1c431"
}
backend/windmill-api/src/offboarding.rs
+36 -25
View File
@@ -795,7 +795,8 @@ async fn offboard_user_from_workspace<'c>(
) -> Result<OffboardSummary> {
let new_prefix = reassign_to.to_string();
// Resolve the new operator's email for on_behalf_of_email on scripts/flows
// Resolve the new operator's email for on_behalf_of_email on scripts/flows/apps.
// resolve_new_permissioned_as already validated the user exists, and usr.email is NOT NULL.
let new_on_behalf_of_user_username = new_permissioned_as
.strip_prefix("u/")
.unwrap_or(new_permissioned_as);
@@ -805,7 +806,13 @@ async fn offboard_user_from_workspace<'c>(
w_id
)
.fetch_optional(&mut **tx)
.await?;
.await?
.ok_or_else(|| {
Error::NotFound(format!(
"new on_behalf_of user '{}' not found in workspace '{}'",
new_on_behalf_of_user_username, w_id
))
})?;
// ---- scripts ----
let scripts_reassigned = sqlx::query_scalar!(
@@ -822,16 +829,14 @@ async fn offboard_user_from_workspace<'c>(
.await?
.unwrap_or(0);
if let Some(ref new_email) = new_on_behalf_of_user_email {
sqlx::query!(
"UPDATE script SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2 AND workspace_id = $3",
new_email,
email,
w_id
)
.execute(&mut **tx)
.await?;
}
sqlx::query!(
"UPDATE script SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2 AND workspace_id = $3",
new_on_behalf_of_user_email,
email,
w_id
)
.execute(&mut **tx)
.await?;
// ---- flows ----
let flows_reassigned = sqlx::query_scalar!(
@@ -864,16 +869,14 @@ async fn offboard_user_from_workspace<'c>(
.execute(&mut **tx)
.await?;
if let Some(ref new_email) = new_on_behalf_of_user_email {
sqlx::query!(
"UPDATE flow SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2 AND workspace_id = $3",
new_email,
email,
w_id
)
.execute(&mut **tx)
.await?;
}
sqlx::query!(
"UPDATE flow SET on_behalf_of_email = $1 WHERE on_behalf_of_email = $2 AND workspace_id = $3",
new_on_behalf_of_user_email,
email,
w_id
)
.execute(&mut **tx)
.await?;
// ---- apps ----
let apps_reassigned = sqlx::query_scalar!(
@@ -891,9 +894,17 @@ async fn offboard_user_from_workspace<'c>(
.unwrap_or(0);
sqlx::query!(
"UPDATE app SET policy = jsonb_set(policy, ARRAY['on_behalf_of'], to_jsonb($1::text)) WHERE policy->>'on_behalf_of' = ('u/' || $2) AND workspace_id = $3",
&new_permissioned_as, username, w_id
).execute(&mut **tx).await?;
"UPDATE app SET policy = jsonb_set(
jsonb_set(policy, ARRAY['on_behalf_of'], to_jsonb($1::text)),
ARRAY['on_behalf_of_email'], to_jsonb($4::text)
) WHERE policy->>'on_behalf_of' = ('u/' || $2) AND workspace_id = $3",
&new_permissioned_as,
username,
w_id,
new_on_behalf_of_user_email
)
.execute(&mut **tx)
.await?;
// ---- raw_app (mirrors app paths) ----
sqlx::query!(