From f05b50d29ac2fdbb808a97057fb92c8e425b4a2f Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Wed, 1 Jul 2026 10:10:03 +0200 Subject: [PATCH] fix: grant dispatch_event table to windmill roles (#9852) The dispatch_event table (migration 20260523055641) was created relying on ALTER DEFAULT PRIVILEGES to reach windmill_user/windmill_admin. Those default privileges only apply to objects created by the role that set them (20250205131523), so deployments whose migration runner is a different role leave dispatch_event ungranted. Direct writes then run as the invoking role and fail with "permission denied for table dispatch_event" -- notably the DELETE in delete_jobs (windmill-common/src/jobs.rs) that reaps a job's side rows on schedule disable, and the dispatcher insert in asset_dispatch.rs. Grant explicitly, same fix as notify_event (20260619091631) and script_trigger (20260619112847). GRANT is idempotent so re-application (squash, or an operator who already granted manually) is a no-op. Fixes WIN-2112 Co-authored-by: Claude Opus 4.8 (1M context) --- ...rant_dispatch_event_to_windmill_roles.down.sql | 4 ++++ ..._grant_dispatch_event_to_windmill_roles.up.sql | 15 +++++++++++++++ 2 files changed, 19 insertions(+) create mode 100644 backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.down.sql create mode 100644 backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.up.sql diff --git a/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.down.sql b/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.down.sql new file mode 100644 index 0000000000..2278fbfb2e --- /dev/null +++ b/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.down.sql @@ -0,0 +1,4 @@ +REVOKE ALL ON dispatch_event FROM windmill_user; +REVOKE ALL ON dispatch_event FROM windmill_admin; +REVOKE ALL ON SEQUENCE dispatch_event_id_seq FROM windmill_user; +REVOKE ALL ON SEQUENCE dispatch_event_id_seq FROM windmill_admin; diff --git a/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.up.sql b/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.up.sql new file mode 100644 index 0000000000..5d0b4650ce --- /dev/null +++ b/backend/migrations/20260701080313_grant_dispatch_event_to_windmill_roles.up.sql @@ -0,0 +1,15 @@ +-- The dispatch_event table (migration 20260523055641_dispatch_event) was +-- created relying on ALTER DEFAULT PRIVILEGES to grant access to windmill_user +-- and windmill_admin. Those default privileges only apply to objects created by +-- the role that set them (migration 20250205131523), so deployments whose +-- migration runner is a different role leave dispatch_event ungranted. Direct +-- writes run as the invoking role -- the dispatcher insert (asset_dispatch.rs) +-- and the DELETE in delete_jobs (windmill-common/src/jobs.rs), reached whenever +-- a job's side rows are reaped, e.g. on schedule disable -- and fail with +-- "permission denied for table dispatch_event". Grant explicitly to guarantee +-- access regardless of who ran the migrations (same fix as notify_event in +-- 20260619091631 and script_trigger in 20260619112847). +GRANT ALL ON dispatch_event TO windmill_user; +GRANT ALL ON dispatch_event TO windmill_admin; +GRANT ALL ON SEQUENCE dispatch_event_id_seq TO windmill_user; +GRANT ALL ON SEQUENCE dispatch_event_id_seq TO windmill_admin;