From f0ae50becfd9df4d04edfbc3f4834e535a9db507 Mon Sep 17 00:00:00 2001 From: Diego Imbert Date: Tue, 8 Sep 2026 13:59:03 +0200 Subject: [PATCH] fix(datatables): unbreak two operator messages and two comments that described other code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The two strings this branch added for states an operator hits once — the catalog write that matched nothing, and the delete that stranded a pointer — were collapsed from their multi-line form with the indentation left in, so both rendered with a fourteen-space gap mid-sentence. `list_datatables` claimed to report a chain it cannot follow and then dropped it; it does drop it, and the comment now says why that is the right place to stay quiet. The non-superadmin check in `edit_datatable_config` was introduced as also covering references, which it does not and need not: `reference` is overwritten from the stored entry for every caller before the check runs. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_012ti5HyeTikPMYyW8YSdiHR --- backend/windmill-api-settings/src/lib.rs | 8 ++++++-- backend/windmill-api-workspaces/src/workspaces.rs | 11 +++++++---- .../windmill-api-workspaces/src/workspaces_extra.rs | 6 +++++- 3 files changed, 18 insertions(+), 7 deletions(-) diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs index 13fc9f779d..a4a0a5179b 100644 --- a/backend/windmill-api-settings/src/lib.rs +++ b/backend/windmill-api-settings/src/lib.rs @@ -2601,8 +2601,12 @@ async fn write_role_catalog( .rows_affected(); if written == 0 { return Err(error::Error::internal_err( - "The instance Postgres settings row is missing, so the data table role catalog could not be recorded. Refresh the custom instance user password in instance settings to recreate it, then try again." - .to_string(), + concat!( + "The instance Postgres settings row is missing, so the data table role catalog ", + "could not be recorded. Refresh the custom instance user password in instance ", + "settings to recreate it, then try again." + ) + .to_string(), )); } Ok(()) diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs index 3da210d2b6..b8e7adca20 100644 --- a/backend/windmill-api-workspaces/src/workspaces.rs +++ b/backend/windmill-api-workspaces/src/workspaces.rs @@ -2158,7 +2158,9 @@ async fn list_datatables( let mut items = Vec::with_capacity(names.len()); for name in names { // A pointer entry owns no database, so what it resolves to is the only truthful answer - // here; a chain that cannot be followed is reported with what the caller can still see. + // here. One that resolves to nothing — a pointer whose workspace was deleted — is dropped + // rather than listed with a database it does not have; what happened is named where it is + // actionable instead: by the delete that stranded it, and by any attempt to use it. let Ok(governing) = resolve_governing_datatable(&db, &w_id, &name).await else { continue; }; @@ -3630,9 +3632,10 @@ async fn edit_datatable_config( ) .await?; - // Check that non-superadmins are not abusing Instance databases, nor pointing an entry at - // another workspace's data table. Both reach a database this workspace does not own: an - // instance database directly, a reference through whoever governs it. + // Check that non-superadmins are not abusing Instance databases, which reach a database this + // workspace does not own. Pointing an entry at another workspace's data table is not checked + // here because it cannot be requested at all: `reference` is overwritten from the stored entry + // above, for every caller. if !is_superadmin { for (name, dt) in new_config.settings.datatables.iter() { let old_dt = old_datatables.get(name); diff --git a/backend/windmill-api-workspaces/src/workspaces_extra.rs b/backend/windmill-api-workspaces/src/workspaces_extra.rs index 888b432e23..90e98c531b 100644 --- a/backend/windmill-api-workspaces/src/workspaces_extra.rs +++ b/backend/windmill-api-workspaces/src/workspaces_extra.rs @@ -1338,7 +1338,11 @@ pub(crate) async fn delete_workspace( .collect::>() .join(", "); Ok(format!( - "Deleted workspace {}. These data tables were governed by it and no longer resolve: {}. Their databases still exist; a superadmin can point them at another workspace's data table.", + concat!( + "Deleted workspace {}. These data tables were governed by it and no longer ", + "resolve: {}. Their databases still exist; a superadmin can point them at ", + "another workspace's data table." + ), &w_id, stranded )) }