From fd97de72263caec4a4b67d829aff745aeca14e0d Mon Sep 17 00:00:00 2001 From: AlexRV12 <71396855+AlexRV12@users.noreply.github.com> Date: Thu, 3 Sep 2026 19:00:03 +0200 Subject: [PATCH] fix(frontend): scope the handler identity notice to the chosen destination The notice told every admin to grant g/variable_expiration_handler write access to the variables it rotates. That is right for a custom handler and wrong for the built-ins, which only post a message and are granted the Slack bot token by migration. Following it for a Slack handler would hand a group write access to the workspace's secrets for no reason. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG --- .../(logged)/workspace_settings/+page.svelte | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte index 966767a3fa..8b2d4a3bbd 100644 --- a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte +++ b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte @@ -2199,11 +2199,21 @@ export async function main( - The handler is executed by the automatically created group - g/variable_expiration_handler. Rotating a variable means writing to it, so grant - that group write access to the variables it is meant to rotate. It starts with - none. A script that carries an on-behalf-of identity is the exception: it runs - as that user, with their permissions rather than the group's. + {#if variableExpirationSelected === 'custom'} + The handler is executed by the automatically created group + g/variable_expiration_handler. Rotating a variable means writing to it, so + grant that group write access to the variables it is meant to rotate. It + starts with none. A script that carries an on-behalf-of identity is the + exception: it runs as that user, with their permissions rather than the + group's. + {:else} + The handler is executed by the automatically created group + g/variable_expiration_handler. It only posts a message, so it needs no access + to your variables: it is given the path and the expiry date, never the value. + {#if variableExpirationSelected === 'slack'} + Access to the Slack bot token is granted for you. + {/if} + {/if}