* feat: collapse the fork members setting and show its state in a badge
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: show the fork members badge next to the title, only when on, like other section badges
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* feat: add a workspace toggle that adds its admins and developers to new forks
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: add members copied into a fork as manual members, not instance-group ones
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* style: keep the fork members copy comment at the query and drop the raw spacer
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* feat: surface execution usage in the sidebar and explain what an execution is
Users read "executions" as a job count and are surprised by the real number,
which meters a second of compute. Every place the UI prints an execution count
now says so, and the sidebar carries a usage meter for the quota that will bind
first.
Adds SidebarUsage at the bottom of both sidebar surfaces: a ring in the
collapsed rail, a labelled bar when expanded, and a modal breaking down every
quota. On the free tier it meters the per-user and per-workspace 1000-execution
caps; on a paid plan it meters workspace usage against the executions the
workspace's seats already include.
Item.tooltip was inert on disabled dropdown rows: DropdownSubmenuItem rendered
the info icon inside the disabled button, which swallows hover, and the row's
own title attribute shadowed any wrapper title. Both renderers now fall back to
a wrapper title the way DropdownV2Inner already intended.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep the usage meter tied to the workspace it describes
isPremiumStore held the previous workspace's tier across a switch, which no
consumer noticed while it only gated affordances — the usage meter is the first
surface to render a number from it, and would have shown a paid seat quota for a
free workspace. It is now undefined until the active workspace's tier is known,
and a superseded response no longer writes.
The seat fetch had the same shape: a slow response for the workspace we left
overwrote the current count and stayed wrong until the next switch.
The usage wrapper also carried the padding the brand-mark row used to own, which
shifted the sidebar bottom by 4px on every instance where the meter renders
nothing. The component owns its own padding instead.
Names the collapsed ring for assistive tech, which otherwise saw an unlabelled
button whose only signal was the arc's color.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: scope the usage meter to the billing workspace and a known tier
A fork's usage, tier and bill all resolve to its billing root, but its member
list is deliberately a subset of the root's, so counting fork members metered
root usage against a fork-sized cap and invented billed-seat overages. Seats now
come from the billing root, and the paid meter stays hidden when that root is
not visible from the fork.
The tier was cleared only after the user-store round-trip, so the meter rendered
the previous workspace's tier for the length of it — a free→paid switch showed
the 1000-execution hard cap on a paid workspace, not a race but every time. The
clear now happens before the first await.
Workspace usage had neither guard: a superseded response overwrote the store
permanently, and the meter is the first surface to print that number as its
headline rather than bury it in a dropdown.
The free-tier counters keyed off `!$isPremiumStore`, which reads an unknown tier
as free and flashed the free-tier blocks during a paid-to-paid switch. They wait
for a known tier instead.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: never render an unresolved execution count as zero
The workspace-usage clear wrote 0, which is a real usage value: an in-flight or
failed fetch rendered as a green "0/1,000" bar, and a rejection left it there for
the session because loadUsage had no failure path. Usage is now undefined until
it resolves, each endpoint is assigned on its own so one failing leaves the
other's number intact, and a quota is listed only once its own usage, tier and
cap are known. The legacy counters show an em dash rather than a fabricated 0.
The fork gates read an unknown tier as not-premium, so clearing the tier on
switch made the fork entry point disappear for the length of the fetch on a
paid-to-paid switch. They hold while the tier is unknown.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: read the usage endpoints as numbers, and fall back to the free tier
Both usage endpoints serve text/plain, so the client hands back a string despite
the generated `number` type. Interpolation and arithmetic coerced it, which is
why nothing noticed before, but `toLocaleString` on a string returns it
unchanged — a five-figure count rendered without its thousands separator against
a formatted cap.
A failed tier fetch left the tier unknown for the session, and consumers hold
premium-only affordances through the unknown window so a free workspace kept
offering them. It falls back to the free tier instead.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep an unknown tier unknown, and refresh the seat cap on demand
Falling back to the free tier on a failed tier fetch fixed the affordance gates
by lying to the meter: a paid workspace's real five-figure usage rendered
against the 1000 hard cap, red, under "jobs stop running for the rest of the
month". The tier stays unknown instead, and the two consumers get what each
needs — the meter hides, while affordances read `maybePremium`, which holds
through the pending window but fails closed once the fetch has failed.
Membership changes elsewhere don't reach this component, so the seat cap could
show an overage against a cap that had since grown. It re-resolves when the
modal opens, which is when the number is read rather than glanced at.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: let anything showing executions re-read them
The counters were written in one place, the root layout, on a workspace change
only — so a tab left open all day showed the count from whenever the workspace
was opened, and the modal-open refresh could only reach the seat cap, leaving a
freshly computed denominator over a stale numerator.
Moves the fetch to lib/usage.ts, next to the stores it writes, so the meter can
refresh both numbers when its modal opens. Seats follow a membership signal that
WorkspaceUserSettings bumps where it already refetches after every mutation, so
the cap stops lagging a role change without either side owning the other.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: order concurrent usage and seat refreshes
The workspace id doesn't order two requests for the same workspace, and both
refreshes can now have two in flight: usage through A→B→A or a modal-open
refresh landing on one already running, seats through a membership bump
arriving mid-request. An older response could win and restore the count it
replaced. Each refresh takes a generation and only writes if it is still the
newest.
The membership signal also fired on a plain read, so opening the users tab made
every consumer re-fetch a list identical to the one it held. It bumps on an
observed change to the member set instead, never on the first read.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: count only billable seats, and order the tier requests
The cap counted every member row, while the backend bills
`NOT disabled AND NOT is_service_account` — a workspace with service accounts
got an inflated included quota, which hides a real overage rather than inventing
one. The seat basis matches `count_paid_seats` now, and the membership signature
carries both fields so enabling or disabling a member re-resolves the cap.
The tier fetch was the one refresh still ordered by workspace id alone, so a
late failure for a workspace could raise the failure flag over a tier a newer
request had already resolved. It takes a generation like the other two.
The membership signature is keyed by workspace: this page survives a workspace
switch, and comparing one workspace's members against another's reported a
membership change where only the workspace had changed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: compare the member set only against the same workspace's
Qualifying the signature with the workspace put the workspace inside the value
being compared, so a switch made every comparison unequal and bumped the version
unconditionally — the opposite of the intent, and worse than before the key. The
workspace is the key now, not part of the payload: a different one has nothing
to compare against and re-baselines silently.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: hold the usage and tier fetches in resources
Every one of these values belongs to a workspace but lived in a bare store, so
each writer and reader re-derived "does this still describe what I'm rendering?"
by hand. Nine sites did, and the ones that forgot were most of this branch's
review findings: three stale-workspace overwrites, three A→B→A races, and two
placeholders (`0` executions, `false` tier) that read as real data because an
in-band value was standing in for "not known".
`resource` from runed — which frontend/AGENTS.md prescribes for async data, and
which ~80 files here already use — supplies all three properties as behaviour
rather than convention: a superseded fetch is discarded, the value resets when
its key changes, and loading and error are states instead of magic values. The
seat count keys on the billing root and the membership version, so both a
workspace switch and an added member re-resolve it.
That removes three generation counters, two workspace trackers, and the manual
clear-and-compare around each fetch. What remains is one publish site that
asserts the value still carries the active workspace before it reaches a store.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: order the resource responses that runed does not
The refactor claimed `resource` discards a superseded fetch. It does not: its
only ordering is an AbortController whose signal the generated client cannot
consume, and `current = result` runs unconditionally once a fetch resolves. So a
late answer for a workspace we had left still landed in `current`, and the
publish site — which trusted `current` — cleared the value on screen for the
workspace we were on. That reinstated the races the generation counters had
covered.
`loading` was standing in for the missing ordering, and it cannot: it is also
true during a `refetch()`, when `current` is still the right value. Gating on it
meant every re-read blanked the meter, and clicking it unmounted the modal that
same click had opened, since both sit behind the quota it had just cleared.
Values now carry the scope they describe and `scopedValue` keeps the newest one
matching the active scope, so a superseded answer neither publishes nor erases,
and a re-read leaves the display alone. The account-wide user counter keys on
the account, so a workspace switch no longer clears it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: order responses within a scope, not just across scopes
The tag carried what a value described but not when it was asked for, so two
fetches for one scope — a refetch landing on an in-flight load, or a second
membership invalidation — were indistinguishable and the older won if it landed
last. That left the seat cap reading the pre-change number until the next bump
or switch, which is the stale cap the generation counters had covered.
Widening the tag to the resource key would have fixed it by blanking the bar on
every membership change, so the issue order travels alongside the scope instead:
`tagged` stamps each request as it is issued, and only a strictly newer answer
for the current scope replaces the held one.
The unit tests now cover the same-key case they missed; both new ones fail
against the key-only guard.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: ignore a user list a newer read has overtaken
`lastSeen` was written unconditionally after the await, so a response for a
workspace already left overwrote the baseline for the workspace on screen. The
next real membership change there then compared against a baseline that was
never taken for it, re-baselined silently, and never bumped
`workspaceMembershipVersion` — leaving the sidebar on the old seat cap. The
`users` assignment had the same hole: an overtaken list could paint over a
newer one.
Both now go through a single check: a read whose issue order is behind the last
applied one is dropped before it touches either.
Also trims the two `scopedValue` docstrings and the membership rationale to the
four lines AGENTS.md allows, and records there that a failed refresh keeps the
last successful value rather than blanking.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: do not claim a plan before the tier resolves
Widening `isPremiumStore` to `boolean | undefined` left `UserMenu`'s `{:else}`
catching the unresolved state: with the tier still in flight, or after the
request failed, a free workspace was told it was on the "Premium plan". Both
branches under that block assert a plan, so the block now renders only once the
tier is known — which also keeps the bordered divider from appearing empty
while it resolves.
Verified against the running instance with the tier stubbed slow: unresolved
shows neither branch, `false` shows the free counters, `true` shows "Premium
plan". Reverting the guard reproduces the wrong label at 300ms.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: pin how a late answer orders against the read that replaced it
Returning to a scope whose earlier read is still in flight is the one case the
guard resolves by scope rather than by sequence, and the suite only covered it
with nothing outstanding. It now covers the late answer itself: it stands while
it is the only value describing the scope, the read issued on returning
supersedes it, and it cannot come back afterwards.
Also gives the meter the explicit `type="button"` the sibling sidebar rows use.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: size the modal's plan button with unifiedSize
`size` is deprecated on `Button`. `unifiedSize="sm"` renders the plan button at
the same height and weight as the modal's own Close button.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: match the plan button to the modal's own action button
`unifiedSize="sm"` is `h-7`, and the Cancel button `Modal` renders beside it is
`px-3 py-[7px]`, i.e. 32px — so the two sat 4px apart. `md` is the unified size
that lands on 32px, which pairs them without putting a deprecated prop back.
Measured both boxes rather than the new one alone: 32px and 32px, same top.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: instrument the execution meter, and bill-align PremiumInfo's seats
The meter's only interaction is opening the modal, so that is what it counts:
`usage_meter/opened`, keyed by the plan tier and the quota that was tightest —
`free:user`, `free:workspace`, `paid:workspace`. The full set is a type next to
the call site so the vocabulary stays readable in one place.
The pair is registered in `FEATURE_USAGE_KINDS` (windmill-ee-private), without
which the post is dropped with a 204 and records nothing. Verified both halves:
the browser posts
`{"feature":"usage_meter","kind":"opened","key":"free:user","value":1}`, the
running EE image drops it because its registry predates the entry, and
`is_recordable_event` accepts it once the entry is there.
`PremiumInfo` computed its seats from an unfiltered user list, so the billing
page counted disabled members and service accounts that `count_paid_seats` does
not bill. Same filter as the sidebar's cap now.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: point ee-repo-ref at the usage_meter registration
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: read the member list before the seat rows that depend on it
`loadPremiumInfo` reads `users` after its own await and nothing recomputes the
seat rows when the list lands, so whenever `premium_info` won the race the page
rendered zero developers, zero operators and zero seats and kept them. The list
is now fetched first, and a failure to read it no longer costs the rest of the
page.
Also refreshes the registered-action inventory in `docs/feature-telemetry.md`,
which the new pair makes 21 across nine features.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: scope the seat comment to the counter it matches
The comment claimed parity with the seats actually charged, which nothing in
this repo computes: `count_paid_seats` documents itself as counting provisioned
members rather than billing's active-user population, and the Stripe quantity
is not derived here. What the filter buys is agreement with that counter.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to c6902ec2c51dc0ce30962afbfab3e456c5d9b831
This commit updates the EE repository reference after PR #735 was merged in windmill-ee-private.
Previous ee-repo-ref: bbc48fae6b73b6d72fe2e125e6003794a4ece167
New ee-repo-ref: c6902ec2c51dc0ce30962afbfab3e456c5d9b831
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* [ee] feat(service-accounts): allow choosing role at creation time
Previously, service accounts were hardcoded to operator and could not be
used as the CLI sync user since they had no write access. They also only
counted as 0.5 seat each.
This change:
- Extends `NewServiceAccount` to accept optional `is_admin` / `operator`
(defaults to `operator=true` for backward compatibility).
- Exposes a role picker in `AddUser.svelte` when creating a service
account (Operator / Developer / Admin).
- Lets admins update a service account's role from the user list (it
used to be locked to "Operator" with a tooltip).
- Updates the OpenAPI spec + regenerates the frontend client.
A developer/admin service account counts as 1 seat under the existing
seat-cap logic (operators stay at 0.5).
Companion PR on windmill-ee-private updates the `INSERT INTO usr` to
honour the chosen role.
Fixes WIN-1985
* [ee] feat(service-accounts): wm_deployers opt-in for Dev role
When creating a service account with role=Developer, surface a toggle
"Add to wm_deployers" (recommended). Members of wm_deployers can deploy
on behalf of other users — the typical setup when the service account is
used as the CLI sync / CI deploy identity.
- `NewServiceAccount` gains an optional `add_to_deployers` flag.
- Frontend defaults the toggle to on but only shows it under Developer
(admins have it implicitly; operators can't deploy).
- Tooltip links to docs.windmill.dev "Run on behalf of".
Companion EE PR updates the handler to INSERT into usr_to_group for
wm_deployers when the flag is set.
Refs WIN-1985
* chore: update ee-repo-ref to 974ed42067d9f63acb42332b671b8c01ffd4b625
This commit updates the EE repository reference after PR #589 was merged in windmill-ee-private.
Previous ee-repo-ref: f7dbc3cc2ba21c396f4828881e3b9d9ab6f50c69
New ee-repo-ref: 974ed42067d9f63acb42332b671b8c01ffd4b625
Automated by sync-ee-ref workflow.
* [ee] fix(service-accounts): unhardcode role in superadmin user list
Two review issues from the merged #9307 / #589:
1. P1 — The global Users tab in #superadmin-settings still pinned every
service account to "Operator". Now it shows the actual role
(Admin / Operator / Developer), derived from the SA's usr row.
- `list_users_as_super_admin`: replaced `true as operator_only` with
the real `operator` value, and added `is_workspace_admin` from the
row (NULL for password users since their admin status is
per-workspace).
- `global_whoami`: when the email belongs to a service account, look
up its real `operator` / `is_admin` instead of pinning to operator.
- `SuperadminSettingsInner.svelte`: drop the hardcoded "Operator"
badge; render Admin / Operator / Developer using the new fields,
matching the workspace-level view.
2. P2 — Regenerate the bundled `openapi-deref.{yaml,json}` so the
`createServiceAccount` body (now exposing `is_admin`, `operator`,
`add_to_deployers`) and the new `GlobalUserInfo.is_workspace_admin`
field show up at runtime in `/api/openapi.{yaml,json}`.
Bumps `ee-repo-ref.txt` to the EE follow-up that adds the offline
seat-cap check on `create_service_account`.
Refs WIN-1985
* chore: update ee-repo-ref to b7a6068c1f3dc845e012959268b2426f0de4d697
This commit updates the EE repository reference after PR #590 was merged in windmill-ee-private.
Previous ee-repo-ref: 0b1307c21d1bfd6fb43a03c2ba39d2a8bf8e6470
New ee-repo-ref: b7a6068c1f3dc845e012959268b2426f0de4d697
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: add user offboarding flow with object reassignment
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: require new_operator for permissioned_as when reassigning to folder
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update on_behalf_of_email on scripts/flows during offboarding
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: extract offboarding to separate module and add integration tests
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: delete tokens, add operator preview counts, remove token reassignment UI
Tokens are now always deleted during offboarding. Preview now shows
scripts/flows/apps with on_behalf_of and schedules/triggers with
permissioned_as referencing the departing user (even outside their path).
Token reassignment UI removed since webhooks break on path changes anyway.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: rich preview with path lists, warnings, and downloadable report
Preview now returns full path lists (not just counts) for owned objects
and objects executing on behalf of the user. Adds warnings for:
- HTTP triggers (webhook URLs will change)
- Email triggers (addresses will change)
- Broken $var:/$res: references in resources/variables
Frontend provides "Export list" button to download affected content.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add coverage for dynamic queries (triggers, extra_perms, operator schedules)
Adds HTTP trigger, extra_perms reference, and shared schedule to test
fixture. Tests verify that non-macro sqlx queries (trigger reassignment,
extra_perms cleanup, operator schedule update) work correctly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove broken_references, add full dynamic query test coverage
Remove broken_references field from preview (user's resources/variables
are already in the owned paths list). Add shared HTTP trigger fixture
to test all dynamic query paths: trigger operator preview (line 232),
trigger permissioned_as update for non-user-path (line 951), and
extra_perms cleanup on trigger tables (line 983).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add referencing field to preview for content/value path references
Preview now includes a 'referencing' section listing scripts (by content),
flows (by value JSON), apps (by policy/extra_perms), and resources (by value)
that contain references to u/{username}/ paths. These references may break
after reassignment. Shown in export list and as a warning in the UI.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: rename objects to items in UI, detect on_behalf_of items in hasItems
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: replace remaining objects with items in UI text
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: rename operator to on_behalf_of, separate owned vs on-behalf UI sections
- Rename new_operator to new_on_behalf_of_user in API and frontend
- Rename op_ prefixed variables to obo_ in backend
- UI now shows separate sections for owned items and items running
on behalf, with the operator selector shown only when needed
- canSubmit logic updated: operator needed for folder targets OR
when on-behalf items exist
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: CSV export, side-by-side layout, always accept new_on_behalf_of_user
- Export affected items as CSV instead of text
- Owned items and on-behalf items shown side by side in summary boxes
- new_on_behalf_of_user always accepted (defaults to target user for
user targets, required for folder targets)
- On_behalf_of selector always visible, auto-defaults when user target
is selected
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: proper pluralization and bottom-aligned counts in summary boxes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: stack info boxes vertically, referencing box as warning style at top
Info boxes (owned, on-behalf, referencing) now one per row instead of
side-by-side. Referencing box uses warning colors. Webhook/email trigger
alerts shown below boxes. Proper pluralization in global modal too.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: CSV exports only referencing items, export button inside warning box
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: use ToggleButtonGroup for user/folder, add reassign toggle on remove
- User/Folder selection now uses ToggleButtonGroup component
- When removing a user, a "Reassign items before removing" toggle lets
the admin skip reassignment and just delete directly
- In reassign-only mode, the toggle is not shown (always reassigns)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: show token details with labels and scopes in preview
Preview now returns token label, scopes, and expiration instead of just
a count. Frontend shows a dedicated token box listing each token with
its scopes. Test updated to verify token label in preview response.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: extract shared offboarding components, per-type trigger links, hash deep linking
- Extract OffboardItemsBox, OffboardReassignControls, OffboardWorkspaceSection,
and offboarding-utils.ts as shared components used by both workspace and global modals
- Change triggers in OffboardAffectedPaths from Vec<String> to HashMap<String, Vec<String>>
so frontend knows which trigger page to link to
- Add hash-based deep linking to all 9 trigger pages and schedules page
- Preserve URL hash in updateQueryFilters across all trigger pages
- Only open editor drawer if the item is found in the list
- Reassign toggle at top with warning alert when disabled (both modals)
- Referencing items box uses yellow warning variant with expandable path links
- Cleaner labels: "Move u/{username}/* items to", "Update triggers/runnables permissions to"
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: rename on_behalf_of section label to match flow advanced settings
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate sqlx query cache
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: address PR review issues for offboarding
- Add 9 trigger tables to check_path_conflicts for user-friendly conflict messages
- Fix submit button no-op when user has only on-behalf items (show target selector, fix canSubmit)
- Only delete workspace user when reassignment entry exists (prevent orphaned objects)
- Add $azure_kv: prefix to vault secret query (match rename_user pattern)
- Use Svelte 5 onSelected callback instead of deprecated on:selected
- Make ScriptBuilder section label conditional on canPreserve
- Fix CSV export to include trigger paths via flattenPaths utility
- Fix test_offboard_reassign_only to remove conflicts and assert on response
- Parallelize workspace config fetches in global modal with Promise.all
- Delete tokens when deleting workspace user
- Return structured JSON from global offboard endpoint
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* sqlx
* fix: address second round of PR review issues
- Accumulate per-workspace OffboardSummary in global offboard instead of returning zeros
- Delete workspace user unconditionally when delete_user=true (prevent orphaned usr rows)
- Filter archived/deleted scripts in check_path_conflicts to match preview
- Reset form state when workspace offboard modal reopens
- Move hashHandled=true inside trigger-found guard on all 10 deep-link pages
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: improve offboarding integration tests
- Add second workspace to fixture for multi-workspace global offboard testing
- Add test_global_offboard_execution: verifies items reassigned across 2
workspaces, user deleted from both, and password row deleted from instance
- Add test_offboard_invalid_target: verifies 400 for nonexistent user,
nonexistent folder, and invalid target format
- Fix test_offboard_to_user: use single DELETE, add explicit new_on_behalf_of_user
- Fix test_global_offboard_preview: assert 2 workspaces instead of 1
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: address third round of PR review issues
- Fix ScriptBuilder tooltip to match conditional section label wording
- Clear stale conflicts in global modal on reopen
- Fix test_offboard_to_folder to assert on specific moved path, not pre-existing data
- Allow deleting user with zero items (show Offboard button, skip reassignment)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add global token deletion warning in instance-level offboard modal
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* update sqlx
* fix: add raw_app path and dependency_map path reassignment to offboarding
Audit found these tables with user-scoped paths were not being updated:
- raw_app: mirrors app paths, needs path reassignment
- dependency_map: importer_path and imported_path reference user paths
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: move user cleanup to delete_workspace_user_internal, fix review issues
- Move extra_perms, folder owners, drafts, favorites, inputs, captures
cleanup into delete_workspace_user_internal so any user deletion gets
proper cleanup (not just offboard path)
- Fix flow INSERT missing labels and lock_error_logs columns (data loss)
- Fix validate_target returning 404 instead of 400 for nonexistent targets
- Fix canSubmit blocking delete when user has no items to reassign
- Fix token preview query filtering out tokens without scopes
- Fix token warning messages: workspace-level mentions webhooks/HTTP triggers,
instance-level mentions API calls using credentials
- Fix "Schedules and triggers" -> "Triggers and runnables" wording
- Show token section at instance level only when tokens exist
- Show Offboard button at instance level when user has no items but deleteUser=true
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: block adding/inviting members to admins workspace on CE
The admins workspace is reserved for superadmins only. On CE (non-enterprise),
prevent adding or inviting users to it via both API and UI.
Backend: add #[cfg(not(feature = "enterprise"))] guards to invite_user and
add_user endpoints that reject requests targeting the admins workspace.
Frontend: show an info alert on the admins workspace members page and hide
the add/invite/auto-add buttons.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use derived variable for admins workspace alert consistency
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Remove $$props.field usage
* Rename slots to ensure no hyphen
* _props
* _trigger
* OnSelectedIteration type correct capitalization
* rename _content
* Remove afterUpdate
* Migrate everything to svelte 5
* array bind
* Fix popover
* type never
* nit fixes
* Fixed many trivial errors
* onClick
* Fix errors
* use let:
* nit typing
* fix: wrap state_referenced_locally vars with untrack()
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add untrack import
* Fix all syntax errors due to untrack migration
* Fix undefined errors
* Fix more undefined errors
* untrack(() => initialOpen)
* svelte-ignore
* Fix state_descriptors_fixed error in Chart.svelte
Use $state.snapshot() to pass plain copies of data/options to Chart.js
instead of $state proxies. Chart.js's listenArrayEvents tries to define
property descriptors on data arrays, which Svelte 5 proxies reject.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* nit typing
* Merge issue
* Fix "path is not set" error in resource picker / editor
* Fix InputTransformForm error when rerunning some flows
* fix npm run check
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* Add vertical nav bar to workspace settings
* harmonize settings content titles
* remove sidebar icons
* add background to sidebar
* nit user section
* EEonly display
* Workspace settings general design
* Add schema validation and dirty detection
* Put critical alerts in a separated tab
* separate error success handler
* only enable save when there is some changes
* Fix dirty detection for deployment UI
* Only enable save button when changes for datatables ws storage
* Add setting footer component
* Use new footer setting for saving configs
* nit
* apply setting footer
* improve save button
* nit
* nit
* nit
* make ws app use same pattern as other tabs
* Separate scrolling between sidebar and content
* Gather error handlers
* use universal save button for object storage
* Title sentence case
* nit
* nit
* improve dirty config logic
* nit
* nit
* clean dead code
* Use settings footer for deployment settings
* Git sync settings
* move tabs
* fix dirty stats of error handlers
* nit
* nit
* feat: add workspace setting to disable error handler for u/ scripts/flows
Add a new workspace setting `error_handler_muted_on_user_path` that allows
disabling the error handler for jobs related to scripts/flows that start
with the "u/" prefix (user scripts/flows).
Changes:
- Add migration to add `error_handler_muted_on_user_path` column to workspace_settings
- Update WorkspaceSettings struct and get_settings query
- Update EditErrorHandler struct and edit_error_handler API endpoint
- Update error handler cache to include the new setting
- Add skip logic in send_error_to_workspace_handler for u/ paths
- Add toggle in workspace settings UI
The implementation uses the existing cached settings to avoid additional
database queries, making it efficient.
Closes#7633
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* all
* update ee private
* combine migrations
* sqlx
* fix: migration fixes for auto_invite JSONB column
- Fix TEXT[] to JSONB conversion using to_jsonb()
- Add GIN index on auto_invite for efficient ? operator queries
- Add index cleanup to down migration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* sqlx
* all
* all
* all
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: instancd groups mapping to workspace
* npm run check
* nits
* improve apis
* sqlx prepare and ee-repo ref
* adding workspace assignment in groups page
* nits
* correct rollback
* sqlx
* ee repo ref
* revert accidental ee-repo-ref commit to main
* ee repo ref
* revert accidental ee-repo-ref commit to main
* use melt menu in sidebar
* stop keyboard navigation for disabled items
* use melt menu for FavoriteMenu and WorkspaceMenu
* fix popover placement for menuButton
* use melt menu for operator menu
* fix notification
* fix operator menu
* Use melt menu in FlowJobsMenu
* use melt menu for AppMenu
* clean code
* clean code
* add use clickOutside option to Menu
* use pointerdown_outside
* use pointerdown_outside
# Conflicts:
# frontend/src/lib/components/meltComponents/Menu.svelte
* use pointerdown in menus
* add max-h to app dropdown menu
* keep more open in operator menu
* add a MenuItem component
* clean
* nit
* nit
* clean code
* put conditionalMelt as utility function
* remove unused Portal
* Add debounce effect in operator menu
* fix component jumping due to z-index
* format pages
* migrate dropdown to melt
* migrate toggle to melt
* migrate popup to melt popover
* fix missing toggle item
* feat: remove `pip` fallback option for python and ansible (#5186)
* refactor!: Remove `pip` fallback option for python and ansible
BREAKING CHANGE: pip was deprecated since 1.425.0 (2024-11-15)
* fix errors in main.rs
* fix tests
* remove nsjail for pip
* fix imports
* fix compilation error
* reinforce melt types
* fix racing condition issue in closing operator menu
* nit
* fix id conflix with melt element
* nit
* clean code
* use melt dropdown instead of menubar
* prevent modal from closing on click outside button in menu
* Apply automatic changes
* fix nit
* nit
* close dropdown when opening a new one
* replace MenuV2 with melt Menu (1/4) (#5214)
* use melt menu in sidebar
* stop keyboard navigation for disabled items
* use melt menu for FavoriteMenu and WorkspaceMenu
* fix popover placement for menuButton
* use melt menu for operator menu
* fix notification
* fix operator menu
* Use melt menu in FlowJobsMenu
* use melt menu for AppMenu
* clean code
* clean code
* add use clickOutside option to Menu
* use pointerdown_outside
* use pointerdown_outside
# Conflicts:
# frontend/src/lib/components/meltComponents/Menu.svelte
* use pointerdown in menus
* add max-h to app dropdown menu
* keep more open in operator menu
* add a MenuItem component
* clean
* nit
* nit
* clean code
* put conditionalMelt as utility function
* remove unused Portal
* Add debounce effect in operator menu
* fix component jumping due to z-index
* feat: remove `pip` fallback option for python and ansible (#5186)
* refactor!: Remove `pip` fallback option for python and ansible
BREAKING CHANGE: pip was deprecated since 1.425.0 (2024-11-15)
* fix errors in main.rs
* fix tests
* remove nsjail for pip
* fix imports
* fix compilation error
* reinforce melt types
* fix racing condition issue in closing operator menu
* nit
* fix id conflix with melt element
* nit
* prevent modal from closing on click outside button in menu
---------
Co-authored-by: pyranota <92104930+pyranota@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
# Conflicts:
# frontend/src/lib/components/meltComponents/MenuItem.svelte
# frontend/src/lib/utils.ts
* clean
* fix z index and render
* fix initialize of dropdownmenu after melt migration
* feat: add support for | None and Optional in python (#5361)
* feat: add support for | None and Optional in python
* update python parser package
* add local rooting for MenuItem
* fix z index
* clean
* nit
* nit
* clean code
* nit
* nit
* clean code
* reinforce melt types
* wip
* reiforce instance select types for toggleButton
* nit
* fix double event
* fix selectedTable toggle
* fix sqs toggleButton
* fix potential issue with binding in toggleGroup
* Update frontend/src/routes/(root)/(logged)/runs/[...path]/+page.svelte
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
---------
Co-authored-by: pyranota <92104930+pyranota@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: HugoCasa <hugo@casademont.ch>
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
* use melt menu in sidebar
* stop keyboard navigation for disabled items
* use melt menu for FavoriteMenu and WorkspaceMenu
* fix popover placement for menuButton
* use melt menu for operator menu
* fix notification
* fix operator menu
* Use melt menu in FlowJobsMenu
* use melt menu for AppMenu
* clean code
* clean code
* add use clickOutside option to Menu
* use pointerdown_outside
* use pointerdown_outside
# Conflicts:
# frontend/src/lib/components/meltComponents/Menu.svelte
* use pointerdown in menus
* add max-h to app dropdown menu
* keep more open in operator menu
* add a MenuItem component
* clean
* nit
* nit
* clean code
* put conditionalMelt as utility function
* remove unused Portal
* Add debounce effect in operator menu
* fix component jumping due to z-index
* format pages
* migrate dropdown to melt
* migrate popup to melt popover
* feat: remove `pip` fallback option for python and ansible (#5186)
* refactor!: Remove `pip` fallback option for python and ansible
BREAKING CHANGE: pip was deprecated since 1.425.0 (2024-11-15)
* fix errors in main.rs
* fix tests
* remove nsjail for pip
* fix imports
* fix compilation error
* reinforce melt types
* fix racing condition issue in closing operator menu
* nit
* fix id conflix with melt element
* nit
* clean code
* use melt dropdown instead of menubar
* prevent modal from closing on click outside button in menu
* fix nit
* nit
* close dropdown when opening a new one
* replace MenuV2 with melt Menu (1/4) (#5214)
* use melt menu in sidebar
* stop keyboard navigation for disabled items
* use melt menu for FavoriteMenu and WorkspaceMenu
* fix popover placement for menuButton
* use melt menu for operator menu
* fix notification
* fix operator menu
* Use melt menu in FlowJobsMenu
* use melt menu for AppMenu
* clean code
* clean code
* add use clickOutside option to Menu
* use pointerdown_outside
* use pointerdown_outside
# Conflicts:
# frontend/src/lib/components/meltComponents/Menu.svelte
* use pointerdown in menus
* add max-h to app dropdown menu
* keep more open in operator menu
* add a MenuItem component
* clean
* nit
* nit
* clean code
* put conditionalMelt as utility function
* remove unused Portal
* Add debounce effect in operator menu
* fix component jumping due to z-index
* feat: remove `pip` fallback option for python and ansible (#5186)
* refactor!: Remove `pip` fallback option for python and ansible
BREAKING CHANGE: pip was deprecated since 1.425.0 (2024-11-15)
* fix errors in main.rs
* fix tests
* remove nsjail for pip
* fix imports
* fix compilation error
* reinforce melt types
* fix racing condition issue in closing operator menu
* nit
* fix id conflix with melt element
* nit
* prevent modal from closing on click outside button in menu
---------
Co-authored-by: pyranota <92104930+pyranota@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
# Conflicts:
# frontend/src/lib/components/meltComponents/MenuItem.svelte
# frontend/src/lib/utils.ts
* clean
* fix z index and render
* fix initialize of dropdownmenu after melt migration
* feat: add support for | None and Optional in python (#5361)
* feat: add support for | None and Optional in python
* update python parser package
* add local rooting for MenuItem
* fix z index
* clean
* nit
* nit
* clean code
* nit
---------
Co-authored-by: pyranota <92104930+pyranota@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: HugoCasa <hugo@casademont.ch>
* fix(frontend): Before legacy code + add confirmation modal when removing a user + fix folder stats
* fix(frontend): Add Date type narrowing
* fix(frontend): Add missing fullscreen in ScriptEditorDrawer
* fix(frontend): Check if we have un-saved changes before navigating to the homepage
* fix(frontend): correctly use the keyed each
* fix(frontend): add DateTimeInput
* fix(frontend): add DateTimeInput
* fix(frontend): add DateTimeInput
* fix(frontend): code cleanup
* fix(frontend): Set default time to 00:00
hugocasaandClaude Opus 5
Diego ImbertandClaude Opus 4.6
Alexander Petric
Ruben Fiszel
Henri Courdent
Ry Blaisdell
Faton Ramadani