hugocasa f4a935bd1c fix(schedule): hoist non-RLS reads out of the create_schedule tx (#10658) ...

create_schedule opened the RLS transaction (user_db.begin) first, then ran
reads that deliberately use the non-RLS `db` pool — fork-ness and
permissioned_as/email resolution — while holding it. Acquiring a second pooled
connection while the tx holds one self-deadlocks on a single-connection pool
(embedded Postgres, PgBouncer statement mode, any max_connections=1 setup): the
read blocks on the sqlx acquire timeout, then errors.

Move those reads (and the ScheduleType::from_str validation) above
user_db.begin(). They don't depend on the tx and bypass RLS by design, so the
result is semantically identical; the RLS transaction is simply opened later and
held for less time. Same class of fix as #9970 (migration bootstrap on the
migrator's held connection).

Note: sibling paths keep the same latent pattern on branches this change does
not touch (push_scheduled_job reads the pool under the tx for flow schedules;
edit_schedule/set_enabled for cross-user permissioned_as) — a possible follow-up.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-08-12 13:11:18 +02:00

..

src

fix(schedule): hoist non-RLS reads out of the create_schedule tx (#10658)

2026-08-12 13:11:18 +02:00

Cargo.toml

refactor: extract 12 leaf crates from windmill-api (#7899)

2026-02-11 10:31:03 +00:00