mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-21 16:02:28 +00:00
Ruben Fiszel
97f4477069
* feat(forks): let a fork's creator manage developers on it without being an admin Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(forks): bind the fork-creator grant to the member's parent username and lock the delete Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
34 lines
2.0 KiB
SQL
34 lines
2.0 KiB
SQL
-- `test2` (a non-admin developer of test-workspace) has forked it. The fork's `usr` row copies the
|
|
-- non-admin role they hold in the parent, which is the situation the fork-creator grant exists for.
|
|
INSERT INTO workspace (id, name, owner, parent_workspace_id) VALUES
|
|
('wm-fork-test', 'fork of test-workspace', 'test2@windmill.dev', 'test-workspace');
|
|
|
|
INSERT INTO workspace_settings (workspace_id) VALUES ('wm-fork-test');
|
|
|
|
INSERT INTO workspace_key (workspace_id, kind, key) VALUES ('wm-fork-test', 'cloud', 'test-key');
|
|
|
|
INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
|
|
('wm-fork-test', 'all', 'All users', '{}');
|
|
|
|
INSERT INTO usr (workspace_id, email, username, is_admin, role) VALUES
|
|
('wm-fork-test', 'test2@windmill.dev', 'test-user-2', false, 'User'),
|
|
-- An admin of the fork, whom its creator must not be able to remove.
|
|
('wm-fork-test', 'test@windmill.dev', 'test-user', true, 'Admin');
|
|
|
|
-- An operator of the parent: the eligibility bar for being added to the fork is developer-or-above
|
|
-- there, so this user must be rejected.
|
|
INSERT INTO password (email, password_hash, login_type, super_admin, verified, name, username)
|
|
VALUES ('test4@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Test User 4', 'test-user-4');
|
|
|
|
INSERT INTO usr (workspace_id, email, username, is_admin, operator, role) VALUES
|
|
('test-workspace', 'test4@windmill.dev', 'test-user-4', false, true, 'Operator');
|
|
|
|
-- add_user resolves the instance-wide username from `password`.
|
|
UPDATE password SET username = 'test-user-2' WHERE email = 'test2@windmill.dev';
|
|
UPDATE password SET username = 'test-user-3' WHERE email = 'test3@windmill.dev';
|
|
|
|
-- With automated username creation off, `add_user` takes the username from the caller. That branch
|
|
-- is what the fork creator must not be able to steer, so the tests run against it.
|
|
INSERT INTO global_settings (name, value) VALUES ('automate_username_creation', 'false'::jsonb)
|
|
ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value;
|