mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-13 08:02:47 +00:00
Ruben FiszelandClaude Opus 4.8
a682d02311
The notify_event table (migration 20260203172950_polling_based_events) relied on ALTER DEFAULT PRIVILEGES to grant access to windmill_user and windmill_admin. Those default privileges only apply to objects created by the role that set them (migration 20250205131523), so deployments whose migration runner is a different role leave notify_event ungranted. Trigger inserts were already worked around with SECURITY DEFINER (migration 20260206060555), but direct application inserts that run as the invoking role still failed with "permission denied for table notify_event" — notably clear_static_asset_usage in assets.rs during script save, and restart_worker_group in settings. Add an explicit GRANT on notify_event and its sequence, matching the existing explicit-grant pattern used for the asset table. Fixes WIN-2074 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
5 lines
222 B
SQL
5 lines
222 B
SQL
REVOKE ALL ON notify_event FROM windmill_user;
|
|
REVOKE ALL ON notify_event FROM windmill_admin;
|
|
REVOKE ALL ON SEQUENCE notify_event_id_seq FROM windmill_user;
|
|
REVOKE ALL ON SEQUENCE notify_event_id_seq FROM windmill_admin;
|