windmill/backend/migrations/20260619112847_grant_script_trigger_to_windmill_roles.down.sql at python-instance-baseline - windmill - Gitea: Git with a cup of tea

starred/windmill

mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-13 00:03:00 +00:00

Files

T

Ruben FiszelandClaude Opus 4.8 33617367d0 fix(backend): grant script_trigger access to windmill roles (#9674 )

The script_trigger table (migration 20260423050000_script_trigger)
relied on ALTER DEFAULT PRIVILEGES to grant access to windmill_user and
windmill_admin. Those default privileges only apply to objects created
by the role that set them (migration 20250205131523), so deployments
whose migration runner is a different role leave script_trigger
ungranted.

Direct application writes run as the invoking role and fail with
"permission denied for table script_trigger" — notably
clear_script_triggers and insert_script_trigger in
windmill-common/src/assets.rs during every script save.

Add an explicit GRANT on script_trigger and its sequence, matching the
notify_event fix (#9665) and the asset table precedent.

Fixes WIN-2076

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-19 11:30:21 +00:00

5 lines

230 B

SQL

Raw Permalink Blame History

 REVOKE ALL ON script_trigger FROM windmill_user;
 REVOKE ALL ON script_trigger FROM windmill_admin;
 REVOKE ALL ON SEQUENCE script_trigger_id_seq FROM windmill_user;
 REVOKE ALL ON SEQUENCE script_trigger_id_seq FROM windmill_admin;