Diego Imbert 0fc9ba39a7 fix(datatables): a tenant and a resource path follow the principal they name ...

A data table role names its tenants — `u/alice`, `g/devs`, `f/team` — and a
data table names its database by resource path. Both are strings that outlive
what they point at, and the flows that free those names left them behind:

- Deleting a workspace user, a group or a folder left its tenant on every role
  it could run as. The name is free afterwards, so whoever takes it next
  inherits the role without an admin granting it. All three now drop it in the
  same transaction that removes the principal.
- Offboarding reassigns a user's resources to a folder without the data table
  following, which both stops it resolving and frees the path it named — a new
  resource there points it at another database with its roles intact. The
  username rename had the same gap. Both move the config with the resource.

The walk both need is one function each now, with the table test that pins
which tenant forms it touches.

Saving permissions also takes a lock per data table, held from the read that
plans to the write that persists: two saves interleaved each planned against
what the other was leaving, and the one that persisted last stored roles the
other had already dropped. The ACL apply takes the same lock, since it reads
the same config and catalog.

2026-09-02 10:27:28 +02:00

..

src

fix(datatables): a tenant and a resource path follow the principal they name

2026-09-02 10:27:28 +02:00

Cargo.toml

feat: folder default_permissioned_as rules for ownership defaults on deploy (#8801)

2026-04-12 20:14:07 +00:00