Guilhem LemouelandClaude Opus 5.5 8bba9e92f9 feat: gate forking behind a role capability ...

Forking becomes the `fork` capability of a workspace role: `developer` holds it, `operator` and
other roles do not until an admin grants it per role, in the instance roles or a workspace
override. Both fork endpoints refuse a role without it; until now only the frontend hid the
entry. A member who forks is a developer in the fork. A role without it keeps a disabled
"Workspace fork" entry in the workspace picker explaining how to get it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-22 06:57:11 -07:00

..

fixtures

feat: put a data table's connection under Postgres roles (#11020)

2026-09-18 13:56:41 +02:00

agent_on_behalf_of.rs

[ee] fix: stop handlers, apps and agents resolving untrusted refs (#11893)

2026-10-21 10:19:20 +02:00

ai_routes.rs

feat: add test key button to AI resource drawers (#11466)

2026-10-01 18:25:49 +02:00

apps.rs

feat: make createApp and updateApp the full-code app tools over MCP (#10510)

2026-08-04 18:20:48 +02:00

assets.rs

fix: show runtime-detected assets in a run's Assets tab (#10738)

2026-08-18 10:26:20 +02:00

audit.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

capture_unauthed.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

ci_tests.rs

feat: WM_TESTED_RUNNABLE env var + wildcards in test: annotation (#8926)

2026-04-24 12:52:25 +00:00

concurrency_groups.rs

authorize GET /concurrency_groups/{job_id}/key per job (#10665)

2026-08-12 21:05:02 +02:00

configs.rs

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

datatable_acl.rs

feat: add an ACL editor for data table roles (#11063)

2026-09-19 23:23:50 +02:00

datatable_roles.rs

feat: configurable workspace roles with per-workspace overrides (#11821)

2026-10-21 15:51:54 +02:00

dbt_materialize_target.rs

feat: let // materialize declare a dbt:// warehouse-relation write (#10978)

2026-09-07 17:38:07 +02:00

drafts.rs

feat: configurable workspace roles with per-workspace overrides (#11821)

2026-10-21 15:51:54 +02:00

favorites.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

flows.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

folder_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

folders.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

fork_background.rs

fix: bound a resumed session fork's wait, keep its intent while in flight (#11413)

2026-09-29 16:49:25 +02:00

fork_clone_on_behalf_of.rs

feat: agents run on behalf of their deployer (#11430)

2026-10-15 19:31:21 +02:00

fork_member_grant.rs

feat(forks): let a fork's creator manage developers on it without being an admin (#10166)

2026-07-17 15:13:36 +02:00

fork_members.rs

feat: add a workspace toggle that adds its admins and developers to new forks (#11215)

2026-09-18 15:15:35 +02:00

fork_secret_replication_azure.rs

test: drop empty doctest and lib-test targets, ignore service tests (#11852)

2026-10-17 22:30:42 +02:00

granular_acls.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

group_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

groups.rs

fix: reserve handler group names for admins (#11823)

2026-10-16 20:40:04 +02:00

health.rs

test nits

2026-03-27 12:28:54 +00:00

inputs.rs

fix: show scheduled singlestepflow runs in flow history sidebar (#10312)

2026-07-24 18:12:09 +02:00

job_metrics.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

jobs_authed.rs

feat: configurable workspace roles with per-workspace overrides (#11821)

2026-10-21 15:51:54 +02:00

jobs_unauthed.rs

test: stop backend tests waiting out real time they do not need (#11851)

2026-10-17 22:11:29 +02:00

login_link.rs

Revert "feat(auth): 2 h login links and a click-to-sign-in page for emailed ones (#11203)" (#11267)

2026-09-21 16:54:28 +00:00

max_token_expiration.rs

feat: cap user token expiration with an instance setting (#11159)

2026-09-18 14:37:39 +02:00

mcp_preprocessor_headers.rs

test: find the mcp preprocessor probe tool by its new name (#11833)

2026-10-16 21:57:37 +02:00

mcp_protocol_versions.rs

feat(mcp): serve the 2026-07-28 spec alongside the legacy protocol (#10535)

2026-08-05 13:52:09 +02:00

mcp_token_query_param.rs

feat: add an instance setting to refuse a token in MCP URLs (#11162)

2026-09-18 15:24:00 +02:00

native_triggers.rs

feat: configurable workspace roles with per-workspace overrides (#11821)

2026-10-21 15:51:54 +02:00

nested_dev_workspace.rs

test: stop backend tests waiting out real time they do not need (#11851)

2026-10-17 22:11:29 +02:00

npm_proxy.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

offboarding.rs

feat: agents run on behalf of their deployer (#11430)

2026-10-15 19:31:21 +02:00

operator_builder_apps.rs

feat: configurable workspace roles with per-workspace overrides (#11821)

2026-10-21 15:51:54 +02:00

operator_builder_flows.rs

feat: configurable workspace roles with per-workspace overrides (#11821)

2026-10-21 15:51:54 +02:00

operator_fork.rs

feat: gate forking behind a role capability

2026-10-22 06:57:11 -07:00

operator_manage_rights.rs

feat: configurable workspace roles with per-workspace overrides (#11821)

2026-10-21 15:51:54 +02:00

permissions.rs

feat: store hashed tokens instead of plaintext (#8217)

2026-03-17 01:15:38 +00:00

preview_on_behalf_of.rs

feat: run previews as the runnable's on_behalf_of identity (#11778)

2026-10-15 10:13:27 +00:00

protection_rules.rs

fix: let a draft-only schedule, trigger or resource be deleted (#11010)

2026-09-07 18:55:40 +02:00

raw_apps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

remote_deploy.rs

feat: deploy from the UI to a workspace on another instance (#11245)

2026-09-22 01:40:53 +02:00

resources.rs

fix: hold mcp token references to resource reference scopes (#11803)

2026-10-16 17:28:29 +02:00

run_inline.rs

feat: mcp oauth gateway (#8443)

2026-03-20 16:12:59 +00:00

schedules.rs

fix: let a draft-only schedule, trigger or resource be deleted (#11010)

2026-09-07 18:55:40 +02:00

scripts.rs

fix: stop running deleted script versions from worker caches (#11456)

2026-10-01 13:37:00 +02:00

sensitive_log_masking.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

service_logs.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

settings.rs

fix: let instances withhold signing secrets from the settings API (#11483)

2026-10-02 19:25:04 +02:00

slack_approvals_unauthed.rs

fix: authenticate slack callback payload with per-workspace hmac (#9461)

2026-06-06 08:02:20 +00:00

token_expiry_warning.rs

feat: cap user token expiration with an instance setting (#11159)

2026-09-18 14:37:39 +02:00

token_hash.rs

fix: keep native triggers attached when a runnable is renamed (#10432)

2026-07-31 23:44:25 +02:00

token_label_idor.rs

fix: skip expiry notifications for app embed and SDK tokens (#11169)

2026-09-16 17:28:53 +02:00

trash.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

trigger_e2e.rs

fix: advance postgres replication slot lsn via periodic standby status updates (#9227)

2026-05-19 05:44:13 +00:00

triggers.rs

feat: support application default credentials for gcp pub/sub triggers (#10778)

2026-08-21 10:41:14 +02:00

users.rs

fix: revoke mcp oauth grants on password change and reset (#11908)

2026-10-21 13:58:03 +02:00

variables.rs

fix(security): scope variable and resource value caches by caller identity (#9427)

2026-06-03 10:31:45 +00:00

workspace_comparison.rs

fix: ignore schedule missed-run counters in workspace compare (#11570)

2026-10-06 18:06:09 +02:00

workspace_dependencies_git_sync.rs

fix(git-sync): run auto-pull as the admin who enabled it (#11121)

2026-09-15 10:34:57 +02:00

workspace_dependencies.rs

fix: scope workspace dependencies create to the path workspace (#11385)

2026-09-28 18:15:10 +02:00

workspace_deps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

workspace_encryption_key_git_sync.rs

fix: re-encrypt git sync secrets on workspace key rotation (#11218)

2026-09-18 15:21:07 +02:00

workspaces.rs

feat: configurable workspace roles with per-workspace overrides (#11821)

2026-10-21 15:51:54 +02:00