mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-06 00:02:13 +00:00
Diego Imbert
45d5eeda0e
A role with a stored pg_rolename but no password resolved to the data table's own connection, which owns everything — so a caller authorized as one role got the admin one instead. Exports and git-synced settings redact that password, so a restored config is exactly the shape that produced it. Refuse instead, and name the fix. The ACL endpoints took any workspace member: on a data table without roles every member resolves to that same admin connection, so ownership and grants there are the workspace admins' to change, as the roles themselves are. Also: check a migration batch's roles before applying any of it, keep the role picker for a single non-default role, drop the revoke button from a default privilege on types (which no scope can express), and say what get_datatable_resource_as_default_role actually resolves as.
Windmill frontend
The Windmill frontend written in Svelte 5 + Tailwind CSS
The frontend is under AGPL, see the LICENSE file at the root of this repo