mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-20 00:02:19 +00:00

Files

T

Ruben Fiszel 57ad009f9f fix: create windmill_admin without BYPASSRLS on managed dbs

On managed Postgres (Scaleway, RDS, Azure, ...) the connecting user is not
a superuser and cannot create a role WITH BYPASSRLS. The early migrations
create windmill_admin WITH BYPASSRLS inside DO/EXCEPTION blocks that swallow
the resulting "permission denied to create role" error, so the role is never
created. The first bare `GRANT ... TO windmill_admin` migration
(20221211192539) then hard-fails with `role "windmill_admin" does not exist`,
aborting all initial migrations.

Bootstrap windmill_user and windmill_admin before migrations run, falling
back to a plain windmill_admin (no BYPASSRLS) when BYPASSRLS is not permitted.
Admin access remains correct in that case via the explicit admin_policy
(USING true) entries already created for every RLS table.

Fixes WIN-2042

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-14 22:26:58 +00:00