Files
windmill/backend/migrations
Ruben Fiszel 293647de4c fix: grant workspace_diff, materialized_partition, debounce_stale_data to windmill roles (#9853)
Same grant gap already fixed for notify_event (20260619091631),
script_trigger (20260619112847), and dispatch_event: tables created after the
one-time GRANT ALL in 20250205131523 rely on ALTER DEFAULT PRIVILEGES, which
only covers objects created by the role that set them. On deployments whose
migration runner is a different role, these tables end up ungranted, and writes
that run under the RLS role (a transaction opened via user_db.begin(&authed) ->
SET LOCAL ROLE windmill_user/windmill_admin) fail with "permission denied for
table <name>".

Audited every table created after 20250205131523: these three are the only
ones with a confirmed write on a user_db transaction that lacked a grant:
- workspace_diff: UPDATE in set_ws_specific (workspaces.rs)
- materialized_partition: INSERT via record_materialization (assets API);
  sibling materialized_asset_schema was already granted
- debounce_stale_data: DELETE in resume_suspended_trigger_jobs (global_handler.rs)

GRANT is idempotent so re-application is a no-op.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-01 10:38:19 +02:00
..
2022-05-05 04:25:58 +02:00
2022-05-05 04:25:58 +02:00
2022-05-05 04:25:58 +02:00
2022-05-05 04:25:58 +02:00
2022-05-05 04:25:58 +02:00
2022-05-05 04:25:58 +02:00
2022-05-05 04:25:58 +02:00
2022-11-26 19:39:37 +01:00
v2
2023-11-22 18:29:51 +01:00
v2
2023-11-22 18:29:51 +01:00