mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-21 08:02:38 +00:00
Diego ImbertandClaude Opus 5
c400469e67
The concurrency test reimplemented the read-modify-write inline, so deleting the lock from all three handlers left it green — it pinned Postgres, not the code it was written for. It now drives `create_datatable_role` twice concurrently and asserts the catalog kept both names. Checked the way the last one should have been: removing the lock from the handler makes it fail with "wmtest_a_… is a live cluster login the catalog forgot". The contracts added last commit were stricter than this PR's own callers, which is worse than none — the next reader sees a rule already broken and learns to ignore it. `read_role_catalog` said superadmin-only while two of its four callers are open to any workspace member, and `converge_connect_grants` said superadmin while `set_datatable_permissions` reaches it as a workspace admin. Both were fine on substance: the rule that actually holds is about the credential never reaching a response, log, audit record or export, not about who may call. They now say that. `read_datatable_entry` gets the same treatment rather than the one the earlier message claimed for it: it is the primitive every resolution goes through, so it is deliberately open, and what must not escape is `permissions` — it names the governing workspace's users, groups and folders. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012ti5HyeTikPMYyW8YSdiHR
47 lines
2.3 KiB
SQL
47 lines
2.3 KiB
SQL
-- A data table under roles in `test-workspace`, and a fork whose entry points at it rather than
|
|
-- carrying a copy. `test-user-2` is a non-admin of the parent and an admin of the fork: the shape
|
|
-- the pointer exists for.
|
|
|
|
INSERT INTO global_settings (name, value) VALUES
|
|
-- Empty registry: role provisioning grants CONNECT on every database named here, and the
|
|
-- data table's `dt_main` is a name in workspace settings, not a database that exists.
|
|
('custom_instance_pg_databases', '{"user_pwd": "pw", "databases": {}}'::jsonb),
|
|
-- The role catalog has its own row: it holds generated credentials and must stay out of the
|
|
-- operator-facing config the neighbouring row belongs to.
|
|
('datatable_roles', '{"role1": {"name": "analytics", "enabled": true, "pwd": "pw"}}'::jsonb)
|
|
ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value;
|
|
|
|
UPDATE workspace_settings SET datatable = '{
|
|
"datatables": {
|
|
"main": {
|
|
"database": {"resource_type": "instance", "resource_path": "dt_main"},
|
|
"permissions": {
|
|
"default_role": "role1",
|
|
"roles": {
|
|
"admin": {"tenants": []},
|
|
"role1": {"tenants": ["u/test-user-2", "g/analysts", "f/finance"]}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}'::jsonb WHERE workspace_id = 'test-workspace';
|
|
|
|
INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
|
|
('test-workspace', 'analysts', 'Analysts', '{}');
|
|
INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms) VALUES
|
|
('test-workspace', 'finance', 'finance', '{}', '{}');
|
|
|
|
INSERT INTO workspace (id, name, owner, parent_workspace_id) VALUES
|
|
('wm-fork-dt', 'fork of test-workspace', 'test2@windmill.dev', 'test-workspace');
|
|
INSERT INTO workspace_key (workspace_id, kind, key) VALUES ('wm-fork-dt', 'cloud', 'test-key');
|
|
INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
|
|
('wm-fork-dt', 'all', 'All users', '{}');
|
|
INSERT INTO usr (workspace_id, email, username, is_admin, role) VALUES
|
|
('wm-fork-dt', 'test2@windmill.dev', 'test-user-2', true, 'Admin');
|
|
|
|
INSERT INTO workspace_settings (workspace_id, datatable) VALUES ('wm-fork-dt', '{
|
|
"datatables": {
|
|
"main": {"reference": {"workspace_id": "test-workspace", "datatable": "main"}}
|
|
}
|
|
}'::jsonb);
|