Ruben Fiszel 7363d2c217 fix(forks): require admin of both sides for the compare visibility guard (#9869) ...

The blast-radius guard added in #9866 forced `all_ahead_items_visible` true for
any fork/target admin. But `filter_visible_diffs` keeps a modified/conflict row
(one that exists in the source AND the fork) only when the caller can see it on
both sides, so an ahead diff can be dropped for a source-side visibility gap even
when the caller is a fork admin. Forcing the flag on fork-admin alone then wrongly
reported "all ahead items visible", letting the UI enable deployment from an
incomplete comparison.

Gate the guard on admin of BOTH the source and the fork (superadmin satisfies
both), which is what actually guarantees full visibility of every item on every
side. Adds a regression test where a fork admin who is only a plain member of the
parent (no access to the item's folder) must still get `all_ahead_items_visible
= false`, plus the superadmin sanity path.

Also restores the SQLx offline cache entry for the phantom-trigger test INSERT
that #9866 landed without (CI/`SQLX_OFFLINE=true` builds failed on it), and adds
entries for the new test's all-literal queries.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-01 23:29:53 +02:00

..

fixtures

fix(security): scope variable and resource value caches by caller identity (#9427)

2026-06-03 10:31:45 +00:00

ai_routes.rs

fix(ai): enforce RLS and scope check on user-supplied X-Resource-Path (#9276)

2026-05-21 15:21:27 +00:00

apps.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

audit.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

capture_unauthed.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

ci_tests.rs

feat: WM_TESTED_RUNNABLE env var + wildcards in test: annotation (#8926)

2026-04-24 12:52:25 +00:00

concurrency_groups.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

configs.rs

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

drafts.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

favorites.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

flows.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

folder_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

folders.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

granular_acls.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

group_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

groups.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

health.rs

test nits

2026-03-27 12:28:54 +00:00

inputs.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

job_metrics.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

jobs_authed.rs

test nits

2026-03-27 12:28:54 +00:00

jobs_unauthed.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

native_triggers.rs

fix: gate native integration pickers behind non-operator check (#9465)

2026-06-07 08:18:14 +00:00

npm_proxy.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

offboarding.rs

feat: add user offboarding flow with object reassignment (#8647)

2026-04-09 17:31:36 +00:00

permissions.rs

feat: store hashed tokens instead of plaintext (#8217)

2026-03-17 01:15:38 +00:00

protection_rules.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

raw_apps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

resources.rs

fix(security): scope variable and resource value caches by caller identity (#9427)

2026-06-03 10:31:45 +00:00

run_inline.rs

feat: mcp oauth gateway (#8443)

2026-03-20 16:12:59 +00:00

schedules.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

scripts.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

sensitive_log_masking.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

service_logs.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

settings.rs

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

slack_approvals_unauthed.rs

fix: authenticate slack callback payload with per-workspace hmac (#9461)

2026-06-06 08:02:20 +00:00

token_hash.rs

fix(native-triggers): serialize Google channel renewal across replicas (#9060)

2026-05-08 07:59:46 +00:00

token_label_idor.rs

fix: prevent token label collision bypassing job read access control (#9462)

2026-06-06 07:47:52 +00:00

trash.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

trigger_e2e.rs

fix: advance postgres replication slot lsn via periodic standby status updates (#9227)

2026-05-19 05:44:13 +00:00

triggers.rs

fix: replace email with permissioned_as for triggers/schedules (#8439)

2026-03-20 16:28:38 +00:00

users.rs

feat: edit scopes on existing API tokens (#8967)

2026-04-29 19:49:56 +00:00

variables.rs

fix(security): scope variable and resource value caches by caller identity (#9427)

2026-06-03 10:31:45 +00:00

workspace_comparison.rs

fix(forks): require admin of both sides for the compare visibility guard (#9869)

2026-07-01 23:29:53 +02:00

workspace_dependencies_git_sync.rs

fix: scope promotion-mode debounce key per repo (#9145)

2026-05-13 11:35:30 +00:00

workspace_deps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

workspace_encryption_key_git_sync.rs

fix: batch encryption-key rotation into one git-sync job (#9355)

2026-05-29 05:12:35 +00:00

workspaces.rs

fix: preserve fork parent linkage on workspace id change (#9716)

2026-06-23 20:54:07 +00:00