diff --git a/backend/migrations/20230327201258_add_granular_share_apps.down.sql b/backend/migrations/20230327201258_add_granular_share_apps.down.sql new file mode 100644 index 0000000000..d2f607c5b8 --- /dev/null +++ b/backend/migrations/20230327201258_add_granular_share_apps.down.sql @@ -0,0 +1 @@ +-- Add down migration script here diff --git a/backend/migrations/20230327201258_add_granular_share_apps.up.sql b/backend/migrations/20230327201258_add_granular_share_apps.up.sql new file mode 100644 index 0000000000..40757dc687 --- /dev/null +++ b/backend/migrations/20230327201258_add_granular_share_apps.up.sql @@ -0,0 +1,11 @@ +-- Add up migration script here +CREATE POLICY see_extra_perms_user ON app FOR ALL +USING (extra_perms ? CONCAT('u/', current_setting('session.user'))) +WITH CHECK ((extra_perms ->> CONCAT('u/', current_setting('session.user')))::boolean); + +CREATE POLICY see_extra_perms_groups ON app FOR ALL +USING (extra_perms ?| regexp_split_to_array(current_setting('session.pgroups'), ',')::text[]) +WITH CHECK (exists( + SELECT key, value FROM jsonb_each_text(extra_perms) + WHERE SPLIT_PART(key, '/', 1) = 'g' AND key = ANY(regexp_split_to_array(current_setting('session.pgroups'), ',')::text[]) + AND value::boolean)); \ No newline at end of file diff --git a/backend/windmill-api/src/workspaces.rs b/backend/windmill-api/src/workspaces.rs index ff2360c46b..be4695538e 100644 --- a/backend/windmill-api/src/workspaces.rs +++ b/backend/windmill-api/src/workspaces.rs @@ -1005,6 +1005,16 @@ async fn add_user( .execute(&mut tx) .await?; + sqlx::query_as!( + Group, + "INSERT INTO usr_to_group (workspace_id, usr, group_) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING", + &w_id, + nu.username, + "all", + ) + .execute(&mut tx) + .await?; + tx.commit().await?; if let Some(new_user_webhook) = NEW_USER_WEBHOOK.clone() { diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs index 25864f54e1..fe3965b1c3 100644 --- a/backend/windmill-worker/src/worker_flow.rs +++ b/backend/windmill-worker/src/worker_flow.rs @@ -11,8 +11,8 @@ use std::iter; use std::time::Duration; use crate::jobs::{add_completed_job, add_completed_job_error, schedule_again_if_scheduled}; -use crate::js_eval::{eval_timeout, IdContext}; -use crate::{worker, KEEP_JOB_DIR, AuthedClient}; +use crate::js_eval::{eval_timeout, IdContext}; +use crate::{worker, AuthedClient, KEEP_JOB_DIR}; use anyhow::Context; use async_recursion::async_recursion; use dyn_iter::DynIter; @@ -120,8 +120,7 @@ pub async fn update_flow_status_after_job_completion( let stop_early = success && if let Some(expr) = r.stop_early_expr.clone() { - compute_bool_from_expr(expr, &r.args, result.clone(), None, Some(client)) - .await? + compute_bool_from_expr(expr, &r.args, result.clone(), None, Some(client)).await? } else { false }; @@ -727,18 +726,13 @@ async fn transform_input( context.push(("error".to_string(), error.unwrap().clone())); } - let v = eval_timeout( - expr.to_string(), - context, - Some(client), - Some(by_id.clone()) - ) - .await - .map_err(|e| { - Error::ExecutionErr(format!( - "Error during isolated evaluation of expression `{expr}`:\n{e}" - )) - })?; + let v = eval_timeout(expr.to_string(), context, Some(client), Some(by_id.clone())) + .await + .map_err(|e| { + Error::ExecutionErr(format!( + "Error during isolated evaluation of expression `{expr}`:\n{e}" + )) + })?; mapped.insert(key.to_string(), v); () } @@ -865,7 +859,7 @@ async fn push_next_flow_job( ] .into(), None, - None + None, ) .await .map_err(|e| { @@ -1128,7 +1122,7 @@ async fn push_next_flow_job( resume_messages.as_slice(), approvers, by_id, - client + client, ) .await } @@ -1167,7 +1161,7 @@ async fn push_next_flow_job( &status_module, last_result.clone(), previous_id, - client + client, ) .await?; tx.commit().await?; @@ -1498,7 +1492,6 @@ async fn script_path_to_payload<'c>( Ok(job_payload) } - async fn compute_next_flow_transform<'c>( flow_job: &QueuedJob, flow: &FlowValue, @@ -1509,7 +1502,7 @@ async fn compute_next_flow_transform<'c>( status_module: &FlowStatusModule, last_result: serde_json::Value, previous_id: String, - client: &AuthedClient + client: &AuthedClient, ) -> error::Result<(sqlx::Transaction<'c, sqlx::Postgres>, NextFlowTransform)> { match &module.value { FlowModuleValue::Identity => Ok(( @@ -1579,7 +1572,7 @@ async fn compute_next_flow_transform<'c>( ] }, Some(client), - Some(by_id) + Some(by_id), ) .await? .into_array() @@ -1696,8 +1689,7 @@ async fn compute_next_flow_transform<'c>( | FlowStatusModule::WaitingForEvents { .. } | FlowStatusModule::WaitingForExecutor { .. } => { let mut branch_chosen = BranchChosen::Default; - let idcontext = - get_transform_context(&flow_job, previous_id, &status).await?; + let idcontext = get_transform_context(&flow_job, previous_id, &status).await?; for (i, b) in branches.iter().enumerate() { let pred = compute_bool_from_expr( b.expr.to_string(), @@ -1873,16 +1865,13 @@ async fn get_transform_context( previous_id: String, status: &FlowStatus, ) -> error::Result { - let steps_results: HashMap = status .modules .iter() .filter_map(|x| x.job_result().map(|y| (x.id(), y))) .collect(); - Ok( - IdContext { flow_job: flow_job.id, steps_results, previous_id }, - ) + Ok(IdContext { flow_job: flow_job.id, steps_results, previous_id }) } async fn evaluate_with( @@ -1896,15 +1885,7 @@ where { match transform { InputTransform::Static { value } => Ok(value), - InputTransform::Javascript { expr } => { - eval_timeout( - expr, - vars(), - client, - by_id, - ) - .await - } + InputTransform::Javascript { expr } => eval_timeout(expr, vars(), client, by_id).await, } } trait IntoArray: Sized {