kalugin66/windmill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

block adding/inviting members to admins workspace (#8721)

Browse Source 
* fix: block adding/inviting members to admins workspace on CE

The admins workspace is reserved for superadmins only. On CE (non-enterprise),
prevent adding or inviting users to it via both API and UI.

Backend: add #[cfg(not(feature = "enterprise"))] guards to invite_user and
add_user endpoints that reject requests targeting the admins workspace.

Frontend: show an info alert on the admins workspace members page and hide
the add/invite/auto-add buttons.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use derived variable for admins workspace alert consistency

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-04-04 07:06:14 -04:00
committed by GitHub
parent 2b865c0694
commit 342defecd2
2 changed files with 325 additions and 298 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
backend/windmill-api-workspaces/src/workspaces.rs
View File

@@ -4044,6 +4044,13 @@ async fn invite_user(
) -> Result<(StatusCode, String)> {
require_admin(is_admin, &username)?;
#[cfg(not(feature = "enterprise"))]
if w_id == "admins" {
return Err(Error::BadRequest(
"The admins workspace is reserved for superadmins. Members cannot be added to it without an enterprise license.".to_string(),
));
}
nu.email = nu.email.to_lowercase();
let mut tx = db.begin().await?;
@@ -4109,6 +4116,14 @@ async fn add_user(
Json(mut nu): Json<NewWorkspaceUser>,
) -> Result<(StatusCode, String)> {
require_admin(authed.is_admin, &authed.username)?;
#[cfg(not(feature = "enterprise"))]
if w_id == "admins" {
return Err(Error::BadRequest(
"The admins workspace is reserved for superadmins. Members cannot be added to it without an enterprise license.".to_string(),
));
}
nu.email = nu.email.to_lowercase();
let mut tx = db.begin().await?;