windmill-components 1.677.1 → 1.687.0

package/package/components/FolderEditor.svelte

@@ -6,7 +6,7 @@ import Skeleton from './common/skeleton/Skeleton.svelte';
 import GroupEditor from './GroupEditor.svelte';
 import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte';
 import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte';
-import { Eye, Plus, Trash } from 'lucide-svelte';
+import { ArrowDown, ArrowUp, Eye, Plus, Trash } from 'lucide-svelte';
 import Label from './Label.svelte';
 import { sendUserToast } from '../toast';
 import { createEventDispatcher, untrack } from 'svelte';
@@ -14,6 +14,9 @@ import Select from './select/Select.svelte';
 import { safeSelectItems } from './select/utils.svelte';
 import TextInput from './text_input/TextInput.svelte';
 import PermissionHistory from './PermissionHistory.svelte';
+import { Minimatch } from 'minimatch';
+import Tooltip from './Tooltip.svelte';
+import CollapseLink from './CollapseLink.svelte';
 let { name } = $props();
 let can_write = $state(false);
 let folder;
@@ -51,6 +54,7 @@ async function loadFolder() {
     try {
         folder = await FolderService.getFolder({ workspace: $workspaceStore, name });
         summary = folder.summary ?? '';
+        defaultPermissionedAs = (folder.default_permissioned_as ?? []).map((r) => ({ ...r }));
         can_write =
             $userStore != undefined &&
                 (folder?.owners.includes('u/' + $userStore.username) ||
@@ -71,6 +75,73 @@ async function loadFolder() {
         folderNotFound = true;
     }
 }
+// --- default_permissioned_as rules editor ---
+let defaultPermissionedAs = $state([]);
+const canEditDefaults = $derived(can_write &&
+    ($userStore?.is_admin ||
+        $userStore?.is_super_admin ||
+        ($userStore?.groups ?? []).includes('wm_deployers')));
+function isValidGlob(glob) {
+    if (!glob)
+        return false;
+    try {
+        new Minimatch(glob);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isValidPermissionedAs(value) {
+    return /^[ug]\/.+/.test(value) || value.includes('@');
+}
+// Split a permissioned_as value like "u/alice" or "g/prod" into its kind and name.
+function ruleKind(value) {
+    return value.startsWith('g/') ? 'group' : 'user';
+}
+function ruleName(value) {
+    if (value.startsWith('u/') || value.startsWith('g/'))
+        return value.slice(2);
+    return value;
+}
+function setRulePermissionedAs(idx, kind, name) {
+    const prefix = kind === 'user' ? 'u/' : 'g/';
+    defaultPermissionedAs[idx].permissioned_as = prefix + name;
+}
+const defaultRulesInvalid = $derived(defaultPermissionedAs.some((r) => !isValidGlob(r.path_glob) || !isValidPermissionedAs(r.permissioned_as)));
+function addDefaultRule() {
+    defaultPermissionedAs = [...defaultPermissionedAs, { path_glob: '**', permissioned_as: '' }];
+}
+function removeDefaultRule(idx) {
+    defaultPermissionedAs = defaultPermissionedAs.filter((_, i) => i !== idx);
+}
+function moveDefaultRule(idx, delta) {
+    const next = [...defaultPermissionedAs];
+    const target = idx + delta;
+    if (target < 0 || target >= next.length)
+        return;
+    [next[idx], next[target]] = [next[target], next[idx]];
+    defaultPermissionedAs = next;
+}
+async function saveDefaultRules() {
+    if (defaultRulesInvalid) {
+        sendUserToast('Some rules have invalid globs or permissioned_as values', true);
+        return;
+    }
+    try {
+        await FolderService.updateFolder({
+            workspace: $workspaceStore ?? '',
+            name,
+            requestBody: { default_permissioned_as: defaultPermissionedAs }
+        });
+        sendUserToast('Default permissioned_as rules updated');
+        dispatch('update');
+        loadFolder();
+    }
+    catch (e) {
+        sendUserToast(e.body ?? String(e), true);
+    }
+}
 function getRole(x) {
     const viewer = x in (folder?.extra_perms ?? {});
     const writer = viewer && (folder?.extra_perms ?? {})[x];
@@ -240,14 +311,13 @@ let reloadHistory = $state(0);
 			{/if}
 			{#if perms}
 				<TableCustom>
-
 					{#snippet headerRow()}
-										<tr >
+						<tr>
 							<th>user/group</th>
 							<th></th>
 							<th></th>
 						</tr>
-									{/snippet}
+					{/snippet}
 					{#snippet body()}
 						<tbody>
 							{#each perms ?? [] as { owner_name, role }}<tr>
@@ -418,6 +488,121 @@ let reloadHistory = $state(0);
 		</div>
 	</Label>
 
+	{#if canEditDefaults}
+		<CollapseLink text="Default permissioned as (advanced, prod only)">
+			<div class="flex flex-col gap-2">
+				<Alert type="info" title="Advanced — for prod workspaces (least privilege)" size="xs">
+					This setting is mostly relevant on <strong>production workspaces</strong> where you want
+					new items under this folder to run under a least-privilege service account rather than the
+					deploying admin's identity. When an admin or <code>wm_deployers</code> member creates a
+					trigger, schedule, app, script, or flow under this folder, the first matching rule
+					determines the default <code>permissioned_as</code>. Globs are relative to the folder root
+					(e.g. <code>jobs/**</code> matches <code>f/{name}/jobs/run_a</code>). Existing items are
+					never rewritten.
+				</Alert>
+
+				{#if defaultPermissionedAs.length > 0}
+					<TableCustom>
+						{#snippet headerRow()}
+							<tr>
+								<th>path_glob <Tooltip>Glob relative to <code>f/{name}/</code></Tooltip></th>
+								<th>permissioned as</th>
+								<th class="w-24"></th>
+							</tr>
+						{/snippet}
+						{#snippet body()}
+							<tbody>
+								{#each defaultPermissionedAs as rule, idx (idx)}
+									{@const kind = ruleKind(rule.permissioned_as)}
+									{@const itemsForKind = kind === 'user' ? usernames : groups}
+									<tr>
+										<td>
+											<TextInput
+												bind:value={rule.path_glob}
+												inputProps={{ placeholder: '**' }}
+												error={!isValidGlob(rule.path_glob)}
+											/>
+										</td>
+										<td>
+											<div class="flex items-center gap-1">
+												<ToggleButtonGroup
+													selected={kind}
+													on:selected={(e) => setRulePermissionedAs(idx, e.detail, '')}
+												>
+													{#snippet children({ item })}
+														<ToggleButton value="user" label="User" {item} size="sm" />
+														<ToggleButton value="group" label="Group" {item} size="sm" />
+													{/snippet}
+												</ToggleButtonGroup>
+												<Select
+													items={safeSelectItems(itemsForKind)}
+													bind:value={
+														() => ruleName(rule.permissioned_as),
+														(v) => setRulePermissionedAs(idx, kind, v ?? '')
+													}
+													class="grow min-w-32"
+												/>
+											</div>
+										</td>
+										<td>
+											<div class="flex items-center gap-1 justify-end">
+												<Button
+													variant="subtle"
+													unifiedSize="sm"
+													startIcon={{ icon: ArrowUp }}
+													iconOnly
+													disabled={idx === 0}
+													on:click={() => moveDefaultRule(idx, -1)}
+												/>
+												<Button
+													variant="subtle"
+													unifiedSize="sm"
+													startIcon={{ icon: ArrowDown }}
+													iconOnly
+													disabled={idx === defaultPermissionedAs.length - 1}
+													on:click={() => moveDefaultRule(idx, 1)}
+												/>
+												<Button
+													variant="subtle"
+													destructive
+													unifiedSize="sm"
+													startIcon={{ icon: Trash }}
+													iconOnly
+													on:click={() => removeDefaultRule(idx)}
+												/>
+											</div>
+										</td>
+									</tr>
+								{/each}
+							</tbody>
+						{/snippet}
+					</TableCustom>
+				{:else}
+					<div class="text-xs text-tertiary">No rules defined.</div>
+				{/if}
+
+				<div class="flex items-center gap-2">
+					<Button
+						variant="default"
+						unifiedSize="sm"
+						startIcon={{ icon: Plus }}
+						on:click={addDefaultRule}
+					>
+						Add rule
+					</Button>
+					<Button
+						variant="accent"
+						unifiedSize="sm"
+						disabled={defaultRulesInvalid}
+						on:click={saveDefaultRules}
+					>
+						Save rules
+					</Button>
+				</div>
+			</div>
+		</CollapseLink>
+	{/if}
+
 	{#if reloadHistory > 0}
 		{#key reloadHistory}
 			<PermissionHistory

package/package/components/ForkWorkspaceBanner.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">import { workspaceStore, userWorkspaces } from '../stores';
-import { WorkspaceService } from '../gen';
+import { WorkspaceService, ScriptService } from '../gen';
 import { Button } from './common';
-import { AlertTriangle, GitFork } from 'lucide-svelte';
+import { AlertTriangle, GitFork, CircleCheck, CircleX, Loader2 } from 'lucide-svelte';
 import { goto } from '$app/navigation';
 import { onMount, untrack } from 'svelte';
 let loading = $state(false);
@@ -61,6 +61,59 @@ function openComparisonDrawer() {
         });
     }
 }
+let ciTestPassing = $state(0);
+let ciTestFailing = $state(0);
+let ciTestRunning = $state(0);
+let ciTestTotal = $state(0);
+async function fetchCiTestSummary() {
+    if (!$workspaceStore || !comparison?.diffs)
+        return;
+    const items = comparison.diffs
+        .filter((d) => d.kind === 'script' || d.kind === 'flow' || d.kind === 'resource')
+        .map((d) => ({ path: d.path, kind: d.kind }));
+    if (items.length === 0)
+        return;
+    try {
+        const batch = await ScriptService.getCiTestResultsBatch({
+            workspace: $workspaceStore,
+            requestBody: { items }
+        });
+        let passing = 0;
+        let failing = 0;
+        let running = 0;
+        let total = 0;
+        for (const results of Object.values(batch)) {
+            for (const r of results) {
+                total++;
+                if (r.status === 'success')
+                    passing++;
+                else if (r.status === 'failure' || r.status === 'canceled')
+                    failing++;
+                else if (r.status === 'running' || (r.job_id && !r.status))
+                    running++;
+            }
+        }
+        ciTestPassing = passing;
+        ciTestFailing = failing;
+        ciTestRunning = running;
+        ciTestTotal = total;
+    }
+    catch (e) {
+        console.error('Failed to fetch CI test summary:', e);
+    }
+}
+$effect(() => {
+    if (comparison && comparison.summary.total_diffs > 0) {
+        fetchCiTestSummary();
+    }
+});
+// Poll while any CI test is still running
+$effect(() => {
+    if (ciTestRunning <= 0)
+        return;
+    const interval = setInterval(fetchCiTestSummary, 3000);
+    return () => clearInterval(interval);
+});
 function forkAheadBehindMessage(changesAhead, changesBehind) {
     let msg = [];
     if (changesAhead > 0 || changesBehind > 0) {
@@ -162,6 +215,26 @@ function forkAheadBehindMessage(changesAhead, changesBehind) {
 									{/if}
 								</div>
 
+								{#if ciTestTotal > 0}
+									-
+									{#if ciTestFailing > 0}
+										<div class="flex items-center gap-1 text-red-600 dark:text-red-400">
+											<CircleX class="w-3 h-3" />
+											<span>CI: {ciTestFailing} failing</span>
+										</div>
+									{:else if ciTestRunning > 0}
+										<div class="flex items-center gap-1 text-yellow-600 dark:text-yellow-400">
+											<Loader2 class="w-3 h-3 animate-spin" />
+											<span>CI: {ciTestRunning} running</span>
+										</div>
+									{:else}
+										<div class="flex items-center gap-1 text-green-600 dark:text-green-400">
+											<CircleCheck class="w-3 h-3" />
+											<span>CI: {ciTestPassing} passing</span>
+										</div>
+									{/if}
+								{/if}
+
 								{#if comparison.summary.conflicts > 0}
 									-
 									<div class="flex items-center gap-1 text-orange-600 dark:text-orange-400">
@@ -186,15 +259,13 @@ function forkAheadBehindMessage(changesAhead, changesBehind) {
 				</div>
 
 				<div class="flex items-center gap-2">
-					{#if comparison && comparison.summary.total_diffs > 0}
-						<Button size="xs" color="blue" on:click={openComparisonDrawer}>
-							{#if comparison.summary.total_ahead > 0}
-								Review & Deploy Changes
-							{:else}
-								Review & Update fork
-							{/if}
-						</Button>
-					{/if}
+					<Button size="xs" color="blue" on:click={openComparisonDrawer}>
+						{#if (comparison?.summary.total_ahead ?? 0) > 0}
+							Review & Deploy Changes
+						{:else}
+							Review & Update fork
+						{/if}
+					</Button>
 				</div>
 			</div>
 		</div>

package/package/components/GlobalUserOffboardingModal.svelte

@@ -0,0 +1,293 @@
+<script lang="ts">import { Alert, Button } from './common';
+import { fade } from 'svelte/transition';
+import { classNames } from '../utils';
+import { AlertTriangle, CornerDownLeft, Loader2 } from 'lucide-svelte';
+import { UserService, FolderService } from '../gen';
+import { sendUserToast } from '../toast';
+import Toggle from './Toggle.svelte';
+import OffboardWorkspaceSection from './OffboardWorkspaceSection.svelte';
+import { countPaths } from './offboarding-utils';
+let { open = $bindable(), email, reassignOnly = false, onClose, onComplete } = $props();
+let workspacePreviews = $state([]);
+let loading = $state(false);
+let submitting = $state(false);
+let doReassign = $state(true);
+let deleteUser = $state(true);
+let conflicts = $state([]);
+$effect(() => {
+    deleteUser = !reassignOnly;
+});
+let wsConfigs = $state({});
+let workspacesWithItems = $derived(workspacePreviews.filter((wp) => countPaths(wp.preview.owned) > 0 || countPaths(wp.preview.executing_on_behalf) > 0));
+$effect(() => {
+    if (open) {
+        loadPreview();
+    }
+});
+async function loadPreview() {
+    loading = true;
+    conflicts = [];
+    try {
+        const result = await UserService.globalOffboardPreview({ email });
+        workspacePreviews = result.workspaces;
+        const configPromises = result.workspaces
+            .filter((wp) => countPaths(wp.preview.owned) > 0 || countPaths(wp.preview.executing_on_behalf) > 0)
+            .map(async (wp) => {
+            const [usernamesList, foldersList] = await Promise.all([
+                UserService.listUsernames({ workspace: wp.workspace_id }),
+                FolderService.listFolders({ workspace: wp.workspace_id })
+            ]);
+            return {
+                workspace_id: wp.workspace_id,
+                config: {
+                    targetKind: 'user',
+                    selectedUser: undefined,
+                    selectedFolder: undefined,
+                    selectedOperator: undefined,
+                    users: usernamesList
+                        .filter((u) => u !== wp.username)
+                        .map((u) => ({ label: u, value: u })),
+                    folders: foldersList.map((f) => ({
+                        label: f.name,
+                        value: f.name
+                    }))
+                }
+            };
+        });
+        const configs = await Promise.all(configPromises);
+        for (const { workspace_id, config } of configs) {
+            wsConfigs[workspace_id] = config;
+        }
+    }
+    catch (e) {
+        sendUserToast('Failed to load offboard preview', true);
+        onClose();
+    }
+    finally {
+        loading = false;
+    }
+}
+function getReassignTo(wId) {
+    const cfg = wsConfigs[wId];
+    if (!cfg)
+        return undefined;
+    return cfg.targetKind === 'user'
+        ? cfg.selectedUser
+            ? `u/${cfg.selectedUser}`
+            : undefined
+        : cfg.selectedFolder
+            ? `f/${cfg.selectedFolder}`
+            : undefined;
+}
+let canSubmit = $derived(!doReassign ||
+    workspacesWithItems.every((wp) => {
+        const target = getReassignTo(wp.workspace_id);
+        const cfg = wsConfigs[wp.workspace_id];
+        if (!target)
+            return false;
+        if (!cfg?.selectedOperator)
+            return false;
+        return true;
+    }));
+async function submit() {
+    submitting = true;
+    conflicts = [];
+    try {
+        const reassignments = {};
+        for (const wp of workspacesWithItems) {
+            const target = getReassignTo(wp.workspace_id);
+            const cfg = wsConfigs[wp.workspace_id];
+            if (target) {
+                reassignments[wp.workspace_id] = {
+                    reassign_to: target,
+                    new_on_behalf_of_user: cfg?.selectedOperator
+                };
+            }
+        }
+        const result = await UserService.offboardGlobalUser({
+            email,
+            requestBody: {
+                reassignments,
+                delete_user: deleteUser
+            }
+        });
+        if (result.conflicts && result.conflicts.length > 0) {
+            conflicts = result.conflicts;
+        }
+        else {
+            sendUserToast(deleteUser
+                ? `User ${email} offboarded successfully`
+                : `Items reassigned from ${email} successfully`);
+            onComplete();
+        }
+    }
+    catch (e) {
+        sendUserToast(`Offboarding failed: ${e}`, true);
+    }
+    finally {
+        submitting = false;
+    }
+}
+function fadeFast(node) {
+    return fade(node, { duration: 100 });
+}
+</script>
+
+{#if open}
+	<div transition:fadeFast|local class="fixed top-0 bottom-0 left-0 right-0 z-[5000]" role="dialog">
+		<div
+			class={classNames(
+				'fixed inset-0 bg-gray-500 bg-opacity-75 transition-opacity',
+				'ease-out duration-300 opacity-100'
+			)}
+		></div>
+
+		<div class="fixed inset-0 z-10 overflow-y-auto">
+			<div class="flex min-h-full items-center justify-center p-4">
+				<div
+					class="relative transform overflow-hidden rounded-lg bg-surface px-4 pt-5 pb-4 text-left shadow-xl transition-all sm:my-8 sm:w-full sm:max-w-2xl sm:p-6 max-h-[80vh] overflow-y-auto"
+				>
+					<div class="flex">
+						<div
+							class="flex h-12 w-12 items-center justify-center rounded-full bg-red-100 dark:bg-red-800/50"
+						>
+							<AlertTriangle class="text-red-500 dark:text-red-400" />
+						</div>
+						<div class="ml-4 text-left flex-1">
+							<h3 class="text-lg font-medium text-primary">
+								{reassignOnly ? 'Reassign user items globally' : 'Offboard user globally'}
+							</h3>
+							<p class="text-sm text-secondary mt-1">
+								{reassignOnly
+									? `Reassign items owned by ${email} across all workspaces`
+									: `Remove ${email} from instance and reassign their items`}
+							</p>
+						</div>
+					</div>
+
+					{#if loading}
+						<div class="flex items-center justify-center py-8">
+							<Loader2 class="animate-spin" size={24} />
+							<span class="ml-2 text-sm text-secondary">Loading preview...</span>
+						</div>
+					{:else}
+						<div class="mt-4 space-y-3">
+							{#if workspacesWithItems.length === 0}
+								<p class="text-sm text-secondary">
+									This user has no owned items in any workspace.
+								</p>
+							{:else}
+								{#if !reassignOnly}
+									<Toggle
+										bind:checked={doReassign}
+										size="xs"
+										options={{ right: 'Reassign items before removing' }}
+									/>
+								{/if}
+
+								{#if doReassign}
+									{#each workspacesWithItems as wp}
+										{@const cfg = wsConfigs[wp.workspace_id]}
+										<div class="border border-border rounded-md p-3 space-y-2">
+											<div class="flex items-center justify-between">
+												<span class="text-sm font-medium text-primary">
+													{wp.workspace_id}
+													<span class="text-secondary font-normal">({wp.username})</span>
+												</span>
+											</div>
+
+											{#if cfg}
+												<OffboardWorkspaceSection
+													preview={wp.preview}
+													username={wp.username}
+													{deleteUser}
+													bind:targetKind={cfg.targetKind}
+													bind:selectedUser={cfg.selectedUser}
+													bind:selectedFolder={cfg.selectedFolder}
+													bind:selectedOperator={cfg.selectedOperator}
+													users={cfg.users}
+													folders={cfg.folders}
+													size="sm"
+													csvFilename="offboard-{email}-{wp.workspace_id}.csv"
+													instanceLevel
+												/>
+											{/if}
+										</div>
+									{/each}
+								{:else}
+									<Alert type="warning" title="Items will not be reassigned">
+										<p class="text-xs">
+											All items across {workspacesWithItems.length} workspace(s) will be left as-is.
+											Triggers and runnables may stop working if the user is removed.
+										</p>
+									</Alert>
+								{/if}
+							{/if}
+
+							{#if deleteUser}
+								<Alert type="warning" title="All tokens will be deleted">
+									<p class="text-xs">
+										All tokens for {email} will be permanently deleted across all workspaces, including
+										non-workspace-scoped tokens. This may break any API calls using these credentials.
+									</p>
+								</Alert>
+							{/if}
+
+							{#if workspacePreviews.length > workspacesWithItems.length}
+								<p class="text-xs text-tertiary">
+									{workspacePreviews.length - workspacesWithItems.length} workspace(s) with no items
+									to reassign
+								</p>
+							{/if}
+
+							{#if conflicts.length > 0}
+								<Alert type="error" title="Path conflicts detected">
+									<p class="text-xs mb-1"
+										>These items already exist at the target. Rename or delete them, or choose a
+										different user/folder.</p
+									>
+									<ul class="text-xs list-disc list-inside max-h-32 overflow-y-auto">
+										{#each conflicts as conflict}
+											<li>{conflict}</li>
+										{/each}
+									</ul>
+								</Alert>
+							{/if}
+						</div>
+					{/if}
+
+					<div class="flex items-center space-x-2 flex-row-reverse space-x-reverse mt-4">
+						{#if workspacesWithItems.length > 0 || deleteUser}
+							<Button
+								disabled={submitting || !canSubmit}
+								onclick={submit}
+								variant="accent"
+								size="sm"
+								destructive
+								shortCut={{ Icon: CornerDownLeft, hide: false, withoutModifier: true }}
+							>
+								{#if submitting}
+									<Loader2 class="animate-spin" />
+								{/if}
+								<span class="min-w-20">
+									{deleteUser ? 'Offboard' : 'Reassign'}
+								</span>
+							</Button>
+						{:else if !loading}
+							<Button onclick={onClose} variant="accent" size="sm">Close</Button>
+						{/if}
+						<Button
+							disabled={submitting}
+							onclick={onClose}
+							variant="default"
+							size="sm"
+							shortCut={{ key: 'Esc', hide: false, withoutModifier: true }}
+						>
+							Cancel
+						</Button>
+					</div>
+				</div>
+			</div>
+		</div>
+	</div>
+{/if}

package/package/components/GlobalUserOffboardingModal.svelte.d.ts

@@ -0,0 +1,10 @@
+type Props = {
+    open: boolean;
+    email: string;
+    reassignOnly?: boolean;
+    onClose: () => void;
+    onComplete: () => void;
+};
+declare const GlobalUserOffboardingModal: import("svelte").Component<Props, {}, "open">;
+type GlobalUserOffboardingModal = ReturnType<typeof GlobalUserOffboardingModal>;
+export default GlobalUserOffboardingModal;