windmill-components 1.677.1 → 1.695.0

package/package/components/GlobalUserOffboardingModal.svelte

@@ -0,0 +1,293 @@
+<script lang="ts">import { Alert, Button } from './common';
+import { fade } from 'svelte/transition';
+import { classNames } from '../utils';
+import { AlertTriangle, CornerDownLeft, Loader2 } from 'lucide-svelte';
+import { UserService, FolderService } from '../gen';
+import { sendUserToast } from '../toast';
+import Toggle from './Toggle.svelte';
+import OffboardWorkspaceSection from './OffboardWorkspaceSection.svelte';
+import { countPaths } from './offboarding-utils';
+let { open = $bindable(), email, reassignOnly = false, onClose, onComplete } = $props();
+let workspacePreviews = $state([]);
+let loading = $state(false);
+let submitting = $state(false);
+let doReassign = $state(true);
+let deleteUser = $state(true);
+let conflicts = $state([]);
+$effect(() => {
+    deleteUser = !reassignOnly;
+});
+let wsConfigs = $state({});
+let workspacesWithItems = $derived(workspacePreviews.filter((wp) => countPaths(wp.preview.owned) > 0 || countPaths(wp.preview.executing_on_behalf) > 0));
+$effect(() => {
+    if (open) {
+        loadPreview();
+    }
+});
+async function loadPreview() {
+    loading = true;
+    conflicts = [];
+    try {
+        const result = await UserService.globalOffboardPreview({ email });
+        workspacePreviews = result.workspaces;
+        const configPromises = result.workspaces
+            .filter((wp) => countPaths(wp.preview.owned) > 0 || countPaths(wp.preview.executing_on_behalf) > 0)
+            .map(async (wp) => {
+            const [usernamesList, foldersList] = await Promise.all([
+                UserService.listUsernames({ workspace: wp.workspace_id }),
+                FolderService.listFolders({ workspace: wp.workspace_id })
+            ]);
+            return {
+                workspace_id: wp.workspace_id,
+                config: {
+                    targetKind: 'user',
+                    selectedUser: undefined,
+                    selectedFolder: undefined,
+                    selectedOperator: undefined,
+                    users: usernamesList
+                        .filter((u) => u !== wp.username)
+                        .map((u) => ({ label: u, value: u })),
+                    folders: foldersList.map((f) => ({
+                        label: f.name,
+                        value: f.name
+                    }))
+                }
+            };
+        });
+        const configs = await Promise.all(configPromises);
+        for (const { workspace_id, config } of configs) {
+            wsConfigs[workspace_id] = config;
+        }
+    }
+    catch (e) {
+        sendUserToast('Failed to load offboard preview', true);
+        onClose();
+    }
+    finally {
+        loading = false;
+    }
+}
+function getReassignTo(wId) {
+    const cfg = wsConfigs[wId];
+    if (!cfg)
+        return undefined;
+    return cfg.targetKind === 'user'
+        ? cfg.selectedUser
+            ? `u/${cfg.selectedUser}`
+            : undefined
+        : cfg.selectedFolder
+            ? `f/${cfg.selectedFolder}`
+            : undefined;
+}
+let canSubmit = $derived(!doReassign ||
+    workspacesWithItems.every((wp) => {
+        const target = getReassignTo(wp.workspace_id);
+        const cfg = wsConfigs[wp.workspace_id];
+        if (!target)
+            return false;
+        if (!cfg?.selectedOperator)
+            return false;
+        return true;
+    }));
+async function submit() {
+    submitting = true;
+    conflicts = [];
+    try {
+        const reassignments = {};
+        for (const wp of workspacesWithItems) {
+            const target = getReassignTo(wp.workspace_id);
+            const cfg = wsConfigs[wp.workspace_id];
+            if (target) {
+                reassignments[wp.workspace_id] = {
+                    reassign_to: target,
+                    new_on_behalf_of_user: cfg?.selectedOperator
+                };
+            }
+        }
+        const result = await UserService.offboardGlobalUser({
+            email,
+            requestBody: {
+                reassignments,
+                delete_user: deleteUser
+            }
+        });
+        if (result.conflicts && result.conflicts.length > 0) {
+            conflicts = result.conflicts;
+        }
+        else {
+            sendUserToast(deleteUser
+                ? `User ${email} offboarded successfully`
+                : `Items reassigned from ${email} successfully`);
+            onComplete();
+        }
+    }
+    catch (e) {
+        sendUserToast(`Offboarding failed: ${e}`, true);
+    }
+    finally {
+        submitting = false;
+    }
+}
+function fadeFast(node) {
+    return fade(node, { duration: 100 });
+}
+</script>
+
+{#if open}
+	<div transition:fadeFast|local class="fixed top-0 bottom-0 left-0 right-0 z-[5000]" role="dialog">
+		<div
+			class={classNames(
+				'fixed inset-0 bg-gray-500 bg-opacity-75 transition-opacity',
+				'ease-out duration-300 opacity-100'
+			)}
+		></div>
+
+		<div class="fixed inset-0 z-10 overflow-y-auto">
+			<div class="flex min-h-full items-center justify-center p-4">
+				<div
+					class="relative transform overflow-hidden rounded-lg bg-surface px-4 pt-5 pb-4 text-left shadow-xl transition-all sm:my-8 sm:w-full sm:max-w-2xl sm:p-6 max-h-[80vh] overflow-y-auto"
+				>
+					<div class="flex">
+						<div
+							class="flex h-12 w-12 items-center justify-center rounded-full bg-red-100 dark:bg-red-800/50"
+						>
+							<AlertTriangle class="text-red-500 dark:text-red-400" />
+						</div>
+						<div class="ml-4 text-left flex-1">
+							<h3 class="text-lg font-medium text-primary">
+								{reassignOnly ? 'Reassign user items globally' : 'Offboard user globally'}
+							</h3>
+							<p class="text-sm text-secondary mt-1">
+								{reassignOnly
+									? `Reassign items owned by ${email} across all workspaces`
+									: `Remove ${email} from instance and reassign their items`}
+							</p>
+						</div>
+					</div>
+
+					{#if loading}
+						<div class="flex items-center justify-center py-8">
+							<Loader2 class="animate-spin" size={24} />
+							<span class="ml-2 text-sm text-secondary">Loading preview...</span>
+						</div>
+					{:else}
+						<div class="mt-4 space-y-3">
+							{#if workspacesWithItems.length === 0}
+								<p class="text-sm text-secondary">
+									This user has no owned items in any workspace.
+								</p>
+							{:else}
+								{#if !reassignOnly}
+									<Toggle
+										bind:checked={doReassign}
+										size="xs"
+										options={{ right: 'Reassign items before removing' }}
+									/>
+								{/if}
+
+								{#if doReassign}
+									{#each workspacesWithItems as wp}
+										{@const cfg = wsConfigs[wp.workspace_id]}
+										<div class="border border-border rounded-md p-3 space-y-2">
+											<div class="flex items-center justify-between">
+												<span class="text-sm font-medium text-primary">
+													{wp.workspace_id}
+													<span class="text-secondary font-normal">({wp.username})</span>
+												</span>
+											</div>
+
+											{#if cfg}
+												<OffboardWorkspaceSection
+													preview={wp.preview}
+													username={wp.username}
+													{deleteUser}
+													bind:targetKind={cfg.targetKind}
+													bind:selectedUser={cfg.selectedUser}
+													bind:selectedFolder={cfg.selectedFolder}
+													bind:selectedOperator={cfg.selectedOperator}
+													users={cfg.users}
+													folders={cfg.folders}
+													size="sm"
+													csvFilename="offboard-{email}-{wp.workspace_id}.csv"
+													instanceLevel
+												/>
+											{/if}
+										</div>
+									{/each}
+								{:else}
+									<Alert type="warning" title="Items will not be reassigned">
+										<p class="text-xs">
+											All items across {workspacesWithItems.length} workspace(s) will be left as-is.
+											Triggers and runnables may stop working if the user is removed.
+										</p>
+									</Alert>
+								{/if}
+							{/if}
+
+							{#if deleteUser}
+								<Alert type="warning" title="All tokens will be deleted">
+									<p class="text-xs">
+										All tokens for {email} will be permanently deleted across all workspaces, including
+										non-workspace-scoped tokens. This may break any API calls using these credentials.
+									</p>
+								</Alert>
+							{/if}
+
+							{#if workspacePreviews.length > workspacesWithItems.length}
+								<p class="text-xs text-tertiary">
+									{workspacePreviews.length - workspacesWithItems.length} workspace(s) with no items
+									to reassign
+								</p>
+							{/if}
+
+							{#if conflicts.length > 0}
+								<Alert type="error" title="Path conflicts detected">
+									<p class="text-xs mb-1"
+										>These items already exist at the target. Rename or delete them, or choose a
+										different user/folder.</p
+									>
+									<ul class="text-xs list-disc list-inside max-h-32 overflow-y-auto">
+										{#each conflicts as conflict}
+											<li>{conflict}</li>
+										{/each}
+									</ul>
+								</Alert>
+							{/if}
+						</div>
+					{/if}
+
+					<div class="flex items-center space-x-2 flex-row-reverse space-x-reverse mt-4">
+						{#if workspacesWithItems.length > 0 || deleteUser}
+							<Button
+								disabled={submitting || !canSubmit}
+								onclick={submit}
+								variant="accent"
+								size="sm"
+								destructive
+								shortCut={{ Icon: CornerDownLeft, hide: false, withoutModifier: true }}
+							>
+								{#if submitting}
+									<Loader2 class="animate-spin" />
+								{/if}
+								<span class="min-w-20">
+									{deleteUser ? 'Offboard' : 'Reassign'}
+								</span>
+							</Button>
+						{:else if !loading}
+							<Button onclick={onClose} variant="accent" size="sm">Close</Button>
+						{/if}
+						<Button
+							disabled={submitting}
+							onclick={onClose}
+							variant="default"
+							size="sm"
+							shortCut={{ key: 'Esc', hide: false, withoutModifier: true }}
+						>
+							Cancel
+						</Button>
+					</div>
+				</div>
+			</div>
+		</div>
+	</div>
+{/if}

package/package/components/GlobalUserOffboardingModal.svelte.d.ts

@@ -0,0 +1,10 @@
+type Props = {
+    open: boolean;
+    email: string;
+    reassignOnly?: boolean;
+    onClose: () => void;
+    onComplete: () => void;
+};
+declare const GlobalUserOffboardingModal: import("svelte").Component<Props, {}, "open">;
+type GlobalUserOffboardingModal = ReturnType<typeof GlobalUserOffboardingModal>;
+export default GlobalUserOffboardingModal;

package/package/components/InputTransformSchemaForm.svelte

@@ -38,7 +38,7 @@ let s3StorageConfigured = $state(true);
 async function checkS3Storage() {
     try {
         if ($workspaceStore) {
-            const settings = await WorkspaceService.getSettings({ workspace: $workspaceStore });
+            const settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore });
             s3StorageConfigured = settings.large_file_storage?.s3_resource_path !== undefined;
         }
     }

package/package/components/InstanceSettings.svelte

@@ -132,12 +132,13 @@ export async function saveSettings() {
         return false;
     });
     let shouldReloadPage = false;
+    let willRestart = false;
     if ($values) {
         // Trim license key before saving
         if ($values['license_key'] && typeof $values['license_key'] === 'string') {
             $values['license_key'] = $values['license_key'].trim();
         }
-        // Check which settings require a page reload
+        // Check which settings require a page reload or server restart
         const allSettings = [...Object.values(settings), scimSamlSetting].flat();
         let licenseKeySet = false;
         for (const s of allSettings) {
@@ -148,10 +149,40 @@ export async function saveSettings() {
                 if (s.requiresReloadOnChange) {
                     shouldReloadPage = true;
                 }
+                if (s.triggersRestart) {
+                    willRestart = true;
+                }
             }
         }
         // Build the full global_settings object for the bulk PUT
         const globalSettings = { ...$values };
+        // Send explicit null for keys that were set on load but are now
+        // missing/cleared, so the Merge-mode bulk endpoint deletes them
+        // instead of silently preserving the old DB value. Covers both:
+        //   - YAML mode: user removed a line / set it to null / set it to {}.
+        //   - Form mode: user toggled a setting off (e.g.
+        //     object_store_cache_config), making the value undefined.
+        const isClearedValue = (v) => {
+            if (v === undefined || v === null)
+                return true;
+            if (typeof v === 'object') {
+                return Array.isArray(v) ? v.length === 0 : Object.keys(v).length === 0;
+            }
+            return false;
+        };
+        for (const key of Object.keys(initialValues ?? {})) {
+            if (excludedKeys.has(key))
+                continue;
+            if (key === 'oauths' || key === 'require_preexisting_user_for_oauth')
+                continue;
+            if (!isClearedValue(globalSettings[key]))
+                continue;
+            // Only flag for deletion if it was non-empty before — otherwise
+            // every save would delete-then-recreate harmless `{}`/`[]` defaults.
+            if (isClearedValue(initialValues[key]))
+                continue;
+            globalSettings[key] = null;
+        }
         // Include oauths and require_preexisting_user_for_oauth
         if (!deepEqual(initialOauths, oauths)) {
             globalSettings['oauths'] = oauths;
@@ -181,6 +212,10 @@ export async function saveSettings() {
         await sleep(1000);
         window.location.reload();
     }
+    else if (willRestart) {
+        sendUserToast('Settings updated. Servers are restarting and changes may take up to a minute to fully propagate.', false, [], undefined, 8000);
+        dispatch('saved');
+    }
     else {
         sendUserToast('Settings updated');
         dispatch('saved');
@@ -265,7 +300,7 @@ function stripEmpty(obj) {
 }
 function getSettingsForCategory(category) {
     if (category === 'Auth/OAuth/SAML') {
-        return scimSamlSetting;
+        return [...(settings[category] ?? []), ...scimSamlSetting];
     }
     const base = settings[category] ?? [];
     // In quick setup, reorder Core: base settings (without license_key), then extras from Jobs
@@ -375,27 +410,20 @@ export function isDirty(category) {
     return dirtyCategories[category] ?? false;
 }
 export function discardCategory(category) {
+    const categorySettings = getSettingsForCategory(category);
+    for (const s of categorySettings) {
+        const v = initialValues[s.key];
+        $values[s.key] = v !== undefined ? JSON.parse(JSON.stringify(v)) : undefined;
+    }
     if (category === 'Auth/OAuth/SAML') {
-        for (const s of scimSamlSetting) {
-            const v = initialValues[s.key];
-            $values[s.key] = v !== undefined ? JSON.parse(JSON.stringify(v)) : undefined;
-        }
         oauths = JSON.parse(JSON.stringify(initialOauths));
         requirePreexistingUserForOauth = initialRequirePreexistingUserForOauth;
         const account_identifier = initialOauths?.snowflake_oauth?.connect_config?.extra_params?.account_identifier;
         snowflakeAccountIdentifier = account_identifier ?? '';
     }
-    else {
-        const categorySettings = getSettingsForCategory(category);
-        for (const s of categorySettings) {
-            const v = initialValues[s.key];
-            $values[s.key] = v !== undefined ? JSON.parse(JSON.stringify(v)) : undefined;
-        }
-        if (category === 'Registries') {
-            const v = initialValues['workspace_registries'];
-            $values['workspace_registries'] =
-                v !== undefined ? JSON.parse(JSON.stringify(v)) : undefined;
-        }
+    else if (category === 'Registries') {
+        const v = initialValues['workspace_registries'];
+        $values['workspace_registries'] = v !== undefined ? JSON.parse(JSON.stringify(v)) : undefined;
     }
 }
 export function discardAll() {
@@ -437,6 +465,7 @@ export async function saveCategorySettings(category) {
         $values['license_key'] = $values['license_key'].trim();
     }
     let shouldReloadPage = false;
+    let willRestart = false;
     const categorySettings = getSettingsForCategory(category);
     let licenseKeySet = false;
     await Promise.all(categorySettings
@@ -452,6 +481,8 @@ export async function saveCategorySettings(category) {
             licenseKeySet = true;
         if (x.requiresReloadOnChange)
             shouldReloadPage = true;
+        if (x.triggersRestart)
+            willRestart = true;
         let value = $values?.[x.key];
         if (x.fieldType === 'codearea' && typeof value === 'string' && value.trim() === '') {
             value = undefined;
@@ -505,6 +536,10 @@ export async function saveCategorySettings(category) {
         await sleep(1000);
         window.location.reload();
     }
+    else if (willRestart) {
+        sendUserToast('Settings updated. Servers are restarting and changes may take up to a minute to fully propagate.', false, [], undefined, 8000);
+        dispatch('saved');
+    }
     else {
         sendUserToast('Settings updated');
         dispatch('saved');
@@ -525,8 +560,12 @@ const sensitiveKeys = new Set([
     'jwt_secret',
     'workspace_registries'
 ]);
-// Settings that should never appear in YAML export/import
-const excludedKeys = new Set([]);
+// Settings that should never appear in YAML export/import.
+// `worker_configs` is a legacy ghost key: worker configs live in the `config`
+// table (managed from /workers), not in `global_settings`. Older DBs may
+// still carry a stale `global_settings.worker_configs` row; filter it here
+// so it never round-trips through this editor.
+const excludedKeys = new Set(['worker_configs']);
 // Nested fields inside object-valued settings that contain secrets.
 // Each entry maps a top-level key to its sensitive sub-field names.
 const nestedSensitiveFields = {