windmill-components 1.677.1 → 1.695.0

package/package/components/FolderEditor.svelte

@@ -6,7 +6,7 @@ import Skeleton from './common/skeleton/Skeleton.svelte';
 import GroupEditor from './GroupEditor.svelte';
 import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte';
 import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte';
-import { Eye, Plus, Trash } from 'lucide-svelte';
+import { ArrowDown, ArrowUp, Eye, Plus, Trash } from 'lucide-svelte';
 import Label from './Label.svelte';
 import { sendUserToast } from '../toast';
 import { createEventDispatcher, untrack } from 'svelte';
@@ -14,6 +14,9 @@ import Select from './select/Select.svelte';
 import { safeSelectItems } from './select/utils.svelte';
 import TextInput from './text_input/TextInput.svelte';
 import PermissionHistory from './PermissionHistory.svelte';
+import { Minimatch } from 'minimatch';
+import Tooltip from './Tooltip.svelte';
+import CollapseLink from './CollapseLink.svelte';
 let { name } = $props();
 let can_write = $state(false);
 let folder;
@@ -51,6 +54,7 @@ async function loadFolder() {
     try {
         folder = await FolderService.getFolder({ workspace: $workspaceStore, name });
         summary = folder.summary ?? '';
+        defaultPermissionedAs = (folder.default_permissioned_as ?? []).map((r) => ({ ...r }));
         can_write =
             $userStore != undefined &&
                 (folder?.owners.includes('u/' + $userStore.username) ||
@@ -71,6 +75,73 @@ async function loadFolder() {
         folderNotFound = true;
     }
 }
+// --- default_permissioned_as rules editor ---
+let defaultPermissionedAs = $state([]);
+const canEditDefaults = $derived(can_write &&
+    ($userStore?.is_admin ||
+        $userStore?.is_super_admin ||
+        ($userStore?.groups ?? []).includes('wm_deployers')));
+function isValidGlob(glob) {
+    if (!glob)
+        return false;
+    try {
+        new Minimatch(glob);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isValidPermissionedAs(value) {
+    return /^[ug]\/.+/.test(value) || value.includes('@');
+}
+// Split a permissioned_as value like "u/alice" or "g/prod" into its kind and name.
+function ruleKind(value) {
+    return value.startsWith('g/') ? 'group' : 'user';
+}
+function ruleName(value) {
+    if (value.startsWith('u/') || value.startsWith('g/'))
+        return value.slice(2);
+    return value;
+}
+function setRulePermissionedAs(idx, kind, name) {
+    const prefix = kind === 'user' ? 'u/' : 'g/';
+    defaultPermissionedAs[idx].permissioned_as = prefix + name;
+}
+const defaultRulesInvalid = $derived(defaultPermissionedAs.some((r) => !isValidGlob(r.path_glob) || !isValidPermissionedAs(r.permissioned_as)));
+function addDefaultRule() {
+    defaultPermissionedAs = [...defaultPermissionedAs, { path_glob: '**', permissioned_as: '' }];
+}
+function removeDefaultRule(idx) {
+    defaultPermissionedAs = defaultPermissionedAs.filter((_, i) => i !== idx);
+}
+function moveDefaultRule(idx, delta) {
+    const next = [...defaultPermissionedAs];
+    const target = idx + delta;
+    if (target < 0 || target >= next.length)
+        return;
+    [next[idx], next[target]] = [next[target], next[idx]];
+    defaultPermissionedAs = next;
+}
+async function saveDefaultRules() {
+    if (defaultRulesInvalid) {
+        sendUserToast('Some rules have invalid globs or permissioned_as values', true);
+        return;
+    }
+    try {
+        await FolderService.updateFolder({
+            workspace: $workspaceStore ?? '',
+            name,
+            requestBody: { default_permissioned_as: defaultPermissionedAs }
+        });
+        sendUserToast('Default permissioned_as rules updated');
+        dispatch('update');
+        loadFolder();
+    }
+    catch (e) {
+        sendUserToast(e.body ?? String(e), true);
+    }
+}
 function getRole(x) {
     const viewer = x in (folder?.extra_perms ?? {});
     const writer = viewer && (folder?.extra_perms ?? {})[x];
@@ -240,14 +311,13 @@ let reloadHistory = $state(0);
 			{/if}
 			{#if perms}
 				<TableCustom>
-
 					{#snippet headerRow()}
-										<tr >
+						<tr>
 							<th>user/group</th>
 							<th></th>
 							<th></th>
 						</tr>
-									{/snippet}
+					{/snippet}
 					{#snippet body()}
 						<tbody>
 							{#each perms ?? [] as { owner_name, role }}<tr>
@@ -418,6 +488,121 @@ let reloadHistory = $state(0);
 		</div>
 	</Label>
 
+	{#if canEditDefaults}
+		<CollapseLink text="Default permissioned as (advanced, prod only)">
+			<div class="flex flex-col gap-2">
+				<Alert type="info" title="Advanced — for prod workspaces (least privilege)" size="xs">
+					This setting is mostly relevant on <strong>production workspaces</strong> where you want
+					new items under this folder to run under a least-privilege service account rather than the
+					deploying admin's identity. When an admin or <code>wm_deployers</code> member creates a
+					trigger, schedule, app, script, or flow under this folder, the first matching rule
+					determines the default <code>permissioned_as</code>. Globs are relative to the folder root
+					(e.g. <code>jobs/**</code> matches <code>f/{name}/jobs/run_a</code>). Existing items are
+					never rewritten.
+				</Alert>
+
+				{#if defaultPermissionedAs.length > 0}
+					<TableCustom>
+						{#snippet headerRow()}
+							<tr>
+								<th>path_glob <Tooltip>Glob relative to <code>f/{name}/</code></Tooltip></th>
+								<th>permissioned as</th>
+								<th class="w-24"></th>
+							</tr>
+						{/snippet}
+						{#snippet body()}
+							<tbody>
+								{#each defaultPermissionedAs as rule, idx (idx)}
+									{@const kind = ruleKind(rule.permissioned_as)}
+									{@const itemsForKind = kind === 'user' ? usernames : groups}
+									<tr>
+										<td>
+											<TextInput
+												bind:value={rule.path_glob}
+												inputProps={{ placeholder: '**' }}
+												error={!isValidGlob(rule.path_glob)}
+											/>
+										</td>
+										<td>
+											<div class="flex items-center gap-1">
+												<ToggleButtonGroup
+													selected={kind}
+													on:selected={(e) => setRulePermissionedAs(idx, e.detail, '')}
+												>
+													{#snippet children({ item })}
+														<ToggleButton value="user" label="User" {item} size="sm" />
+														<ToggleButton value="group" label="Group" {item} size="sm" />
+													{/snippet}
+												</ToggleButtonGroup>
+												<Select
+													items={safeSelectItems(itemsForKind)}
+													bind:value={
+														() => ruleName(rule.permissioned_as),
+														(v) => setRulePermissionedAs(idx, kind, v ?? '')
+													}
+													class="grow min-w-32"
+												/>
+											</div>
+										</td>
+										<td>
+											<div class="flex items-center gap-1 justify-end">
+												<Button
+													variant="subtle"
+													unifiedSize="sm"
+													startIcon={{ icon: ArrowUp }}
+													iconOnly
+													disabled={idx === 0}
+													on:click={() => moveDefaultRule(idx, -1)}
+												/>
+												<Button
+													variant="subtle"
+													unifiedSize="sm"
+													startIcon={{ icon: ArrowDown }}
+													iconOnly
+													disabled={idx === defaultPermissionedAs.length - 1}
+													on:click={() => moveDefaultRule(idx, 1)}
+												/>
+												<Button
+													variant="subtle"
+													destructive
+													unifiedSize="sm"
+													startIcon={{ icon: Trash }}
+													iconOnly
+													on:click={() => removeDefaultRule(idx)}
+												/>
+											</div>
+										</td>
+									</tr>
+								{/each}
+							</tbody>
+						{/snippet}
+					</TableCustom>
+				{:else}
+					<div class="text-xs text-tertiary">No rules defined.</div>
+				{/if}
+
+				<div class="flex items-center gap-2">
+					<Button
+						variant="default"
+						unifiedSize="sm"
+						startIcon={{ icon: Plus }}
+						on:click={addDefaultRule}
+					>
+						Add rule
+					</Button>
+					<Button
+						variant="accent"
+						unifiedSize="sm"
+						disabled={defaultRulesInvalid}
+						on:click={saveDefaultRules}
+					>
+						Save rules
+					</Button>
+				</div>
+			</div>
+		</CollapseLink>
+	{/if}
+
 	{#if reloadHistory > 0}
 		{#key reloadHistory}
 			<PermissionHistory

package/package/components/ForkConflictModal.svelte

@@ -0,0 +1,57 @@
+<script lang="ts">import ConfirmationModal from './common/confirmationModal/ConfirmationModal.svelte';
+import { forkConflictModal } from '../stores';
+const state = $derived(forkConflictModal.val);
+// Three failure shapes we want to describe accurately:
+// - split-events: shared upstream subscription/queue, two listeners halve each other's traffic
+// - duplicate-firing: independent triggers on shared input, every event fires twice
+// - slot-takeover: PG replication slot is exclusive AND its position is destructively shared
+const SPLIT_KINDS = new Set(['kafka', 'nats', 'mqtt', 'sqs', 'gcp', 'azure']);
+const DUPLICATE_KINDS = new Set(['websocket', 'schedule']);
+const family = $derived(!state
+    ? 'unknown'
+    : state.kind === 'postgres'
+        ? 'slot'
+        : SPLIT_KINDS.has(state.kind)
+            ? 'split'
+            : DUPLICATE_KINDS.has(state.kind)
+                ? 'duplicate'
+                : 'unknown');
+function close(confirmed) {
+    const resolve = state?.resolve;
+    forkConflictModal.val = undefined;
+    resolve?.(confirmed);
+}
+</script>
+
+<ConfirmationModal
+	open={!!state}
+	title="Enable in fork conflicts with parent"
+	confirmationText="Enable anyway"
+	onConfirmed={() => close(true)}
+	onCanceled={() => close(false)}
+>
+	{#if state}
+		<p>
+			The parent workspace (<span class="font-mono">{state.parentWorkspaceId}</span>) has the same
+			{state.kindLabel} configured at this path. Because this fork's row was cloned from it, the upstream
+			identifier is shared.
+		</p>
+		<p class="mt-2">
+			{#if family === 'split'}
+				If both are enabled, the two listeners will compete on the same upstream and each side will
+				receive only a fraction of its events.
+			{:else if family === 'duplicate'}
+				If both are enabled, every event will fire the script twice — once in the fork and once in
+				the parent.
+			{:else if family === 'slot'}
+				The cloned <span class="font-mono">replication_slot_name</span> points at the same Postgres slot,
+				which only allows one consumer at a time. Enabling here will either fail with "slot already active"
+				if the parent is enabled, or hijack the slot's WAL position if it isn't — causing the parent
+				to lose events when re-enabled.
+			{:else}
+				Enabling it here may compete for the same upstream events or duplicate side effects.
+			{/if}
+		</p>
+		<p class="mt-2">Enable in this fork anyway?</p>
+	{/if}
+</ConfirmationModal>

package/package/components/ForkConflictModal.svelte.d.ts

@@ -0,0 +1,3 @@
+declare const ForkConflictModal: import("svelte").Component<Record<string, never>, {}, "">;
+type ForkConflictModal = ReturnType<typeof ForkConflictModal>;
+export default ForkConflictModal;

package/package/components/ForkWorkspaceBanner.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">import { workspaceStore, userWorkspaces } from '../stores';
-import { WorkspaceService } from '../gen';
+import { WorkspaceService, ScriptService } from '../gen';
 import { Button } from './common';
-import { AlertTriangle, GitFork } from 'lucide-svelte';
+import { AlertTriangle, GitFork, CircleCheck, CircleX, Loader2 } from 'lucide-svelte';
 import { goto } from '$app/navigation';
 import { onMount, untrack } from 'svelte';
 let loading = $state(false);
@@ -61,6 +61,59 @@ function openComparisonDrawer() {
         });
     }
 }
+let ciTestPassing = $state(0);
+let ciTestFailing = $state(0);
+let ciTestRunning = $state(0);
+let ciTestTotal = $state(0);
+async function fetchCiTestSummary() {
+    if (!$workspaceStore || !comparison?.diffs)
+        return;
+    const items = comparison.diffs
+        .filter((d) => d.kind === 'script' || d.kind === 'flow' || d.kind === 'resource')
+        .map((d) => ({ path: d.path, kind: d.kind }));
+    if (items.length === 0)
+        return;
+    try {
+        const batch = await ScriptService.getCiTestResultsBatch({
+            workspace: $workspaceStore,
+            requestBody: { items }
+        });
+        let passing = 0;
+        let failing = 0;
+        let running = 0;
+        let total = 0;
+        for (const results of Object.values(batch)) {
+            for (const r of results) {
+                total++;
+                if (r.status === 'success')
+                    passing++;
+                else if (r.status === 'failure' || r.status === 'canceled')
+                    failing++;
+                else if (r.status === 'running' || (r.job_id && !r.status))
+                    running++;
+            }
+        }
+        ciTestPassing = passing;
+        ciTestFailing = failing;
+        ciTestRunning = running;
+        ciTestTotal = total;
+    }
+    catch (e) {
+        console.error('Failed to fetch CI test summary:', e);
+    }
+}
+$effect(() => {
+    if (comparison && comparison.summary.total_diffs > 0) {
+        fetchCiTestSummary();
+    }
+});
+// Poll while any CI test is still running
+$effect(() => {
+    if (ciTestRunning <= 0)
+        return;
+    const interval = setInterval(fetchCiTestSummary, 3000);
+    return () => clearInterval(interval);
+});
 function forkAheadBehindMessage(changesAhead, changesBehind) {
     let msg = [];
     if (changesAhead > 0 || changesBehind > 0) {
@@ -162,6 +215,26 @@ function forkAheadBehindMessage(changesAhead, changesBehind) {
 									{/if}
 								</div>
 
+								{#if ciTestTotal > 0}
+									-
+									{#if ciTestFailing > 0}
+										<div class="flex items-center gap-1 text-red-600 dark:text-red-400">
+											<CircleX class="w-3 h-3" />
+											<span>CI: {ciTestFailing} failing</span>
+										</div>
+									{:else if ciTestRunning > 0}
+										<div class="flex items-center gap-1 text-yellow-600 dark:text-yellow-400">
+											<Loader2 class="w-3 h-3 animate-spin" />
+											<span>CI: {ciTestRunning} running</span>
+										</div>
+									{:else}
+										<div class="flex items-center gap-1 text-green-600 dark:text-green-400">
+											<CircleCheck class="w-3 h-3" />
+											<span>CI: {ciTestPassing} passing</span>
+										</div>
+									{/if}
+								{/if}
+
 								{#if comparison.summary.conflicts > 0}
 									-
 									<div class="flex items-center gap-1 text-orange-600 dark:text-orange-400">
@@ -186,15 +259,13 @@ function forkAheadBehindMessage(changesAhead, changesBehind) {
 				</div>
 
 				<div class="flex items-center gap-2">
-					{#if comparison && comparison.summary.total_diffs > 0}
-						<Button size="xs" color="blue" on:click={openComparisonDrawer}>
-							{#if comparison.summary.total_ahead > 0}
-								Review & Deploy Changes
-							{:else}
-								Review & Update fork
-							{/if}
-						</Button>
-					{/if}
+					<Button size="xs" color="blue" on:click={openComparisonDrawer}>
+						{#if (comparison?.summary.total_ahead ?? 0) > 0}
+							Review & Deploy Changes
+						{:else}
+							Review & Update fork
+						{/if}
+					</Button>
 				</div>
 			</div>
 		</div>