Bump version to 1.0.0-RC.5 [skip ci]

Users get sql_workbench_result_snapshot.insert, so pinning results works
under core permission enforcement (#16).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 All notable changes to this project are documented here. The format follows Keep a Changelog; versions follow semantic versioning.
 
-## [1.0.0-RC.3] - Unreleased
+## [1.0.0-RC.4] - Unreleased
 
 ### Added
 - **App home dashboard.** The `sqlWorkbench` app's home is now an information dashboard of real data, read in the viewer's session (permissions and record locks apply): summary tiles and links, runs per day, recent notebooks, recent runs, slowest and failed queries, most-used notebooks, shared notebooks, committed writes, and (workbench admins only) activity by user. Each widget has an honest empty state.
@@ -17,12 +17,19 @@ All notable changes to this project are documented here. The format follows Keep
 - **Names follow the owner rule: lowercase snake_case, prefixed with the qbit's name (metadata only, no DDL).** Tables `sql_workbench_notebook`, `sql_workbench_cell`, `sql_workbench_notebook_version`, `sql_workbench_result_snapshot`, `sql_workbench_notebook_share`, `sql_workbench_execution` (they now equal their backend table names); possible-value source `sql_workbench_share_audience_type`; permissions `sql_workbench.*`, `sql_workbench_admin.hasAccess` and `<table>.read` etc.; security key types `sql_workbench_user` (all-access `sql_workbench_all_access`) and `sql_workbench_audience`; joins `sql_workbench_notebook_join_sql_workbench_*`.
 - `tableNamePrefix` (and the QBit namespace) is normalized to lowercase snake_case and joined with one `_`.
 
+### Fixed
+- **Pinning a result works with QQQ core permission enforcement on.** `getUserPermissionNames()` now includes `sql_workbench_result_snapshot.insert`: pinning is a top-level insert, which core enforcement checks, so hosts no longer need to grant it by hand. Record locks still limit snapshots to the user's own notebooks.
+
 ### Deprecated
 - `LEGACY_TABLE_NAME` on each entity, `ShareAudienceType.LEGACY_NAME` and `SqlWorkbenchQBitConfig.LEGACY_*` hold the pre-RC.3 names, for migrating stored references only.
 
 ### Upgrade from RC.2
 - Follow [UPGRADE.md](UPGRADE.md): grant the renamed permissions and rename stored table names (audit, saved views and reports). No DDL.
 
+## [1.0.0-RC.3] - 2026-10-12
+
+**Do not use.** 1.0.0-RC.3 on Maven Central is an accidental republish of the RC.2 code by a tag build; do not use it. The next real candidate is 1.0.0-RC.4. (Cause: QRun-IO/qqq-orb#20; the `publish_release` workflow now runs on GA tags only.)
+
 ## [1.0.0-RC.2] - Unreleased
 
 The workbench's data becomes standard QQQ tables, secured by QQQ's own mechanisms instead of being hidden ([#3](https://github.com/QRun-IO/qbit-sql-workbench/issues/3)). Requires QQQ `4.1.0-RC.4` or later ([qqq#1073](https://github.com/QRun-IO/qqq/issues/1073)).

README.md

@@ -114,7 +114,7 @@ Everything is denied by default. Two standard QQQ layers apply:
 
 | Role | Grant | What it allows |
 |---|---|---|
-| User | `config.getUserPermissionNames()`: `sql_workbench.hasAccess`, plus read/insert/edit/delete on notebooks and cells, read on versions, shares and the audit, and read/edit/delete on pinned results | The app, widget and endpoints (read-only SQL, EXPLAIN, schema). Their own notebooks, read-only access to notebooks shared with them or in the library, and their own execution history. |
+| User | `config.getUserPermissionNames()`: `sql_workbench.hasAccess`, plus read/insert/edit/delete on notebooks and cells, read on versions, shares and the audit, and read/insert/edit/delete on pinned results | The app, widget and endpoints (read-only SQL, EXPLAIN, schema). Their own notebooks, read-only access to notebooks shared with them or in the library, and their own execution history. |
 | Writer | `config.getWritePermissionName()` (`sql_workbench.write`) | Write mode (preview and commit) and EXPLAIN ANALYZE. |
 | Sharer | `config.getSharePermissionNames()`: `sql_workbench.share`, plus insert/edit/delete on shares | Sharing their own notebooks with users, groups, or everyone (publishing to the library). |
 | Admin | `config.getAdminPermissionNames()`: the user permissions plus `sql_workbench_admin.hasAccess` | The all-access key: every user's notebooks, cells, versions, pinned results (real query data), shares, and the whole execution audit, and editing any notebook. |

pom.xml

@@ -18,7 +18,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
    <properties>
-      <revision>1.0.0-SNAPSHOT</revision>
+      <revision>1.0.0-RC.5</revision>
       <maven.compiler.source>21</maven.compiler.source>
       <maven.compiler.target>21</maven.compiler.target>
             <jacoco.version>0.8.15</jacoco.version>

src/main/java/com/kingsrook/qbits/sqlworkbench/SqlWorkbenchQBitConfig.java

@@ -377,8 +377,8 @@ public class SqlWorkbenchQBitConfig implements QBitConfig
    /*******************************************************************************
     ** Every permission an ordinary workbench user needs: the access
     ** permission, read / insert / edit / delete on notebooks and cells, read
-    ** on versions, shares and the execution audit, and read / edit (label) /
-    ** delete on pinned snapshots. Record locks narrow every one of these to
+    ** on versions, shares and the execution audit, and read / insert (pin) /
+    ** edit (label) / delete on pinned snapshots. Record locks narrow every one of these to
     ** the user's own (or shared-with-them, for reads) rows.
     *******************************************************************************/
    @JsonIgnore
@@ -389,7 +389,7 @@ public class SqlWorkbenchQBitConfig implements QBitConfig
       addTablePermissions(names, SqlWorkbenchNotebook.TABLE_NAME, "read", "insert", "edit", "delete");
       addTablePermissions(names, SqlWorkbenchCell.TABLE_NAME, "read", "insert", "edit", "delete");
       addTablePermissions(names, SqlWorkbenchNotebookVersion.TABLE_NAME, "read");
-      addTablePermissions(names, SqlWorkbenchResultSnapshot.TABLE_NAME, "read", "edit", "delete");
+      addTablePermissions(names, SqlWorkbenchResultSnapshot.TABLE_NAME, "read", "insert", "edit", "delete");
       addTablePermissions(names, SqlWorkbenchNotebookShare.TABLE_NAME, "read");
       addTablePermissions(names, SqlWorkbenchExecution.TABLE_NAME, "read");
       return (names);

src/test/java/com/kingsrook/qbits/sqlworkbench/notebook/NotebookServiceTest.java

@@ -219,6 +219,36 @@ class NotebookServiceTest extends BaseSqlWorkbenchTest
 
 
 
+   /*******************************************************************************
+    ** With QQQ core permission enforcement on, an ordinary user's permission set
+    ** (getUserPermissionNames) is enough for the whole notebook flow, including
+    ** pinning a result (a top-level snapshot insert).
+    *******************************************************************************/
+   @Test
+   void testUserPermissionsSufficeWithCoreEnforcement() throws Exception
+   {
+      qInstance.setEnforcePermissionsInCoreActions(true);
+      try
+      {
+         Integer id = (Integer) service.create(body("Enforced", List.of(cell("c1", "SQL", "SELECT * FROM person"))), as(READER)).get("id");
+         service.update(id, Map.of("title", "Enforced v2"), as(READER));
+
+         SqlExecutionEngine  engine   = new SqlExecutionEngine(qInstance, SqlWorkbenchRuntime.get(qInstance));
+         Map<String, Object> response = engine.execute(ExecutionRequest.readOnly(BACKEND_NAME, "SELECT * FROM person", Map.of()), as(READER));
+
+         Map<String, Object> snapshot = service.createSnapshot(id, Map.of("executionUuid", response.get("executionUuid"), "cellKey", "c1"), as(READER), "SELECT * FROM person");
+         assertThat(snapshot.get("id")).isNotNull();
+         service.deleteSnapshot(id, (Integer) snapshot.get("id"), as(READER));
+         service.delete(id, as(READER));
+      }
+      finally
+      {
+         qInstance.setEnforcePermissionsInCoreActions(null);
+      }
+   }
+
+
+
    /*******************************************************************************
     **
     *******************************************************************************/