fix(permissions): grant result_snapshot.insert to users (pinning under core enforcement) #16

2026-10-12T21:12:36Z

KofTwentyTwo commented

2026-10-12 21:12:36 +00:00

(Migrated from github.com)

What

Pinning a result inserts a sql_workbench_result_snapshot row as a top-level action. With QQQ core permission enforcement on (QInstance.enforcePermissionsInCoreActions, QRun-IO/qqq#1075), that insert is checked against the session's permissions. getUserPermissionNames() granted only read/edit/delete on snapshots, so every user's pin was denied.

kof22.com hit this when it turned enforcement on (KofTwentyTwo/Website-Backend#107) and had to grant the insert by hand. This PR adds insert to the user set, so hosts don't need to.

Record locks are unchanged: a user can still only pin results to their own notebooks. Notebook versions and the execution audit need no grant, because their inserts run nested inside another action (trusted) or as the system user.

Changes

SqlWorkbenchQBitConfig.getUserPermissionNames(): adds sql_workbench_result_snapshot.insert.
New test NotebookServiceTest.testUserPermissionsSufficeWithCoreEnforcement. With enforcement on and only the user permission set, it creates, updates, runs, pins, unpins and deletes. The test was red before the fix (QPermissionDeniedException on the pin).
CHANGELOG (RC.3 section, Fixed) and the README permissions table.

Test plan

./mvnw verify passes.

🤖 Generated with Claude Code

## What Pinning a result inserts a `sql_workbench_result_snapshot` row as a top-level action. With QQQ core permission enforcement on (`QInstance.enforcePermissionsInCoreActions`, QRun-IO/qqq#1075), that insert is checked against the session's permissions. `getUserPermissionNames()` granted only `read`/`edit`/`delete` on snapshots, so **every user's pin was denied**. kof22.com hit this when it turned enforcement on (KofTwentyTwo/Website-Backend#107) and had to grant the insert by hand. This PR adds `insert` to the user set, so hosts don't need to. Record locks are unchanged: a user can still only pin results to their own notebooks. Notebook versions and the execution audit need no grant, because their inserts run nested inside another action (trusted) or as the system user. ## Changes - `SqlWorkbenchQBitConfig.getUserPermissionNames()`: adds `sql_workbench_result_snapshot.insert`. - New test `NotebookServiceTest.testUserPermissionsSufficeWithCoreEnforcement`. With enforcement on and only the user permission set, it creates, updates, runs, pins, unpins and deletes. The test was red before the fix (`QPermissionDeniedException` on the pin). - CHANGELOG (RC.3 section, Fixed) and the README permissions table. ## Test plan - [x] `./mvnw verify` passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-sql-workbench#16