CHANGELOG.md

@@ -17,6 +17,9 @@ All notable changes to this project are documented here. The format follows Keep
 - **Names follow the owner rule: lowercase snake_case, prefixed with the qbit's name (metadata only, no DDL).** Tables `sql_workbench_notebook`, `sql_workbench_cell`, `sql_workbench_notebook_version`, `sql_workbench_result_snapshot`, `sql_workbench_notebook_share`, `sql_workbench_execution` (they now equal their backend table names); possible-value source `sql_workbench_share_audience_type`; permissions `sql_workbench.*`, `sql_workbench_admin.hasAccess` and `<table>.read` etc.; security key types `sql_workbench_user` (all-access `sql_workbench_all_access`) and `sql_workbench_audience`; joins `sql_workbench_notebook_join_sql_workbench_*`.
 - `tableNamePrefix` (and the QBit namespace) is normalized to lowercase snake_case and joined with one `_`.
 
+### Fixed
+- **Pinning a result works with QQQ core permission enforcement on.** `getUserPermissionNames()` now includes `sql_workbench_result_snapshot.insert`: pinning is a top-level insert, which core enforcement checks, so hosts no longer need to grant it by hand. Record locks still limit snapshots to the user's own notebooks.
+
 ### Deprecated
 - `LEGACY_TABLE_NAME` on each entity, `ShareAudienceType.LEGACY_NAME` and `SqlWorkbenchQBitConfig.LEGACY_*` hold the pre-RC.3 names, for migrating stored references only.
 

README.md

@@ -114,7 +114,7 @@ Everything is denied by default. Two standard QQQ layers apply:
 
 | Role | Grant | What it allows |
 |---|---|---|
-| User | `config.getUserPermissionNames()`: `sql_workbench.hasAccess`, plus read/insert/edit/delete on notebooks and cells, read on versions, shares and the audit, and read/edit/delete on pinned results | The app, widget and endpoints (read-only SQL, EXPLAIN, schema). Their own notebooks, read-only access to notebooks shared with them or in the library, and their own execution history. |
+| User | `config.getUserPermissionNames()`: `sql_workbench.hasAccess`, plus read/insert/edit/delete on notebooks and cells, read on versions, shares and the audit, and read/insert/edit/delete on pinned results | The app, widget and endpoints (read-only SQL, EXPLAIN, schema). Their own notebooks, read-only access to notebooks shared with them or in the library, and their own execution history. |
 | Writer | `config.getWritePermissionName()` (`sql_workbench.write`) | Write mode (preview and commit) and EXPLAIN ANALYZE. |
 | Sharer | `config.getSharePermissionNames()`: `sql_workbench.share`, plus insert/edit/delete on shares | Sharing their own notebooks with users, groups, or everyone (publishing to the library). |
 | Admin | `config.getAdminPermissionNames()`: the user permissions plus `sql_workbench_admin.hasAccess` | The all-access key: every user's notebooks, cells, versions, pinned results (real query data), shares, and the whole execution audit, and editing any notebook. |

src/main/java/com/kingsrook/qbits/sqlworkbench/SqlWorkbenchQBitConfig.java

@@ -377,8 +377,8 @@ public class SqlWorkbenchQBitConfig implements QBitConfig
    /*******************************************************************************
     ** Every permission an ordinary workbench user needs: the access
     ** permission, read / insert / edit / delete on notebooks and cells, read
-    ** on versions, shares and the execution audit, and read / edit (label) /
-    ** delete on pinned snapshots. Record locks narrow every one of these to
+    ** on versions, shares and the execution audit, and read / insert (pin) /
+    ** edit (label) / delete on pinned snapshots. Record locks narrow every one of these to
     ** the user's own (or shared-with-them, for reads) rows.
     *******************************************************************************/
    @JsonIgnore
@@ -389,7 +389,7 @@ public class SqlWorkbenchQBitConfig implements QBitConfig
       addTablePermissions(names, SqlWorkbenchNotebook.TABLE_NAME, "read", "insert", "edit", "delete");
       addTablePermissions(names, SqlWorkbenchCell.TABLE_NAME, "read", "insert", "edit", "delete");
       addTablePermissions(names, SqlWorkbenchNotebookVersion.TABLE_NAME, "read");
-      addTablePermissions(names, SqlWorkbenchResultSnapshot.TABLE_NAME, "read", "edit", "delete");
+      addTablePermissions(names, SqlWorkbenchResultSnapshot.TABLE_NAME, "read", "insert", "edit", "delete");
       addTablePermissions(names, SqlWorkbenchNotebookShare.TABLE_NAME, "read");
       addTablePermissions(names, SqlWorkbenchExecution.TABLE_NAME, "read");
       return (names);

src/test/java/com/kingsrook/qbits/sqlworkbench/notebook/NotebookServiceTest.java

@@ -219,6 +219,36 @@ class NotebookServiceTest extends BaseSqlWorkbenchTest
 
 
 
+   /*******************************************************************************
+    ** With QQQ core permission enforcement on, an ordinary user's permission set
+    ** (getUserPermissionNames) is enough for the whole notebook flow, including
+    ** pinning a result (a top-level snapshot insert).
+    *******************************************************************************/
+   @Test
+   void testUserPermissionsSufficeWithCoreEnforcement() throws Exception
+   {
+      qInstance.setEnforcePermissionsInCoreActions(true);
+      try
+      {
+         Integer id = (Integer) service.create(body("Enforced", List.of(cell("c1", "SQL", "SELECT * FROM person"))), as(READER)).get("id");
+         service.update(id, Map.of("title", "Enforced v2"), as(READER));
+
+         SqlExecutionEngine  engine   = new SqlExecutionEngine(qInstance, SqlWorkbenchRuntime.get(qInstance));
+         Map<String, Object> response = engine.execute(ExecutionRequest.readOnly(BACKEND_NAME, "SELECT * FROM person", Map.of()), as(READER));
+
+         Map<String, Object> snapshot = service.createSnapshot(id, Map.of("executionUuid", response.get("executionUuid"), "cellKey", "c1"), as(READER), "SELECT * FROM person");
+         assertThat(snapshot.get("id")).isNotNull();
+         service.deleteSnapshot(id, (Integer) snapshot.get("id"), as(READER));
+         service.delete(id, as(READER));
+      }
+      finally
+      {
+         qInstance.setEnforcePermissionsInCoreActions(null);
+      }
+   }
+
+
+
    /*******************************************************************************
     **
     *******************************************************************************/