feat(frontend): operator visibility setting per workspace (#5124)

* feat(frontend): operator visibility setting per workspace

* section + reactivity

* sqlx prep

* npm check

* more sqlx

* fix table bg dark mode

* improve db query / reactivity

* sqlx prepare

* more merge fixing

* npm check

* npm check

backend/migrations/20250122211942_operator_settings.down.sql

@@ -0,0 +1 @@
+ALTER TABLE workspace_settings DROP COLUMN operator_settings;

backend/migrations/20250122211942_operator_settings.up.sql

@@ -0,0 +1,11 @@
+ALTER TABLE workspace_settings ADD COLUMN operator_settings JSONB DEFAULT '{
+    "runs": true,
+    "groups": true,
+    "folders": true,
+    "workers": true,
+    "triggers": true,
+    "resources": true,
+    "schedules": true,
+    "variables": true,
+    "audit_logs": true
+}';

backend/windmill-api/openapi.yaml

@@ -1618,6 +1618,29 @@ paths:
               schema:
                 $ref: "#/components/schemas/User"
 
+  /w/{workspace}/workspaces/operator_settings:
+    post:
+      operationId: updateOperatorSettings
+      summary: Update operator settings for a workspace
+      description: Updates the operator settings for a specific workspace. Requires workspace admin privileges.
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OperatorSettings"
+      responses:
+        '200':
+          description: Operator settings updated successfully
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /users/exists/{email}:
     get:
       summary: exists email
@@ -1745,6 +1768,8 @@ paths:
                     type: boolean
                   color:
                     type: string
+                  operator_settings:
+                    $ref: "#/components/schemas/OperatorSettings"
                 required:
                   - code_completion_enabled
                   - automatic_billing
@@ -13643,6 +13668,8 @@ components:
                 type: string
               color:
                 type: string
+              operator_settings:
+                $ref: "#/components/schemas/OperatorSettings"
             required:
               - id
               - name
@@ -14501,6 +14528,48 @@ components:
       required:
         - trigger_kind
 
+    OperatorSettings:
+      nullable: true
+      type: object
+      required:
+        - runs
+        - schedules
+        - resources
+        - variables
+        - triggers
+        - audit_logs
+        - groups
+        - folders
+        - workers
+      properties:
+        runs:
+          type: boolean
+          description: Whether operators can view runs
+        schedules:
+          type: boolean
+          description: Whether operators can view schedules
+        resources:
+          type: boolean
+          description: Whether operators can view resources
+        variables:
+          type: boolean
+          description: Whether operators can view variables
+        audit_logs:
+          type: boolean
+          description: Whether operators can view audit logs
+        triggers:
+          type: boolean
+          description: Whether operators can view triggers
+        groups:
+          type: boolean
+          description: Whether operators can view groups page
+        folders:
+          type: boolean
+          description: Whether operators can view folders page
+        workers:
+          type: boolean
+          description: Whether operators can view workers page
+
     TeamInfo:
       type: object
       required:
@@ -14521,7 +14590,7 @@ components:
           description: List of channels within the team
           items:
             $ref: '#/components/schemas/ChannelInfo'
-    
+
     ChannelInfo:
       type: object
       required:

backend/windmill-api/src/workspaces.rs

@@ -121,7 +121,8 @@ pub fn workspaced_service() -> Router {
             "/critical_alerts/acknowledge_all",
             post(acknowledge_all_critical_alerts),
         )
-        .route("/critical_alerts/mute", post(mute_critical_alerts));
+        .route("/critical_alerts/mute", post(mute_critical_alerts))
+        .route("/operator_settings", post(update_operator_settings));
 
     #[cfg(feature = "stripe")]
     {
@@ -188,6 +189,7 @@ pub struct WorkspaceSettings {
     pub default_scripts: Option<serde_json::Value>,
     pub mute_critical_alerts: Option<bool>,
     pub color: Option<String>,
+    pub operator_settings: Option<serde_json::Value>,
 }
 
 #[derive(FromRow, Serialize, Debug)]
@@ -286,6 +288,7 @@ struct UserWorkspace {
     pub name: String,
     pub username: String,
     pub color: Option<String>,
+    pub operator_settings: Option<Option<serde_json::Value>>,
 }
 
 #[derive(Deserialize)]
@@ -1366,7 +1369,8 @@ async fn user_workspaces(
     let mut tx = db.begin().await?;
     let workspaces = sqlx::query_as!(
         UserWorkspace,
-        "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color
+        "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color,
+                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings
          FROM workspace
          JOIN usr ON usr.workspace_id = workspace.id
          JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id
@@ -2135,3 +2139,41 @@ async fn mute_critical_alerts(
 pub async fn mute_critical_alerts() -> Error {
     Error::NotFound("Critical Alerts require EE".to_string())
 }
+
+#[derive(Deserialize, Serialize)]
+struct ChangeOperatorSettings {
+    runs: bool,
+    schedules: bool,
+    resources: bool,
+    variables: bool,
+    triggers: bool,
+    audit_logs: bool,
+    groups: bool,
+    folders: bool,
+    workers: bool,
+}
+
+async fn update_operator_settings(
+    authed: ApiAuthed,
+    Path(w_id): Path<String>,
+    Extension(db): Extension<DB>,
+    Json(settings): Json<ChangeOperatorSettings>,
+) -> Result<String> {
+    require_admin(authed.is_admin, &authed.username)?;
+
+    let mut tx = db.begin().await?;
+
+    let settings_json = serde_json::json!(settings);
+
+    sqlx::query!(
+        "UPDATE workspace_settings SET operator_settings = $1 WHERE workspace_id = $2",
+        settings_json,
+        &w_id
+    )
+    .execute(&mut *tx)
+    .await?;
+
+    tx.commit().await?;
+
+    Ok("Operator settings updated successfully".to_string())
+}