qbit-sql-workbench 1.0.0-RC.2

1.0.0-RC.3 on Maven Central is an accidental republish of this RC.2 code by a tag build; do not use it. The next real candidate is 1.0.0-RC.4.

qbit-sql-workbench 1.0.0-RC.2 is published to Maven Central (com.kingsrook.qbits:qbit-sql-workbench:1.0.0-RC.2) from release/1.0 (CircleCI 16) on 2026-10-12. It requires QQQ 4.1.0-RC.4 or later and a Next UI that renders the SQL_WORKBENCH widget (v1.0.0-RC.13 or later). Owner approval 2026-10-12: "all approved and releases approved". This is a prerelease; 1.0.0 is not final.

The signed annotated tag v1.0.0-RC.2 fixes source 0d8af84 (version bump on the merge of develop into release/1.0, which includes #5). The RC.1 version bump never reached release/1.0 because the CircleCI deploy key is read only, so the merge commit set <revision> to 1.0.0-RC.1 and the bump to RC.2 was pushed by hand.

Notes from the changelog:

The workbench's data becomes standard QQQ tables, secured by QQQ's own mechanisms instead of being hidden (#3). Requires QQQ 4.1.0-RC.4 or later (qqq#1073).

Added

• sqlWorkbenchNotebookShare: share a notebook, read-only, with a user, a group, or everyone (ALL, the shared library). Publishing in the notebook UI now writes an ALL share; a notebook's visibility follows its shares.
• Record security locks on every table, enforced by QQQ's core actions (table UI, /qqq/v1 table API, export, PVS lookups, processes, the workbench endpoints): owners see and change their notebooks and children, share audiences read them, users read their own execution audit, admins (sqlWorkbenchAdmin.hasAccess) hold the all-access key. Security key types sqlWorkbenchUser and sqlWorkbenchAudience; SqlWorkbenchSecurity.applyToSession(qInstance, session, groups) puts the keys in a session.
• Per-table read / insert / edit / delete permissions, listed per role by SqlWorkbenchQBitConfig.getUserPermissionNames(), getSharePermissionNames() and getAdminPermissionNames().
• All six tables are children of the sqlWorkbench app, with record-view sections, child-list widgets (cells, shares, pinned results, versions) and SQL / JSON code-editor adornments.
• Record actions (processes on tables, not in the nav): Share Notebook, Duplicate Notebook, Restore Version.
• Table customizers that keep the notebook invariants for every entry point: ownership from the session, cell validation and ordering, one version per change, share keys and visibility, append-only versions and audit (also for admins), pinned results only from pinning, cascading notebook deletes.
• Record-level QQQ audits for notebooks, cells, pinned results and shares.

Changed

• NotebookService and the history endpoint run as the caller's session through the standard table actions (no system-user bypass); the explicit owner / share checks stay as defense in depth.
• The tables' permission rules are per-table permissions instead of sqlWorkbenchAdmin.hasAccess. Hosts must grant the new lists and call applyToSession.
• Built against QQQ 4.1.0-RC.4.

Upgrade from RC.1

• Run the share-table DDL from docs/ddl/postgres.sql: it creates sql_workbench_notebook_share and backfills an all share for each SHARED notebook (additive, idempotent; owners unchanged).
• Grant the permission lists and call SqlWorkbenchSecurity.applyToSession in the authentication customizer.