feat: add folder and group permission history tracking

backend/migrations/20251030104400_folder_group_permission_history.down.sql

@@ -0,0 +1,6 @@
+-- Add down migration script here
+DROP INDEX IF EXISTS idx_group_perm_history_workspace_group;
+DROP TABLE IF EXISTS group_permission_history;
+
+DROP INDEX IF EXISTS idx_folder_perm_history_workspace_folder;
+DROP TABLE IF EXISTS folder_permission_history;

backend/migrations/20251030104400_folder_group_permission_history.up.sql

@@ -0,0 +1,31 @@
+-- Add up migration script here
+
+-- Folder permission changes history
+CREATE TABLE IF NOT EXISTS folder_permission_history (
+    id BIGSERIAL PRIMARY KEY,
+    workspace_id VARCHAR(50) NOT NULL,
+    folder_name VARCHAR(255) NOT NULL,
+    changed_by VARCHAR(50) NOT NULL,
+    changed_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+    change_type VARCHAR(50) NOT NULL,
+    owner_affected VARCHAR(100),
+    FOREIGN KEY (workspace_id, folder_name) REFERENCES folder(workspace_id, name) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_folder_perm_history_workspace_folder
+    ON folder_permission_history(workspace_id, folder_name, changed_at DESC);
+
+-- Group permission changes history
+CREATE TABLE IF NOT EXISTS group_permission_history (
+    id BIGSERIAL PRIMARY KEY,
+    workspace_id VARCHAR(50) NOT NULL,
+    group_name VARCHAR(255) NOT NULL,
+    changed_by VARCHAR(50) NOT NULL,
+    changed_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+    change_type VARCHAR(50) NOT NULL,
+    member_affected VARCHAR(100),
+    FOREIGN KEY (workspace_id, group_name) REFERENCES group_(workspace_id, name) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_group_perm_history_workspace_group
+    ON group_permission_history(workspace_id, group_name, changed_at DESC);

backend/windmill-api/openapi.yaml

@@ -11995,6 +11995,40 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/groups_history/get/{name}:
+    get:
+      summary: get group permission history
+      operationId: getGroupPermissionHistory
+      tags:
+        - group
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Name"
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PerPage"
+      responses:
+        "200":
+          description: group permission history
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  properties:
+                    id:
+                      type: integer
+                    changed_by:
+                      type: string
+                    changed_at:
+                      type: string
+                      format: date-time
+                    change_type:
+                      type: string
+                    member_affected:
+                      type: string
+                      nullable: true
+
   /w/{workspace}/folders/list:
     get:
       summary: list folders
@@ -12258,6 +12292,40 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/folders_history/get/{name}:
+    get:
+      summary: get folder permission history
+      operationId: getFolderPermissionHistory
+      tags:
+        - folder
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Name"
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PerPage"
+      responses:
+        "200":
+          description: folder permission history
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  properties:
+                    id:
+                      type: integer
+                    changed_by:
+                      type: string
+                    changed_at:
+                      type: string
+                      format: date-time
+                    change_type:
+                      type: string
+                    owner_affected:
+                      type: string
+                      nullable: true
+
   /workers/list:
     get:
       summary: list workers

backend/windmill-api/src/folder_history.rs

@@ -0,0 +1,68 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+use crate::db::ApiAuthed;
+use axum::{
+    extract::{Extension, Path, Query},
+    routing::get,
+    Router,
+};
+use windmill_common::{
+    db::UserDB,
+    error::JsonResult,
+    utils::{paginate, Pagination},
+};
+
+use serde::Serialize;
+use sqlx::FromRow;
+
+pub fn workspaced_service() -> Router {
+    Router::new().route("/get/:name", get(get_folder_permission_history))
+}
+
+#[derive(Serialize, FromRow)]
+pub struct FolderPermissionChange {
+    pub id: i64,
+    pub changed_by: String,
+    pub changed_at: chrono::DateTime<chrono::Utc>,
+    pub change_type: String,
+    pub owner_affected: Option<String>,
+}
+
+async fn get_folder_permission_history(
+    authed: ApiAuthed,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, name)): Path<(String, String)>,
+    Query(pagination): Query<Pagination>,
+) -> JsonResult<Vec<FolderPermissionChange>> {
+    let mut tx = user_db.begin(&authed).await?;
+
+    // Check if user is owner of the folder
+    crate::folders::require_is_owner(&authed, &name)?;
+
+    let (per_page, offset) = paginate(pagination);
+
+    let history = sqlx::query_as!(
+        FolderPermissionChange,
+        "SELECT id, changed_by, changed_at, change_type, owner_affected
+         FROM folder_permission_history
+         WHERE workspace_id = $1 AND folder_name = $2
+         ORDER BY changed_at DESC
+         LIMIT $3 OFFSET $4",
+        w_id,
+        name,
+        per_page as i64,
+        offset as i64
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+
+    tx.commit().await?;
+
+    Ok(axum::Json(history))
+}