feat(workflow): match search and listings against the copy on show - #7857
Closed
yangzhang75 wants to merge 4 commits into
Closed
feat(workflow): match search and listings against the copy on show#7857yangzhang75 wants to merge 4 commits into
yangzhang75 wants to merge 4 commits into
Conversation
A public workflow follows the author's latest content today: every save reaches the Hub immediately. Pinning a version as the public copy needs somewhere to keep that copy, which is what these columns are. `is_public` stays the on/off switch. `published_content` is the pin: NULL means the workflow follows the author's latest, which is what every workflow does today, so the migration changes nothing anyone can see. `published_name` and `published_description` travel with it because a pin has to hold everything on show, and `workflow_version` stores no metadata at all -- only content deltas. `published_version_id` names the version row holding that copy, so the revision panel can mark it and the author can restore it. The copy is materialized rather than replayed from `workflow_version` because those rows are reverse JSON-Patch deltas: serving a pinned workflow would mean folding every newer patch back from the author's current content on each public read, and a computed value is something the fulltext index cannot cover. A CHECK constraint makes "private but pinned" unrepresentable, and a PGroonga index mirrors the latest-content one so public search can match the frozen copy. Adding columns changes the arity of the generated positional constructor, so the three copy-producing paths (clone, duplicate, restore-a-version) now build their POJO with setters -- which is also what stops a later column from silently shifting a null into the wrong field. Part of apache#7828.
A public workflow follows the author's latest content, as publishing has
always done. This adds the other state: the author pins the version they
have now, and the public copy stops moving until they pin again.
`is_public` stays the on/off switch; `published_content` is the pin, NULL
while following. `WorkflowPublishService` owns the two states, and three
endpoints expose them: POST and DELETE `/workflow/pin/{wid}` to pin and
unpin, GET `/workflow/publish-status/{wid}` for what the author is shown.
Publishing and unpublishing move through the same service, so unpublishing
drops the pin rather than leaving a private workflow carrying one.
Two paths are narrowed so a pin can hold. A save wrote the whole row back,
so a publish landing while a save was in flight was silently rolled back,
and a request body could set the publish columns itself; saves now write
only name, description and content. Creating a workflow clears the publish
columns for the same reason.
Nothing reads the pinned copy yet: every workflow is in the following
state it is in today, and nothing on screen changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
With a version pinned, a workflow has two copies: the author's working copy and the frozen one on public show. This routes every read that serves a viewer without granted access through the frozen copy, and freezes the name and description with the graph. `WorkflowPublishService.publicCopyOf` returns the three fields as a group, so a surface cannot pick up the published graph under a title the author has not published; `WorkflowAccessResource.hasGrantedAccess` is the seam that decides which copy a caller gets. Granted access -- owner, shared, project member -- keeps tracking the author's latest, because sharing is not publishing. Name and description freeze because they are as public as the graph: if only the graph froze, a report about a title could be answered by editing the title while the pinned copy still advertised it. Routed through it: opening a workflow, the hub's read, Clone, Duplicate, `/workflow_name`, `/workflow_description` and the size a listing shows. A workflow that follows the author's latest -- every workflow today -- is served exactly what it is served now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Search and the listings it feeds were reading the author's live columns, which for a pinned workflow is the one copy the public cannot open. A draft would turn up in a public search under a title nobody has seen, and the card would advertise a name the detail page does not show. Each filter is now applied to whichever copy the caller may see: `onVisibleCopy` builds the same filter twice -- over the live columns for rows the caller was granted access to, over the frozen ones for rows they reach only because the workflow is public -- and ORs the two. A disjunction over bare columns rather than a CASE, so each side stays eligible for its own fulltext index. Unpinned public rows fall back to the live columns, so a following workflow searches exactly as it does now. Listings carry two more things from the same query: the frozen name and description to show a viewer without granted access, and whether the copy on show is behind the author's working copy. `constructWhereClause` takes `includePublic` for this; the other builders accept and ignore it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
Automated Reviewer SuggestionsBased on the
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #7857 +/- ##
============================================
+ Coverage 91.87% 91.89% +0.02%
- Complexity 4510 4516 +6
============================================
Files 1173 1174 +1
Lines 47350 47501 +151
Branches 5306 5334 +28
============================================
+ Hits 43502 43652 +150
+ Misses 2204 2195 -9
- Partials 1644 1654 +10
*This pull request uses carry forward flags. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
|
| config | throughput | MB/s | latency | max Δ latest / 7d | |
|---|---|---|---|---|---|
| 🔴 | bs=10 sw=10 sl=64 | 419 | 0.256 | 23,252/31,412/31,412 us | 🔴 +158.7% / 🔴 +118.4% |
| 🔴 | bs=100 sw=10 sl=64 | 946 | 0.577 | 105,361/130,178/130,178 us | 🔴 +73.3% / 🔴 +30.8% |
| 🔴 | bs=1000 sw=10 sl=64 | 1,103 | 0.673 | 907,832/943,462/943,462 us | 🔴 +32.3% / ⚪ within ±5% |
Baseline details
Latest main b7c33b0 from 2026-08-22T12:41:18.215Z
| config | metric | PR | latest main | 7d avg | Δ latest | Δ 7d |
|---|---|---|---|---|---|---|
| bs=10 sw=10 sl=64 | throughput | 419 tuples/sec | 1,070 tuples/sec | 833.79 tuples/sec | -60.8% | -49.7% |
| bs=10 sw=10 sl=64 | MB/s | 0.256 MB/s | 0.653 MB/s | 0.509 MB/s | -60.8% | -49.7% |
| bs=10 sw=10 sl=64 | p50 | 23,252 us | 8,990 us | 11,864 us | +158.7% | +96.0% |
| bs=10 sw=10 sl=64 | p95 | 31,412 us | 12,633 us | 14,381 us | +148.7% | +118.4% |
| bs=10 sw=10 sl=64 | p99 | 31,412 us | 13,861 us | 18,035 us | +126.6% | +74.2% |
| bs=100 sw=10 sl=64 | throughput | 946 tuples/sec | 1,420 tuples/sec | 1,083 tuples/sec | -33.4% | -12.7% |
| bs=100 sw=10 sl=64 | MB/s | 0.577 MB/s | 0.867 MB/s | 0.661 MB/s | -33.4% | -12.7% |
| bs=100 sw=10 sl=64 | p50 | 105,361 us | 69,686 us | 93,077 us | +51.2% | +13.2% |
| bs=100 sw=10 sl=64 | p95 | 130,178 us | 75,137 us | 99,553 us | +73.3% | +30.8% |
| bs=100 sw=10 sl=64 | p99 | 130,178 us | 89,601 us | 108,604 us | +45.3% | +19.9% |
| bs=1000 sw=10 sl=64 | throughput | 1,103 tuples/sec | 1,455 tuples/sec | 1,119 tuples/sec | -24.2% | -1.4% |
| bs=1000 sw=10 sl=64 | MB/s | 0.673 MB/s | 0.888 MB/s | 0.683 MB/s | -24.2% | -1.4% |
| bs=1000 sw=10 sl=64 | p50 | 907,832 us | 685,976 us | 909,247 us | +32.3% | -0.2% |
| bs=1000 sw=10 sl=64 | p95 | 943,462 us | 727,444 us | 952,561 us | +29.7% | -1.0% |
| bs=1000 sw=10 sl=64 | p99 | 943,462 us | 767,738 us | 985,186 us | +22.9% | -4.2% |
Raw CSV
config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,477.11,200,128000,419,0.256,23251.91,31411.91,31411.91
1,100,10,64,20,2115.17,2000,1280000,946,0.577,105361.45,130178.13,130178.13
2,1000,10,64,20,18133.80,20000,12800000,1103,0.673,907832.22,943461.62,943461.62
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #7828. Stacked on #7856 — the review here is the last commit,
feat(workflow): match search and listings against the copy on show.Search and the listings it feeds read the author's live columns. For a pinned workflow that is the one copy the public cannot open: a draft would turn up in a public search under a title nobody has seen, and the card would advertise a name the detail page does not show.
One filter, applied to the copy the caller may see
onVisibleCopybuilds each filter twice — over the live columns for rows the caller was granted access to, over the frozen ones for rows they reach only because the workflow is public — and ORs the two. A disjunction over bare columns rather than aCASE, so each side stays eligible for its own fulltext index. Unpinned public rows fall back to the live columns, so a following workflow searches exactly as it does today.This covers both halves of what public search indexes: the words in a workflow, and the operators in it.
Two more things listings carry
From the same query, no second round trip:
The hub's own listing query gets the same treatment. It is the public shelf, so everything on it is listed as the public sees it — the author included, who is looking at the shelf and not at their own dashboard.
constructWhereClausetakesincludePublicfor this; the dataset and project builders accept and ignore it.Tests
+27 backend cases. Search: a draft is unfindable by a keyword or an operator that exists only in it, while the author still finds their own; a pinned workflow matches its frozen title and not its live one, and an unpinned one matches its live title. Listings: the frozen values shown to a stranger and the live ones to the author and to a collaborator; drift reported only for a workflow that actually has a frozen copy. Plus the record-mapping cases, including that an unknown access answer counts as public — the reverse is the leak.