From 0718d4f50a9acfb05ad0fb8cfbfe170abd990586 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 4 Aug 2026 08:16:30 +0000 Subject: [PATCH] docs: record why a stale dispatch address cannot escalate --- backend/windmill-common/src/users.rs | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/backend/windmill-common/src/users.rs b/backend/windmill-common/src/users.rs index 35d662226c..1123896a23 100644 --- a/backend/windmill-common/src/users.rs +++ b/backend/windmill-common/src/users.rs @@ -235,8 +235,14 @@ pub async fn permissioned_as_from_email( /// runnable) is the authority for every run that follows it, so a stale address there is /// permanent and invisible: those use [`get_email_from_permissioned_as_uncached`]. Job dispatch /// also stores its answer, and the worker reads it back to build that run's authed, but it -/// governs one job and dies with it — bounded enough to be worth keeping dispatch off the -/// database, so it stays here. +/// governs one job and dies with it, so it stays here. +/// +/// What makes a stale dispatch address harmless is not that bound, though — it is that nothing is +/// authorized from the address itself. `fetch_authed_from_permissioned_as` re-reads +/// `password.super_admin` and `email_to_igroup` live, keyed on it, and `change_user_email` moves +/// both onto the new address, so a stale one matches nothing and grants nothing: the direction is +/// de-privileging, never escalation. Memoize an `Authed` beside the address, or grant from this +/// string without that live re-read, and dispatch has to move to the uncached variant. /// /// Reads through the non-RLS pool and authorizes nothing — callers must already be authorized /// for `workspace_id`.