starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-07 08:02:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: branch on MIN_VERSION to write plaintext token or null

Browse Source 
Check MIN_VERSION_SUPPORTS_TOKEN_HASH at runtime: write plaintext to
token column while old workers exist, switch to NULL once all workers
are >= 1.649.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-03-04 09:28:21 +00:00
co-authored by Claude Opus 4.6
parent e2103d9448
commit 23bc2c4eee
3 changed files with 40 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api-users/src/users.rs
+16 -2
View File
@@ -1746,9 +1746,16 @@ pub async fn create_session_token<'c>(
tx: &mut sqlx::Transaction<'c, sqlx::Postgres>,
cookies: Cookies,
) -> Result<String> {
use windmill_common::min_version::MIN_VERSION_SUPPORTS_TOKEN_HASH;
let token = rd_string(32);
let t_hash = windmill_common::auth::hash_token(&token);
let t_prefix = &token[..TOKEN_PREFIX_LEN];
let plaintext: Option<&str> = if MIN_VERSION_SUPPORTS_TOKEN_HASH.met().await {
None
} else {
Some(&token)
};
if *INVALIDATE_OLD_SESSIONS {
sqlx::query!(
@@ -1782,7 +1789,7 @@ pub async fn create_session_token<'c>(
VALUES ($1, $2, $3, $4, $5, now() + ($6 || ' seconds')::interval, $7)",
t_hash,
t_prefix,
&token,
plaintext as Option<&str>,
email,
"session",
&MAX_SESSION_VALIDITY_SECONDS.to_string(),
@@ -1827,9 +1834,16 @@ async fn impersonate(
authed: ApiAuthed,
Json(new_token): Json<NewToken>,
) -> Result<(StatusCode, String)> {
use windmill_common::min_version::MIN_VERSION_SUPPORTS_TOKEN_HASH;
let token = rd_string(32);
let t_hash = windmill_common::auth::hash_token(&token);
let t_prefix = &token[..TOKEN_PREFIX_LEN];
let plaintext: Option<&str> = if MIN_VERSION_SUPPORTS_TOKEN_HASH.met().await {
None
} else {
Some(&token)
};
require_super_admin(&db, &authed.email).await?;
if new_token.impersonate_email.is_none() {
@@ -1855,7 +1869,7 @@ async fn impersonate(
VALUES ($1, $2, $3, $4, $5, $6, $7)",
t_hash,
t_prefix,
&token,
plaintext as Option<&str>,
impersonated,
new_token.label,
new_token.expiration,