starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-21 08:02:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: improve agent policies

Browse Source
This commit is contained in:
Ruben Fiszel
2024-02-07 22:45:07 +01:00
parent 31fb948c35
commit 23bef7f31f
3 changed files with 47 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/migrations/20240207211936_accept_missing_config_in_policies_2.down.sql
+1
View File
@@ -0,0 +1 @@
-- Add down migration script here
backend/migrations/20240207211936_accept_missing_config_in_policies_2.up.sql
+44
View File
@@ -0,0 +1,44 @@
-- Add up migration script here
DROP POLICY see_own_path ON queue;
DROP POLICY see_member_path ON queue;
DROP POLICY see_own ON queue;
DROP POLICY see_member ON queue;
DROP POLICY see_folder_extra_perms_user ON queue;
DROP POLICY see_own_path ON completed_job;
DROP POLICY see_member_path ON completed_job;
DROP POLICY see_own ON completed_job;
DROP POLICY see_member ON completed_job;
DROP POLICY see_folder_extra_perms_user ON completed_job;
CREATE POLICY see_own_path ON queue FOR ALL
USING (queue.visible_to_owner IS true AND SPLIT_PART(queue.script_path, '/', 1) = 'u' AND SPLIT_PART(queue.script_path, '/', 2) = current_setting('session.user', true));
CREATE POLICY see_member_path ON queue FOR ALL
USING (queue.visible_to_owner IS true AND SPLIT_PART(queue.script_path, '/', 1) = 'g' AND SPLIT_PART(queue.script_path, '/', 2) = any(regexp_split_to_array(current_setting('session.groups', true), ',')::text[]));
CREATE POLICY see_own ON queue FOR ALL
USING (SPLIT_PART(queue.permissioned_as, '/', 1) = 'u' AND SPLIT_PART(queue.permissioned_as, '/', 2) = current_setting('session.user', true));
CREATE POLICY see_member ON queue FOR ALL
USING (SPLIT_PART(queue.permissioned_as, '/', 1) = 'g' AND SPLIT_PART(queue.permissioned_as, '/', 2) = any(regexp_split_to_array(current_setting('session.groups', true), ',')::text[]));
CREATE POLICY see_folder_extra_perms_user ON queue FOR ALL
USING (((visible_to_owner IS TRUE) AND (split_part((script_path)::text, '/'::text, 1) = 'f'::text) AND (split_part((script_path)::text, '/'::text, 2) = ANY (regexp_split_to_array(current_setting('session.folders_read'::text, true), ','::text)))));
CREATE POLICY see_own_path ON completed_job FOR ALL
USING (completed_job.visible_to_owner IS true AND SPLIT_PART(completed_job.script_path, '/', 1) = 'u' AND SPLIT_PART(completed_job.script_path, '/', 2) = current_setting('session.user', true));
CREATE POLICY see_member_path ON completed_job FOR ALL
USING (completed_job.visible_to_owner IS true AND SPLIT_PART(completed_job.script_path, '/', 1) = 'g' AND SPLIT_PART(completed_job.script_path, '/', 2) = any(regexp_split_to_array(current_setting('session.groups', true), ',')::text[]));
CREATE POLICY see_own ON completed_job FOR ALL
USING (SPLIT_PART(completed_job.permissioned_as, '/', 1) = 'u' AND SPLIT_PART(completed_job.permissioned_as, '/', 2) = current_setting('session.user', true));
CREATE POLICY see_member ON completed_job FOR ALL
USING (SPLIT_PART(completed_job.permissioned_as, '/', 1) = 'g' AND SPLIT_PART(completed_job.permissioned_as, '/', 2) = any(regexp_split_to_array(current_setting('session.groups', true), ',')::text[]));
CREATE POLICY see_folder_extra_perms_user ON completed_job FOR ALL
USING (((visible_to_owner IS TRUE) AND (split_part((script_path)::text, '/'::text, 1) = 'f'::text) AND (split_part((script_path)::text, '/'::text, 2) = ANY (regexp_split_to_array(current_setting('session.folders_read'::text, true), ','::text)))));
backend/windmill-api/src/scripts.rs
+2
View File
@@ -610,6 +610,8 @@ async fn create_script(
if needs_lock_gen {
let tag = if ns.dedicated_worker.is_some_and(|x| x) {
Some(format!("{}:{}", &w_id, &ns.path,))
} else if ns.tag.as_ref().is_some_and(|x| x.contains("$args[")) {
None
} else {
ns.tag
};