starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-07 00:01:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: guests stop at the launched-by-me job grant; canonical app paths at the mint and discovery; the toggle ends on the stored value

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BayTppRCstWX6qTf3LMco5
This commit is contained in:
Ruben Fiszel
2026-09-04 09:07:39 +02:00
co-authored by Claude Fable 5.1
parent fbcb0728f7
commit 2b4631cedc
7 changed files with 82 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api/src/jobs.rs
+5 -1
View File
@@ -1594,7 +1594,11 @@ pub(crate) async fn require_job_read_access(
// this token, and letting it reach any job merely visible to the viewer would
// expose unrelated runs' results/logs. Stop at the launched-by-viewer grant.
// NotFound (not PermissionDenied) so the untrusted app can't probe job existence.
if windmill_api_auth::scopes::has_app_embed_sentinel(authed.scopes.as_deref()) {
// A guest stops here too: it has no membership behind it, so a share token whose
// audience is the workspace's members must not read for it either.
if windmill_api_auth::scopes::has_app_embed_sentinel(authed.scopes.as_deref())
|| windmill_api_auth::scopes::has_guest_sentinel(authed.scopes.as_deref())
{
return Err(Error::NotFound(format!("Job {job_id} not found")));
}