fix: set WM_END_USER_EMAIL on direct script and flow runs (#11636)

* fix: set WM_END_USER_EMAIL on direct script and flow runs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: pass the end user to workflow-as-code tasks

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: describe when WM_END_USER_EMAIL is set

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test: pin the end user a job token passes on

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
hugocasa
2026-10-09 15:41:52 +02:00
committed by GitHub
co-authored by Claude Opus 5.5
parent 2ea846f563
commit 2bdeceba7f
5 changed files with 145 additions and 83 deletions
+10 -5
View File
@@ -7826,6 +7826,7 @@ pub async fn run_workflow_as_code(
)
};
let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
let (uuid, mut tx) = push(
&db,
@@ -7854,7 +7855,7 @@ pub async fn run_workflow_as_code(
None,
push_authed.as_ref(),
false,
None,
end_user_email,
None,
None,
scope_ceiling.as_deref(),
@@ -8141,6 +8142,7 @@ pub async fn run_wait_result_job_by_path_get(
)
};
let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
let (uuid, tx) = push(
&db,
@@ -8169,7 +8171,7 @@ pub async fn run_wait_result_job_by_path_get(
None,
push_authed.as_ref(),
false,
None,
end_user_email,
authed.trigger_or_fallback(None),
run_query.suspended_mode,
scope_ceiling.as_deref(),
@@ -8291,6 +8293,7 @@ pub async fn run_wait_result_script_by_path_internal(
)
};
let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
let (uuid, tx) = push(
&db,
@@ -8319,7 +8322,7 @@ pub async fn run_wait_result_script_by_path_internal(
None,
push_authed.as_ref(),
false,
None,
end_user_email,
authed.trigger_or_fallback(None),
run_query.suspended_mode,
scope_ceiling.as_deref(),
@@ -8409,6 +8412,7 @@ pub async fn run_wait_result_script_by_hash(
)
};
let end_user_email = run_end_user_email(&db, &w_id, &authed, None).await?;
let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
let (uuid, tx) = push(
&db,
@@ -8451,7 +8455,7 @@ pub async fn run_wait_result_script_by_hash(
None,
push_authed.as_ref(),
false,
None,
end_user_email,
authed.trigger_or_fallback(None),
run_query.suspended_mode,
scope_ceiling.as_deref(),
@@ -10556,6 +10560,7 @@ pub async fn run_job_by_hash_inner(
};
let job_payload = with_run_retry(&run_query, job_payload, &push_args, &tag)?;
let end_user_email = run_end_user_email(&db, &w_id, &authed, trigger.as_ref()).await?;
let scope_ceiling = windmill_api_auth::caller_scope_ceiling(&db, &authed).await?;
let (uuid, tx) = push(
&db,
@@ -10584,7 +10589,7 @@ pub async fn run_job_by_hash_inner(
None,
push_authed.as_ref(),
false,
None,
end_user_email,
authed.trigger_or_fallback(trigger),
run_query.suspended_mode,
scope_ceiling.as_deref(),