starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-25 16:02:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert to restrict_to_user_paths

Browse Source
This commit is contained in:
Diego Imbert
2025-08-21 17:05:19 +02:00
parent 44e93245a5
commit 2c9a68c77d
4 changed files with 27 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api/openapi.yaml
+2 -2
View File
@@ -17506,7 +17506,7 @@ components:
type: string
public_resource:
type: boolean
allow_user_paths:
restrict_to_user_paths:
type: boolean
secondary_storage:
type: object
@@ -17531,7 +17531,7 @@ components:
type: string
public_resource:
type: boolean
allow_user_paths:
restrict_to_user_paths:
type: boolean
DucklakeSettings:
backend/windmill-common/src/s3_helpers.rs
+15 -15
View File
@@ -237,13 +237,13 @@ impl LargeFileStorage {
LargeFileStorage::GoogleCloudStorage(gcs_lfs) => &gcs_lfs.gcs_resource_path,
}
}
pub fn allow_user_paths(&self) -> bool {
pub fn restrict_to_user_paths(&self) -> bool {
match self {
LargeFileStorage::S3Storage(lfs) => lfs.allow_user_paths,
LargeFileStorage::S3AwsOidc(lfs) => lfs.allow_user_paths,
LargeFileStorage::AzureBlobStorage(lfs) => lfs.allow_user_paths,
LargeFileStorage::AzureWorkloadIdentity(lfs) => lfs.allow_user_paths,
LargeFileStorage::GoogleCloudStorage(glfs) => glfs.allow_user_paths,
LargeFileStorage::S3Storage(lfs) => lfs.restrict_to_user_paths,
LargeFileStorage::S3AwsOidc(lfs) => lfs.restrict_to_user_paths,
LargeFileStorage::AzureBlobStorage(lfs) => lfs.restrict_to_user_paths,
LargeFileStorage::AzureWorkloadIdentity(lfs) => lfs.restrict_to_user_paths,
LargeFileStorage::GoogleCloudStorage(glfs) => glfs.restrict_to_user_paths,
}
.unwrap_or(false)
}
@@ -265,7 +265,7 @@ pub struct S3Storage {
#[serde(skip_serializing_if = "Option::is_none")]
pub public_resource: Option<bool>,
#[serde(skip_serializing_if = "Option::is_none")]
pub allow_user_paths: Option<bool>,
pub restrict_to_user_paths: Option<bool>,
}
#[derive(Serialize, Deserialize, Debug)]
@@ -274,7 +274,7 @@ pub struct AzureBlobStorage {
#[serde(skip_serializing_if = "Option::is_none")]
pub public_resource: Option<bool>,
#[serde(skip_serializing_if = "Option::is_none")]
pub allow_user_paths: Option<bool>,
pub restrict_to_user_paths: Option<bool>,
}
#[derive(Serialize, Deserialize, Debug)]
@@ -283,7 +283,7 @@ pub struct GoogleCloudStorage {
#[serde(skip_serializing_if = "Option::is_none")]
pub public_resource: Option<bool>,
#[serde(skip_serializing_if = "Option::is_none")]
pub allow_user_paths: Option<bool>,
pub restrict_to_user_paths: Option<bool>,
}
#[derive(Clone, Debug)]
@@ -1136,12 +1136,12 @@ pub fn check_lfs_object_path_permissions(
}
let username = authed.username.as_str();
if lfs.allow_user_paths() {
if object_path.starts_with(&format!("u/{username}/")) {
return Ok(());
if lfs.restrict_to_user_paths() {
if !object_path.starts_with(&format!("u/{username}/")) {
return Err(error::Error::NotAuthorized(format!(
"Can only access paths u/{username}/**"
)));
}
}
return Err(error::Error::NotAuthorized(format!(
"Cannot access path {object_path}"
)));
return Ok(());
}
frontend/src/lib/components/workspaceSettings/StorageSettings.svelte
+2 -2
View File
@@ -222,9 +222,9 @@
<svelte:fragment slot="content">
<div class="flex flex-col gap-3 mx-4 py-4 w-[40rem]">
<Toggle
bind:checked={storage.allowUserPaths}
bind:checked={storage.restrictToUserPaths}
options={{
right: 'Allow access to u/username/** paths',
right: 'Restrict access to u/username/** paths',
rightTooltip:
'If set, all users will be able to read and write objects with path u/username/**'
}}
frontend/src/lib/workspace_settings.ts
+8 -8
View File
@@ -8,7 +8,7 @@ type s3ResourceSettingsItem = {
resourceType: s3type
resourcePath: string | undefined
publicResource: boolean | undefined
allowUserPaths?: boolean
restrictToUserPaths?: boolean
}
export type S3ResourceSettings = s3ResourceSettingsItem & {
secondaryStorage: [string, s3ResourceSettingsItem][] | undefined
@@ -33,42 +33,42 @@ export function convertBackendSettingsToFrontendSettingsItem(
resourceType: 's3',
resourcePath: large_file_storage?.s3_resource_path?.replace('$res:', ''),
publicResource: large_file_storage?.public_resource,
allowUserPaths: large_file_storage?.allow_user_paths
restrictToUserPaths: large_file_storage?.restrict_to_user_paths
}
} else if (large_file_storage?.type === 'AzureBlobStorage') {
return {
resourceType: 'azure_blob',
resourcePath: large_file_storage?.azure_blob_resource_path?.replace('$res:', ''),
publicResource: large_file_storage?.public_resource,
allowUserPaths: large_file_storage?.allow_user_paths
restrictToUserPaths: large_file_storage?.restrict_to_user_paths
}
} else if (large_file_storage?.type === 'AzureWorkloadIdentity') {
return {
resourceType: 'azure_workload_identity',
resourcePath: large_file_storage?.azure_blob_resource_path?.replace('$res:', ''),
publicResource: large_file_storage?.public_resource,
allowUserPaths: large_file_storage?.allow_user_paths
restrictToUserPaths: large_file_storage?.restrict_to_user_paths
}
} else if (large_file_storage?.type === 'S3AwsOidc') {
return {
resourceType: 's3_aws_oidc',
resourcePath: large_file_storage?.s3_resource_path?.replace('$res:', ''),
publicResource: large_file_storage?.public_resource,
allowUserPaths: large_file_storage?.allow_user_paths
restrictToUserPaths: large_file_storage?.restrict_to_user_paths
}
} else if (large_file_storage?.type === 'GoogleCloudStorage') {
return {
resourceType: 'gcloud_storage',
resourcePath: large_file_storage?.gcs_resource_path?.replace('$res:', ''),
publicResource: large_file_storage?.public_resource,
allowUserPaths: large_file_storage?.allow_user_paths
restrictToUserPaths: large_file_storage?.restrict_to_user_paths
}
} else {
return {
resourceType: 's3',
resourcePath: undefined,
publicResource: undefined,
allowUserPaths: undefined
restrictToUserPaths: undefined
}
}
}
@@ -93,7 +93,7 @@ export function convertFrontendToBackendettingsItem(
let resourcePathWithPrefix = `$res:${s3ResourceSettings.resourcePath}`
let params = {
public_resource: s3ResourceSettings.publicResource,
allow_user_paths: s3ResourceSettings.allowUserPaths
restrict_to_user_paths: s3ResourceSettings.restrictToUserPaths
}
if (s3ResourceSettings.resourceType === 'azure_blob') {
let typ: LargeFileStorage['type'] = 'AzureBlobStorage'