From 316d3cbae6c80c1538c76b21cd01b2c6ea983c87 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Wed, 12 Aug 2026 19:28:55 +0200
Subject: [PATCH] fix: keep job argument assets when the script source is
 unreadable

A job can be visible to someone with no read grant on its script. The assets
viewer awaited the script fetch before parsing the job arguments, so a denial
rejected the whole promise and the tab reported no assets at all, dropping the
argument-derived ones that need no script access.

Also drop the `authed` query parameter from the dereferenced OpenAPI copies,
which are served at /openapi.yaml and /openapi.json and still advertised a
parameter the handler no longer accepts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 backend/windmill-api/openapi-deref.json                   | 7 -------
 backend/windmill-api/openapi-deref.yaml                   | 4 ----
 frontend/src/lib/components/assets/JobAssetsViewer.svelte | 7 +++++--
 3 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/backend/windmill-api/openapi-deref.json b/backend/windmill-api/openapi-deref.json
index fd40b6fa5e..904c8a3265 100644
--- a/backend/windmill-api/openapi-deref.json
+++ b/backend/windmill-api/openapi-deref.json
@@ -13765,13 +13765,6 @@
             "schema": {
               "type": "boolean"
             }
-          },
-          {
-            "name": "authed",
-            "in": "query",
-            "schema": {
-              "type": "boolean"
-            }
           }
         ],
         "responses": {
diff --git a/backend/windmill-api/openapi-deref.yaml b/backend/windmill-api/openapi-deref.yaml
index 7efc30a509..7ae2c87d05 100644
--- a/backend/windmill-api/openapi-deref.yaml
+++ b/backend/windmill-api/openapi-deref.yaml
@@ -14328,10 +14328,6 @@ paths:
           in: query
           schema:
             type: boolean
-        - name: authed
-          in: query
-          schema:
-            type: boolean
       responses:
         '200':
           description: script details
diff --git a/frontend/src/lib/components/assets/JobAssetsViewer.svelte b/frontend/src/lib/components/assets/JobAssetsViewer.svelte
index 10e2f011f9..5ed25ed848 100644
--- a/frontend/src/lib/components/assets/JobAssetsViewer.svelte
+++ b/frontend/src/lib/components/assets/JobAssetsViewer.svelte
@@ -37,11 +37,14 @@
 		if (job.job_kind === 'script') {
 			let code = job.raw_code
 			if (!code && job.script_hash && $workspaceStore) {
+				// A job can be visible to someone with no read permission on its script.
+				// Only the source-derived assets are then unavailable, so the argument-derived
+				// ones below must still be parsed rather than lost with the whole promise.
 				const script = await ScriptService.getScriptByHash({
 					workspace: $workspaceStore,
 					hash: job.script_hash
-				})
-				code = script.content
+				}).catch(() => undefined)
+				code = script?.content
 			}
 			let inferAssetsResult = await inferAssets(job.language!, code ?? '')
 			let assets = inferAssetsResult.status === 'ok' ? inferAssetsResult.assets : []