From 344721677bcf446b32931f1ec5d144b6047acffd Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Wed, 28 Oct 2026 19:26:00 +0100 Subject: [PATCH] docs: note that variable/resource perm errors show extra_perms on purpose (#12079) * fix: drop extra_perms from variable and resource access-denied errors Co-Authored-By: Claude Opus 5.5 * test: pin that denied variable/resource reads omit extra_perms Co-Authored-By: Claude Opus 5.5 * docs: note that perm errors show extra_perms on purpose Co-Authored-By: Claude Opus 5.5 --------- Co-authored-by: Claude Opus 5.5 --- backend/windmill-store/src/resources.rs | 3 +++ backend/windmill-store/src/variables.rs | 3 +++ 2 files changed, 6 insertions(+) diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs index 541369f327..3c4b032b93 100644 --- a/backend/windmill-store/src/resources.rs +++ b/backend/windmill-store/src/resources.rs @@ -695,6 +695,9 @@ async fn get_resource_value( Ok(Json(value)) } +/// Including the resource's and its folder's `extra_perms` in the error is intended, not a +/// leak: who holds access to an item is not secret within a workspace, and it tells the +/// denied caller whom to ask. Keep the maps in the message. pub async fn explain_resource_perm_error( path: &str, w_id: &str, diff --git a/backend/windmill-store/src/variables.rs b/backend/windmill-store/src/variables.rs index e9aa3ab60d..3a5fccae3b 100644 --- a/backend/windmill-store/src/variables.rs +++ b/backend/windmill-store/src/variables.rs @@ -486,6 +486,9 @@ fn describe_authed(authed: Option<&(impl Authable + Sync)>) -> String { } } +/// Including the variable's and its folder's `extra_perms` in the error is intended, not a +/// leak: who holds access to an item is not secret within a workspace, and it tells the +/// denied caller whom to ask. Keep the maps in the message. async fn explain_variable_perm_error( path: &str, w_id: &str,