enforce on_behalf_of by the backend, not frontend

backend/windmill-api/src/apps.rs

@@ -313,10 +313,13 @@ async fn create_app(
     Extension(user_db): Extension<UserDB>,
     Extension(webhook): Extension<WebhookShared>,
     Path(w_id): Path<String>,
-    Json(app): Json<CreateApp>,
+    Json(mut app): Json<CreateApp>,
 ) -> Result<(StatusCode, String)> {
     let mut tx = user_db.begin(&authed).await?;
 
+    app.policy.on_behalf_of = Some(username_to_permissioned_as(&authed.username));
+    app.policy.on_behalf_of_email = Some(authed.email);
+
     let id = sqlx::query_scalar!(
         "INSERT INTO app
             (workspace_id, path, summary, policy, versions)
@@ -463,7 +466,9 @@ async fn update_app(
             sqlb.set_str("summary", nsummary);
         }
 
-        if let Some(npolicy) = ns.policy {
+        if let Some(mut npolicy) = ns.policy {
+            npolicy.on_behalf_of = Some(username_to_permissioned_as(&authed.username));
+            npolicy.on_behalf_of_email = Some(authed.email);
             sqlb.set(
                 "policy",
                 &format!(

frontend/src/lib/components/apps/editor/AppEditorHeader.svelte

@@ -168,13 +168,6 @@
 				)
 		)
 		policy.triggerables = Object.fromEntries(allTriggers.filter((x) => x.length > 0))
-
-		if (!$userStore?.username?.includes('@')) {
-			policy.on_behalf_of = `u/${$userStore?.username}`
-		} else {
-			policy.on_behalf_of = $userStore?.email
-		}
-		policy.on_behalf_of_email = $userStore?.email
 	}
 	async function createApp(path: string) {
 		await computeTriggerables()

frontend/src/routes/(root)/(logged)/apps/add/+page.svelte

@@ -36,7 +36,9 @@
 	loadApp()
 
 	let policy: Policy = {
-		on_behalf_of: `u/${$userStore?.username}`,
+		on_behalf_of: $userStore?.username.includes('@')
+			? $userStore?.username
+			: `u/${$userStore?.username}`,
 		on_behalf_of_email: $userStore?.email,
 		execution_mode: Policy.execution_mode.PUBLISHER
 	}