From 5ef5f58eeb4aff5356609af1d53e324c62cd96cf Mon Sep 17 00:00:00 2001
From: Diego Imbert <diego@windmill.dev>
Date: Wed, 16 Sep 2026 23:38:06 +0200
Subject: [PATCH] fix(datatables): scope external cluster credential readers to
 the crate

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 backend/ee-repo-ref.txt                             |  2 +-
 backend/windmill-common/src/external_instance_pg.rs | 13 ++++++++++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index fcb881ff0a..b7a94fb45b 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-760219d356e0e396f8c8e94b04a86cdeaa34b06f
+6e61ff49c01f7b6c3788a0e32b46161572bf0d84
diff --git a/backend/windmill-common/src/external_instance_pg.rs b/backend/windmill-common/src/external_instance_pg.rs
index f7362c6cfa..68532733ce 100644
--- a/backend/windmill-common/src/external_instance_pg.rs
+++ b/backend/windmill-common/src/external_instance_pg.rs
@@ -71,15 +71,20 @@ pub enum SetupStepStatus {
 pub struct ExternalInstancePgStatus {
     pub configured: bool,
     pub database_count: usize,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub last_setup: Option<ExternalInstancePgSetupReport>,
 }
 
-pub async fn read_external_instance_pg_config(db: &DB) -> Result<Option<ExternalInstancePg>> {
+/// Authorization: returns the cluster's admin password and checks nothing. Callers MUST be
+/// superadmin or an internal server path.
+pub(crate) async fn read_external_instance_pg_config<'c>(
+    executor: impl sqlx::PgExecutor<'c>,
+) -> Result<Option<ExternalInstancePg>> {
     let value = sqlx::query_scalar!(
         "SELECT value FROM global_settings WHERE name = $1",
         EXTERNAL_INSTANCE_PG_SETTING
     )
-    .fetch_optional(db)
+    .fetch_optional(executor)
     .await?;
     value
         .map(|v| {
@@ -90,7 +95,9 @@ pub async fn read_external_instance_pg_config(db: &DB) -> Result<Option<External
         .transpose()
 }
 
-pub async fn read_external_instance_pg_state<'c>(
+/// Authorization: returns the passwords Windmill generated on the cluster and checks nothing.
+/// Callers MUST be superadmin or an internal server path.
+pub(crate) async fn read_external_instance_pg_state<'c>(
     executor: impl sqlx::PgExecutor<'c>,
 ) -> Result<ExternalInstancePgState> {
     let value = sqlx::query_scalar!(