improve draft only delete security

backend/.sqlx/query-02424907504848e983bfa89eec343061932dc5b4b17cf13d5cf8d833aedbe6d5.json

@@ -5,7 +5,7 @@
     "columns": [
       {
         "ordinal": 0,
-        "name": "bool",
+        "name": "?column?",
         "type_info": "Bool"
       }
     ],

backend/.sqlx/query-062859f1d0e5cfba3115f4241115753b86a4ad239708851c998ff5620ebca5b8.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE queue SET last_ping = now() WHERE id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "062859f1d0e5cfba3115f4241115753b86a4ad239708851c998ff5620ebca5b8"
-}

backend/.sqlx/query-113b120ae10ea4469ec3575dc3506aaa6d6a8940017a1172403ca9851d0f13a7.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT flow as \"flow!: sqlx::types::Json<Box<RawValue>>\" FROM flow_node WHERE id = $1 LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "flow!: sqlx::types::Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "113b120ae10ea4469ec3575dc3506aaa6d6a8940017a1172403ca9851d0f13a7"
-}

backend/.sqlx/query-15a5db0202c61ed187d9594311cb32cbde4240e143df1c980843dcdfeef3499e.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT lock, code AS \"code!: String\" FROM flow_node WHERE id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "lock",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "code!: String",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": [
-      true,
-      true
-    ]
-  },
-  "hash": "15a5db0202c61ed187d9594311cb32cbde4240e143df1c980843dcdfeef3499e"
-}

backend/.sqlx/query-3d77e5b691dab38b3e39477ed980560bacd55c6ae9fafcbb0239163a3d7f3c0c.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT flow AS \"flow!: Json<Box<JsonRawValue>>\" FROM flow_node WHERE id = $1 LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "flow!: Json<Box<JsonRawValue>>",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "3d77e5b691dab38b3e39477ed980560bacd55c6ae9fafcbb0239163a3d7f3c0c"
-}

backend/.sqlx/query-5ac7c9eb3ce21e46f90e23435562b5f818a4274ba223f905e68280b86b24fa25.json

@@ -1,27 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        WITH existing AS (\n            SELECT id FROM flow_node\n            WHERE hash = $1 AND path = $2 AND workspace_id = $3 AND code = $4 AND lock = $5 AND (flow IS NOT DISTINCT FROM $6)\n            LIMIT 1\n        ),\n        inserted AS (\n            INSERT INTO flow_node (hash, path, workspace_id, code, lock, flow)\n            VALUES ($1, $2, $3, $4, $5, $6)\n            ON CONFLICT DO NOTHING\n            RETURNING id\n        )\n        SELECT id FROM existing\n        UNION ALL\n        SELECT id FROM inserted\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Text",
-        "Text",
-        "Text",
-        "Text",
-        "Jsonb"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "5ac7c9eb3ce21e46f90e23435562b5f818a4274ba223f905e68280b86b24fa25"
-}

backend/.sqlx/query-661f472ff3860983322162420457f5033b9c9afc344d9c3e385ba20a3ad2197a.json

@@ -5,7 +5,7 @@
     "columns": [
       {
         "ordinal": 0,
-        "name": "bool",
+        "name": "?column?",
         "type_info": "Bool"
       }
     ],

backend/.sqlx/query-8653373c2c8301c902e21e8bf5a11480ff040bb987a48b6f66522bc9b7e2c1d8.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT lock, code AS \"code!: String\" FROM flow_node WHERE id = $1 LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "lock",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "code!: String",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": [
-      true,
-      true
-    ]
-  },
-  "hash": "8653373c2c8301c902e21e8bf5a11480ff040bb987a48b6f66522bc9b7e2c1d8"
-}

backend/.sqlx/query-aa98ab0e4b9a0eb41a804ab047a120444af65b1dc43a234821cde5bf6bf8b74f.json

@@ -1,27 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        WITH existing AS (\n            SELECT id FROM flow_node\n            WHERE hash = $1 AND path = $2 AND workspace_id = $3 AND code = $4 AND lock = $5 AND flow = $6\n            LIMIT 1\n        ),\n        inserted AS (\n            INSERT INTO flow_node (hash, path, workspace_id, code, lock, flow)\n            VALUES ($1, $2, $3, $4, $5, $6)\n            ON CONFLICT DO NOTHING\n            RETURNING id\n        )\n        SELECT id FROM existing\n        UNION ALL\n        SELECT id FROM inserted\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Text",
-        "Text",
-        "Text",
-        "Text",
-        "Jsonb"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "aa98ab0e4b9a0eb41a804ab047a120444af65b1dc43a234821cde5bf6bf8b74f"
-}

backend/.sqlx/query-d6615719bf8db4b333ed55c9a3c160ad1962668fc3305d8e80ae91ef73614a80.json

@@ -5,7 +5,7 @@
     "columns": [
       {
         "ordinal": 0,
-        "name": "bool",
+        "name": "?column?",
         "type_info": "Bool"
       }
     ],

backend/windmill-api/src/scripts.rs

@@ -1439,14 +1439,27 @@ async fn delete_script_by_path(
         require_admin(authed.is_admin, &authed.username)?;
     }
 
-    let script = sqlx::query_scalar!(
-        "DELETE FROM script WHERE path = $1 AND workspace_id = $2 RETURNING path",
-        path,
-        w_id
-    )
-    .fetch_one(&db)
-    .await
-    .map_err(|e| Error::InternalErr(format!("deleting script by path {w_id}: {e:#}")))?;
+    let script = if !draft_only {
+        require_admin(authed.is_admin, &authed.username)?;
+        sqlx::query_scalar!(
+            "DELETE FROM script WHERE path = $1 AND workspace_id = $2 RETURNING path",
+            path,
+            w_id
+        )
+        .fetch_one(&db)
+        .await
+        .map_err(|e| Error::InternalErr(format!("deleting script by path {w_id}: {e:#}")))?
+    } else {
+        // If the script is draft only, we can delete it without admin permissions but we still need write permissions
+        sqlx::query_scalar!(
+            "DELETE FROM script WHERE path = $1 AND workspace_id = $2 RETURNING path",
+            path,
+            w_id
+        )
+        .fetch_one(&mut *tx)
+        .await
+        .map_err(|e| Error::InternalErr(format!("deleting script by path {w_id}: {e:#}")))?
+    };
 
     sqlx::query!(
         "DELETE FROM draft WHERE path = $1 AND workspace_id = $2 AND typ = 'script'",

backend/windmill-worker/src/job_logger_ee.rs

@@ -8,7 +8,14 @@ use windmill_common::DB;
 use crate::job_logger::CompactLogs;
 
 #[cfg(all(feature = "enterprise", feature = "parquet"))]
-pub(crate) async fn s3_storage(_job_id: Uuid, _w_id: &String, _db: &sqlx::Pool<sqlx::Postgres>, _logs: &String, _total_size: &Arc<AtomicU32>, _worker_name: &String) {
+pub(crate) async fn s3_storage(
+    _job_id: Uuid,
+    _w_id: &String,
+    _db: &sqlx::Pool<sqlx::Postgres>,
+    _logs: &String,
+    _total_size: &Arc<AtomicU32>,
+    _worker_name: &String,
+) {
     tracing::info!("Logs length of {job_id} has exceeded a threshold. Implementation to store excess on s3 in not OSS");
 }
 
@@ -24,7 +31,9 @@ pub(crate) async fn default_disk_log_storage(
     tracing::info!("Logs length of {job_id} has exceeded a threshold. Implementation to store excess on disk in not OSS");
 }
 
-
-pub(crate) fn process_streaming_log_lines(r: Result<Option<String>, io::Error>, _stderr: bool) -> Option<Result<String, io::Error>> {
+pub(crate) fn process_streaming_log_lines(
+    r: Result<Option<String>, io::Error>,
+    _stderr: bool,
+) -> Option<Result<String, io::Error>> {
     r.transpose()
-}
+}