fix: let Teams handlers post with job tokens again (#11792)

* fix: let job tokens post Teams messages to their own workspace's team

* chore: point ee-repo-ref at the Teams job-token check

* chore: update ee-repo-ref to 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4

This commit updates the EE repository reference after PR #885 was merged in windmill-ee-private.

Previous ee-repo-ref: e8e4bcd63d6fc804d29e67d42ca6d4163b144a33

New ee-repo-ref: 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4

Automated by sync-ee-ref workflow.

---------

Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>

backend/.sqlx/query-8c56f79cb3f940b29a35f31a48f23ea068d451cf4bfd0c3c9b2f957df82173d1.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ws.teams_team_id FROM v2_job j\n         JOIN workspace_settings ws ON ws.workspace_id = j.workspace_id\n         WHERE j.id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "teams_team_id",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "8c56f79cb3f940b29a35f31a48f23ea068d451cf4bfd0c3c9b2f957df82173d1"
+}

backend/ee-repo-ref.txt

@@ -1 +1 @@
-0253ffdd6c0b0f1ba162a43d19aed56bc7bd7a71
+3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4

backend/tests/wm_token_confinement.rs

@@ -381,6 +381,22 @@ async fn test_wm_token_is_confined_to_its_workspace(db: Pool<Postgres>) -> anyho
         "WM_TOKEN must still record its own tutorial progress: {}",
         resp.text().await?
     );
+    //    Every Teams notification a job sends posts here. An empty body is a 422 from the
+    //    handler's extractor, so a 403 means confinement refused it. The real route is only
+    //    mounted in an EE build.
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    {
+        let resp = authed(client().post(format!("{api}/teams/activities")), &user_wm)
+            .json(&json!({}))
+            .send()
+            .await?;
+        assert_eq!(
+            resp.status(),
+            422,
+            "WM_TOKEN must still reach the Teams message route: {}",
+            resp.text().await?
+        );
+    }
 
     // 11. ...and the caller-scoped reads deliberately left out of it, each because it
     //     names another workspace or the identity's credentials.

backend/windmill-api-auth/src/scopes.rs

@@ -940,11 +940,15 @@ fn is_global_read_open_to_job_token(route_path: &str) -> bool {
 ///   not send.
 /// - tutorial progress upserts a UI bitfield keyed on the caller's own email. Its path
 ///   serves a `GET` too, which the read list above carries.
-const GLOBAL_WRITES_OPEN_TO_JOB_TOKEN: [&str; 4] = [
+/// - a Teams message from a job (the Teams error, recovery and success handlers) posts as
+///   the instance-wide bot. The handler refuses a job token whose conversation is not a
+///   channel of the team connected to the job's workspace.
+const GLOBAL_WRITES_OPEN_TO_JOB_TOKEN: [&str; 5] = [
     "/api/settings/test_object_storage_config",
     "/api/workspaces/exists",
     "/api/schedules/preview",
     "/api/users/tutorial_progress",
+    "/api/teams/activities",
 ];
 
 /// Confines a job token (`$WM_TOKEN`) to routes that name a workspace. It is minted