fix: exempt only static websites, not single-file static assets

backend/windmill-api/openapi.yaml

@@ -30304,7 +30304,7 @@ components:
           items:
             type: string
             maxLength: 256
-          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a route serving static assets: those hand out public files, so restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches."
+          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a static website, which has no authentication of its own and so hands out public files: restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches. A single-file static asset is not exempt, since it can carry an authentication_method."
         error_handler_path:
           type: string
           description: Path to a script to run when the triggered job fails. A bare
@@ -30403,7 +30403,7 @@ components:
           items:
             type: string
             maxLength: 256
-          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a route serving static assets: those hand out public files, so restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches."
+          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a static website, which has no authentication of its own and so hands out public files: restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches. A single-file static asset is not exempt, since it can carry an authentication_method."
         error_handler_path:
           type: string
           description: Path to a script to run when the triggered job fails. A bare
@@ -30509,7 +30509,7 @@ components:
           items:
             type: string
             maxLength: 256
-          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a route serving static assets: those hand out public files, so restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches."
+          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a static website, which has no authentication of its own and so hands out public files: restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches. A single-file static asset is not exempt, since it can carry an authentication_method."
         error_handler_path:
           type: string
           description: Path to a script to run when the triggered job fails. A bare

backend/windmill-api/src/triggers/http/handler.rs

@@ -102,11 +102,17 @@ enum CorsDecision {
     Unavailable,
 }
 
-/// A route serving static assets is never subject to an allowlist, its own
-/// included. It hands out public files that any non-browser client can already
-/// fetch, so restricting which browsers may read them protects nothing, while
-/// breaking the cross-origin uses that do consult CORS: a webfont, a
-/// `crossorigin` asset, a `fetch`.
+/// A static website is never subject to an allowlist, its own included. It has
+/// no authentication of its own — the editor does not offer any — so it hands
+/// out public files that any non-browser client can already fetch, and
+/// restricting which browsers may read them protects nothing while breaking the
+/// cross-origin uses that do consult CORS: a webfont, a `crossorigin` asset, a
+/// `fetch`.
+///
+/// A single-file static asset is not exempt. That one can carry an
+/// `authentication_method`, so its content need not be public, and an allowlist
+/// is what keeps another origin from reading a response its own credentials
+/// would not have obtained.
 ///
 /// The CORS verdict for a request, published by whoever resolved its trigger.
 ///
@@ -123,7 +129,7 @@ impl ResolvedCorsPolicy {
     /// Record what the trigger being served allows. Called once, where the
     /// route is resolved, so the answer cannot drift from the response.
     fn publish(&self, trigger: &TriggerRoute, method: Option<HttpMethod>, headers: &HeaderMap) {
-        let decision = if trigger.static_asset_config.is_some() {
+        let decision = if trigger.is_static_website {
             CorsDecision::Unrestricted
         } else {
             let instance_default = HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS.load();
@@ -182,7 +188,7 @@ async fn resolve_cors_decision(
     let route = router.at(requested_path).ok();
     if route
         .as_ref()
-        .is_some_and(|trigger| trigger.value.static_asset_config.is_some())
+        .is_some_and(|trigger| trigger.value.is_static_website)
     {
         return CorsDecision::Unrestricted;
     }

cli/src/guidance/skills.gen.ts

@@ -8396,9 +8396,10 @@ properties:
       including the http_route_default_allowed_origins instance setting. An empty
       list is not a configuration and resolves exactly as null does. When null, the
       instance setting applies, or Access-Control-Allow-Origin: * if it is unset.
-      Ignored on a route serving static assets: those hand out public files, so restricting
-      which browsers may read them protects nothing while breaking cross-origin webfonts
-      and fetches.'
+      Ignored on a static website, which has no authentication of its own and so hands
+      out public files: restricting which browsers may read them protects nothing
+      while breaking cross-origin webfonts and fetches. A single-file static asset
+      is not exempt, since it can carry an authentication_method.'
   error_handler_path:
     type: string
     description: Path to a script to run when the triggered job fails. A bare path,

frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts

@@ -69,7 +69,7 @@ export const httpTriggerRequestSchema = z.object({
 	"wrap_body": z.boolean().describe("If true, wraps the request body in a 'body' parameter").optional(),
 	"mode": z.enum(["enabled", "disabled", "suspended"]).describe("job trigger mode").optional(),
 	"raw_string": z.boolean().describe("If true, passes the request body as a raw string instead of parsing as JSON").optional(),
-	"allowed_origins": z.array(z.string()).describe("Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a route serving static assets: those hand out public files, so restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches.").nullable().optional(),
+	"allowed_origins": z.array(z.string()).describe("Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a static website, which has no authentication of its own and so hands out public files: restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches. A single-file static asset is not exempt, since it can carry an authentication_method.").nullable().optional(),
 	"error_handler_path": z.string().describe("Path to a script to run when the triggered job fails. A bare path, without the script/ or flow/ prefix a schedule error handler takes; it cannot be a flow.").optional(),
 	"error_handler_args": z.record(z.string(), z.any()).describe("Arguments to pass to the error handler").optional(),
 	"retry": z.object({

frontend/src/lib/components/triggers/http/RouteEditorInner.svelte

@@ -796,11 +796,7 @@
 								{ name: 'Authentication', active: authentication_method !== 'none' },
 								{
 									name: 'CORS',
-									// Not shown for a static route: the backend exempts those from
-									// the allowlist, so reporting a restriction would be a lie.
-									active:
-										!static_asset_config &&
-										isOriginRestricted(allowed_origins, instanceDefaultOrigins)
+									active: isOriginRestricted(allowed_origins, instanceDefaultOrigins)
 								}
 							]}
 						/>
@@ -1005,20 +1001,13 @@
 										{testingBadge}
 									/>
 
-									<!-- Both static target types are exempt from the allowlist on
-										 the backend, so the control is not offered for either. The
-										 surrounding section is only hidden for a static website,
-										 which would leave a single-file static asset showing a
-										 restriction that is never applied. -->
-									{#if !static_asset_config}
-										<RouteCorsOption
-											bind:allowed_origins
-											error={originsError}
-											{instanceDefaultOrigins}
-											disabled={!can_write}
-											{testingBadge}
-										/>
-									{/if}
+									<RouteCorsOption
+										bind:allowed_origins
+										error={originsError}
+										{instanceDefaultOrigins}
+										disabled={!can_write}
+										{testingBadge}
+									/>
 								</div>
 							{:else}
 								<TriggerRetriesAndErrorHandler

system_prompts/auto-generated/schemas/http_trigger.schema.yaml

@@ -106,9 +106,10 @@ properties:
       including the http_route_default_allowed_origins instance setting. An empty
       list is not a configuration and resolves exactly as null does. When null, the
       instance setting applies, or Access-Control-Allow-Origin: * if it is unset.
-      Ignored on a route serving static assets: those hand out public files, so restricting
-      which browsers may read them protects nothing while breaking cross-origin webfonts
-      and fetches.'
+      Ignored on a static website, which has no authentication of its own and so hands
+      out public files: restricting which browsers may read them protects nothing
+      while breaking cross-origin webfonts and fetches. A single-file static asset
+      is not exempt, since it can carry an authentication_method.'
   error_handler_path:
     type: string
     description: Path to a script to run when the triggered job fails. A bare path,