From 7af10b05e0de50fd33a5910f85e23440e38bfbbc Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Sun, 13 Sep 2026 13:43:11 +0200 Subject: [PATCH] docs: state attach_on_behalf_of_email's authorization contract Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01EYWxvwmteVyzcWenJfbnzs --- backend/windmill-api/src/apps.rs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs index 6b3cdf9dbb..35397f3c7e 100644 --- a/backend/windmill-api/src/apps.rs +++ b/backend/windmill-api/src/apps.rs @@ -5589,6 +5589,11 @@ fn refuse_address_only_identity(policy: &Policy, preserve: Option) -> Resu /// last typed, so resolving one would answer "which address is `u/x`?" for any principal a /// caller cares to name — including a superadmin outside their own workspaces, whom /// `resolve_username_to_email` reaches instance-wide. +/// +/// Resolves through the non-RLS pool and authorizes nothing: it hands back an address for +/// whatever principal it is given, so callers must already have established that the caller may +/// see this app. Every route that calls it does so after its own read check — the RLS +/// transaction that produced the row, `check_scopes`, or `authorize_app_viewer`. pub async fn attach_on_behalf_of_email( policy: &mut sqlx::types::Json>, w_id: &str,