starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-05 16:03:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: describe the full raw-app SDK sentinel narrowing

Browse Source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018Gmsk9kAG7p9t2Qy6ADRJz
This commit is contained in:
Diego Imbert
2026-07-28 12:06:59 +02:00
co-authored by Claude Fable 5
parent 02aea763cd
commit 7b928ca239
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api-auth/src/scopes.rs
+4 -2
View File
@@ -725,8 +725,10 @@ pub fn has_app_embed_sentinel(scopes: Option<&[String]>) -> bool {
}
/// Sentinel scope in raw-app frontend SDK tokens. Grants nothing itself;
/// `check_route_access` uses it to deny the request-supplied-code endpoints that
/// `jobs:run` would otherwise reach.
/// `check_route_access` uses it to narrow the declared scopes down to what the
/// viewer's permission prompt actually promised: it denies the
/// request-supplied-code endpoints `jobs:run` would otherwise reach, and confines
/// `users:read` to `users/whoami` (never the workspace member directory).
pub const RAW_APP_SDK_SENTINEL: &str = "raw_app_sdk";
pub fn has_raw_app_sdk_sentinel(scopes: Option<&[String]>) -> bool {