From 7b928ca23938ccf032af42afa9e08dbf7785fd2c Mon Sep 17 00:00:00 2001 From: Diego Imbert Date: Tue, 28 Jul 2026 12:06:59 +0200 Subject: [PATCH] docs: describe the full raw-app SDK sentinel narrowing Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_018Gmsk9kAG7p9t2Qy6ADRJz --- backend/windmill-api-auth/src/scopes.rs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/backend/windmill-api-auth/src/scopes.rs b/backend/windmill-api-auth/src/scopes.rs index 6759d9107e..51c7d68c31 100644 --- a/backend/windmill-api-auth/src/scopes.rs +++ b/backend/windmill-api-auth/src/scopes.rs @@ -725,8 +725,10 @@ pub fn has_app_embed_sentinel(scopes: Option<&[String]>) -> bool { } /// Sentinel scope in raw-app frontend SDK tokens. Grants nothing itself; -/// `check_route_access` uses it to deny the request-supplied-code endpoints that -/// `jobs:run` would otherwise reach. +/// `check_route_access` uses it to narrow the declared scopes down to what the +/// viewer's permission prompt actually promised: it denies the +/// request-supplied-code endpoints `jobs:run` would otherwise reach, and confines +/// `users:read` to `users/whoami` (never the workspace member directory). pub const RAW_APP_SDK_SENTINEL: &str = "raw_app_sdk"; pub fn has_raw_app_sdk_sentinel(scopes: Option<&[String]>) -> bool {