From a7561fd8bde5c4a766a050507c2d9b9823c08bcc Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Mon, 19 Oct 2026 01:38:00 +0200 Subject: [PATCH] fix: insert ApiAuthed into request extensions in no-auth mode (#11868) Co-authored-by: Claude Opus 5.5 --- backend/windmill-api-auth/src/auth.rs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/backend/windmill-api-auth/src/auth.rs b/backend/windmill-api-auth/src/auth.rs index 8bf02acede..6bc9a930a4 100644 --- a/backend/windmill-api-auth/src/auth.rs +++ b/backend/windmill-api-auth/src/auth.rs @@ -1154,10 +1154,10 @@ pub async fn resolve_opt_job_authed( }; if is_no_auth() { - return Ok(( - OptJobAuthed { authed: no_auth_admin_authed(), job_id: None }, - parts, - )); + let authed = no_auth_admin_authed(); + // Handlers taking `Extension` read this insert, as on the token path. + parts.extensions.insert(authed.clone()); + return Ok((OptJobAuthed { authed, job_id: None }, parts)); } // Safe only while what the route checks below read is fixed before the first