starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-12 00:06:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(jwt): implement scopes run for executing apps components

Browse Source
This commit is contained in:
Ruben Fiszel
2025-09-09 12:45:16 +00:00
parent 9bd7a0c46b
commit acf0d958d5
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api/src/scopes.rs
+4 -1
View File
@@ -413,6 +413,7 @@ impl ScopeAction {
pub fn includes(&self, other: &ScopeAction) -> bool {
match (self, other) {
(ScopeAction::Write, ScopeAction::Read) => true,
(ScopeAction::Run, ScopeAction::Read) => true,
(a, b) => a == b,
}
}
@@ -440,6 +441,7 @@ pub fn check_route_access(
for scope_str in token_scopes {
if !scope_str.starts_with("if_jobs:filter_tags:") {
if let Ok(scope) = ScopeDefinition::from_scope_string(scope_str) {
// tracing::error!("Checking scope {:?} for required domain {:?} and action {:?} and kind {:?} and route suffix {:?}", scope, required_domain, required_action, required_kind, route_suffix);
if scope_grants_access(
&scope,
required_domain,
@@ -498,7 +500,7 @@ const FLOW_JOBS: [&'static str; 5] = [
lazy_static::lazy_static! {
static ref RUN_PATH_ACTIONS: Vec<&'static str> = {
let mut v = vec!["jobs/resume/", "jobs/run/batch_rerun_jobs", "jobs/run/workflow_as_code", "jobs/run/dependencies","jobs/run/flow_dependencies",];
let mut v = vec!["jobs/resume/", "jobs/run/batch_rerun_jobs", "jobs/run/workflow_as_code", "jobs/run/dependencies","jobs/run/flow_dependencies", "apps_u/execute_component"];
v.extend(SCRIPT_JOBS);
v.extend(FLOW_JOBS);
@@ -568,6 +570,7 @@ fn extract_domain_from_route(
};
if let Some(domain) = domain {
// tracing::error!("Extracted domain {:?} from route {:?} with kind {:?} and route suffix {:?}", domain, route_path, kind, route_suffix);
return Ok((domain, kind, route_suffix));
}