fix: tighten operator permissions

backend/windmill-api/src/apps.rs

@@ -1042,6 +1042,11 @@ async fn create_app_raw<'a>(
     Path(w_id): Path<String>,
     multipart: Multipart,
 ) -> Result<(StatusCode, String)> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot create apps for security reasons".to_string(),
+        ));
+    }
     let (path, _id) = process_app_multipart!(
         authed,
         user_db,
@@ -1094,6 +1099,11 @@ async fn create_app(
     Path(w_id): Path<String>,
     Json(app): Json<CreateApp>,
 ) -> Result<(StatusCode, String)> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot create apps for security reasons".to_string(),
+        ));
+    }
     let path = app.path.clone();
     check_scopes(&authed, || format!("apps:write:{}", &path))?;
 
@@ -1413,6 +1423,11 @@ async fn update_app(
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(ns): Json<EditApp>,
 ) -> Result<String> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot update apps for security reasons".to_string(),
+        ));
+    }
     // create_app_internal(authed, user_db, db, &w_id, &mut app).await?;
     let path = path.to_path();
     check_scopes(&authed, || format!("apps:write:{}", path))?;
@@ -1441,6 +1456,11 @@ async fn update_app_raw<'a>(
     Path((w_id, path)): Path<(String, StripPath)>,
     multipart: Multipart,
 ) -> Result<String> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot update apps for security reasons".to_string(),
+        ));
+    }
     let path = path.to_path();
     check_scopes(&authed, || format!("apps:write:{}", path))?;
     let opath = path.to_string();

backend/windmill-api/src/flows.rs

@@ -421,6 +421,11 @@ async fn create_flow(
     Path(w_id): Path<String>,
     Json(nf): Json<NewFlow>,
 ) -> Result<(StatusCode, String)> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot create flows for security reasons".to_string(),
+        ));
+    }
     check_scopes(&authed, || format!("flows:write:{}", nf.path))?;
     validate_flow(&nf).await?;
     if *CLOUD_HOSTED {
@@ -846,6 +851,11 @@ async fn update_flow(
     Path((w_id, flow_path)): Path<(String, StripPath)>,
     Json(nf): Json<NewFlow>,
 ) -> Result<String> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot update flows for security reasons".to_string(),
+        ));
+    }
     let flow_path = flow_path.to_path();
     check_scopes(&authed, || format!("flows:write:{}", flow_path))?;
     validate_flow(&nf).await?;

backend/windmill-api/src/raw_apps.rs

@@ -156,6 +156,11 @@ async fn create_app(
     Path(w_id): Path<String>,
     Json(app): Json<CreateApp>,
 ) -> Result<(StatusCode, String)> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot create raw apps for security reasons".to_string(),
+        ));
+    }
     check_scopes(&authed, || format!("raw_apps:write:{}", app.path))?;
     if *CLOUD_HOSTED {
         let nb_apps = sqlx::query_scalar!(
@@ -272,6 +277,11 @@ async fn update_app(
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(app): Json<EditApp>,
 ) -> Result<String> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot update raw apps for security reasons".to_string(),
+        ));
+    }
     use sql_builder::prelude::*;
 
     let path = path.to_path();

backend/windmill-api/src/scripts.rs

@@ -589,6 +589,11 @@ async fn create_script_internal<'c>(
     Transaction<'c, Postgres>,
     Option<HandleDeploymentMetadata>,
 )> {
+    if authed.is_operator {
+        return Err(Error::NotAuthorized(
+            "Operators cannot create scripts for security reasons".to_string(),
+        ));
+    }
     check_scopes(&authed, || format!("scripts:write:{}", ns.path))?;
 
     guard_script_from_debounce_data(&ns).await?;