From b683b14da730d172c8bb338c825a38ef95a6ccf6 Mon Sep 17 00:00:00 2001 From: hugocasa Date: Mon, 7 Sep 2026 11:50:36 +0200 Subject: [PATCH] fix: gate the credential pass budget on the features that use it Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01C1xHmkxuxYb1GYvth1BS75 --- backend/src/monitor.rs | 30 ++++++++++--------- .../windmill-worker/src/result_processor.rs | 11 ++++--- .../src/lib/components/ResourceEditor.svelte | 12 ++------ 3 files changed, 26 insertions(+), 27 deletions(-) diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs index a98da8b4ec..6ca0d2520f 100644 --- a/backend/src/monitor.rs +++ b/backend/src/monitor.rs @@ -354,7 +354,9 @@ pub async fn initial_load( ) } }); - pass.action(windmill_common::min_version::store_min_keep_alive_version(db)); + pass.action(windmill_common::min_version::store_min_keep_alive_version( + db, + )); pass.setting( windmill_common::global_settings::INSTANCE_EVENTS_WEBHOOK_SETTING, false, @@ -709,7 +711,6 @@ pub async fn initial_load( pass.run(conn).await; } - pub fn apply_metrics_enabled(value: Option) { if let Some(serde_json::Value::Bool(t)) = value { METRICS_ENABLED.store(t, Ordering::Relaxed) @@ -1066,8 +1067,8 @@ pub fn apply_fork_workspace_tag_append_fork_suffix(value: Option error::Result<()> { - let v = - load_value_from_global_settings_with_conn(conn, CRITICAL_ALERT_MUTE_UI_SETTING, true).await?; + let v = load_value_from_global_settings_with_conn(conn, CRITICAL_ALERT_MUTE_UI_SETTING, true) + .await?; apply_critical_alert_mute_ui_setting(v); Ok(()) } @@ -2732,7 +2733,6 @@ pub async fn reload_timeout_wait_result_setting(conn: &Connection) { .await; } - pub async fn reload_extra_pip_index_url_setting(conn: &Connection) { reload_option_setting_with_tracing( conn, @@ -2823,7 +2823,6 @@ pub async fn reload_bunfig_install_scopes_setting(conn: &Connection) { .await; } - pub async fn reload_nuget_config_setting(conn: &Connection) { reload_option_setting_with_tracing( conn, @@ -2931,7 +2930,6 @@ pub async fn reload_ruby_repos_setting(conn: &Connection) { .await; } - pub async fn reload_workspace_registries_setting(conn: &Connection) { match load_value_from_global_settings_with_conn( conn, @@ -3185,7 +3183,6 @@ pub async fn apply_job_isolation_setting(value: Option) { } } - async fn resolve_license_key_value(conn: &Connection, quiet: bool) -> anyhow::Result { let q = load_value_from_global_settings_with_conn(conn, LICENSE_KEY_SETTING, true) .await @@ -3480,7 +3477,10 @@ impl<'a> SettingsPass<'a> { // on compile-time defaults until the next full reload. Only the single-query transport // can fail this way; over HTTP the batch already is the per-setting read. if matches!(conn, Connection::Sql(_)) && values.is_empty() && !names.is_empty() { - tracing::warn!("Falling back to per-setting reads for {} settings", names.len()); + tracing::warn!( + "Falling back to per-setting reads for {} settings", + names.len() + ); values = fetch_settings_individually(conn, &names).await; } for (name, http) in &declared { @@ -3872,7 +3872,6 @@ pub fn parse_setting_value( value } - #[cfg(feature = "prometheus")] pub async fn monitor_pool(db: &DB) { if METRICS_ENABLED.load(Ordering::Relaxed) { @@ -4718,6 +4717,7 @@ const GIT_CREDENTIAL_LOCK_ID: i64 = 737_483_923; /// rotation must never be cancelled between GitLab issuing a token and Windmill /// storing it, so the pass stops at a repository boundary instead and the /// least-recently-checked ordering brings the rest along on the next tick. +#[cfg(all(feature = "enterprise", feature = "private"))] const GIT_CREDENTIAL_PASS_BUDGET: Duration = Duration::from_secs(180); /// Refresh every git-sync repository's credential status and rotate the ones near @@ -4856,9 +4856,12 @@ async fn maintain_git_credentials_inner(db: &Pool) -> error::Result<() }); if needs_hook { let mut repo = repo.clone(); - if let Err(e) = - windmill_common::git_sync_ee::sync_repo_webhook(db, &row.workspace_id, &mut repo) - .await + if let Err(e) = windmill_common::git_sync_ee::sync_repo_webhook( + db, + &row.workspace_id, + &mut repo, + ) + .await { tracing::warn!( "git credentials: could not reconcile the webhook for {path} in workspace {}: {e:#}", @@ -6773,7 +6776,6 @@ pub async fn reload_critical_alerts_on_db_oversize(conn: &DB) -> error::Result<( Ok(()) } - pub async fn reload_jwt_secret_setting(db: &DB) -> error::Result<()> { let v = load_value_from_global_settings(db, JWT_SECRET_SETTING).await?; apply_jwt_secret_setting(db, v).await diff --git a/backend/windmill-worker/src/result_processor.rs b/backend/windmill-worker/src/result_processor.rs index 821514d862..bb38e5c8dc 100644 --- a/backend/windmill-worker/src/result_processor.rs +++ b/backend/windmill-worker/src/result_processor.rs @@ -1384,7 +1384,7 @@ async fn maybe_post_git_sync_check( (None, Some(deploy)) => (true, deploy), (None, None) => return, }; - let Ok(mut check) = serde_json::from_value::(marker) else { + let Ok(check) = serde_json::from_value::(marker) else { return; }; // Job args are persisted, so the repository URL is not among them: it is @@ -1395,7 +1395,11 @@ async fn maybe_post_git_sync_check( // carries the identity to check it against. A marker written before that // identity existed keeps using the URL it captured at enqueue, which cannot // have been repointed since. - let repo_url = match (check.repo.is_some(), row.repo_path.as_deref(), check.repo_url.clone()) { + let repo_url = match ( + check.repo.is_some(), + row.repo_path.as_deref(), + check.repo_url.clone(), + ) { // The resource path is mutable, so following it is only safe when the // marker also carries the identity to check the result against. (true, Some(path), _) => { @@ -1426,8 +1430,7 @@ async fn maybe_post_git_sync_check( }; // A resource repointed while the diff was running would otherwise close a // check, or post a preview, on a repository that has nothing to do with it. - if check.repo.is_some() - && windmill_common::git_sync_ee::repo_identity(&repo_url) != check.repo + if check.repo.is_some() && windmill_common::git_sync_ee::repo_identity(&repo_url) != check.repo { tracing::warn!( "git sync-check: the repository moved since the check was created; leaving it alone" diff --git a/frontend/src/lib/components/ResourceEditor.svelte b/frontend/src/lib/components/ResourceEditor.svelte index 65f43611b4..27cc768a6c 100644 --- a/frontend/src/lib/components/ResourceEditor.svelte +++ b/frontend/src/lib/components/ResourceEditor.svelte @@ -1,11 +1,6 @@