From b7c3f66610fcdff48847b28170784201abbe9089 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 4 Aug 2026 09:54:41 +0000 Subject: [PATCH] fix: record the validated address on the job row, not the one handed in --- backend/windmill-common/src/users.rs | 6 +++--- backend/windmill-queue/src/jobs.rs | 6 +++++- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/backend/windmill-common/src/users.rs b/backend/windmill-common/src/users.rs index f268cccd1e..43d7eb1d35 100644 --- a/backend/windmill-common/src/users.rs +++ b/backend/windmill-common/src/users.rs @@ -152,9 +152,9 @@ pub async fn permissioned_as_exists( /// Drop a cached address so a transactional email change is visible immediately. /// -/// The address is derived at dispatch and feeds the instance-superadmin check and -/// `email_to_igroup`, so serving a stale one would run jobs with the wrong authorization -/// for up to the cache TTL. +/// Not the thing that keeps authorization correct — `fetch_authed_from_permissioned_as` +/// re-resolves the address before granting anything. This keeps the cache from serving an +/// address that is merely wrong for the TTL, on reads and on what is shown. pub fn invalidate_email_cache(workspace_id: &str, username: &str) { EMAIL_CACHE.remove(&(workspace_id.to_string(), username.to_string())); } diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs index fd80a741dc..6af905f71a 100644 --- a/backend/windmill-queue/src/jobs.rs +++ b/backend/windmill-queue/src/jobs.rs @@ -6749,7 +6749,11 @@ async fn push_inner<'c, 'd>( language as Option, same_worker, pre_run_error.map(|e| e.to_string()), - email, + // `job_authed`'s, not the caller's: that one came through + // `fetch_authed_from_permissioned_as`, which re-resolves the address from the principal's + // live binding. The same statement writes it to `job_perms.email`, and the two columns + // naming different accounts is the state this is here to prevent. + job_authed.email, visible_to_owner, flow_innermost_root_job, guarded_concurrent_limit,