From c8046af9d01ade6891ea97e56974bb742bbf3e6e Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Wed, 29 Nov 2023 00:33:58 +0100 Subject: [PATCH] fix: only list session and permanent token in user settings --- ...98ad829ea8023ce449eab27225ec66738525.json} | 4 +- ...4ae081146e598109860ee1f42cd3778c5ebaf.json | 52 ++++++++++++++ backend/src/monitor.rs | 2 +- backend/windmill-api/openapi.yaml | 68 +++++++++++++------ backend/windmill-api/src/users.rs | 36 +++++++--- .../src/lib/components/UserSettings.svelte | 2 +- 6 files changed, 130 insertions(+), 34 deletions(-) rename backend/.sqlx/{query-773c145013623e4eb29a8df70e46d805dc5b15942a36a0d988521abb0cb34e41.json => query-9ce6eecfa10c2f71cc536957ead498ad829ea8023ce449eab27225ec66738525.json} (87%) create mode 100644 backend/.sqlx/query-bc1f2f169b4960dae02f62e37bb4ae081146e598109860ee1f42cd3778c5ebaf.json diff --git a/backend/.sqlx/query-773c145013623e4eb29a8df70e46d805dc5b15942a36a0d988521abb0cb34e41.json b/backend/.sqlx/query-9ce6eecfa10c2f71cc536957ead498ad829ea8023ce449eab27225ec66738525.json similarity index 87% rename from backend/.sqlx/query-773c145013623e4eb29a8df70e46d805dc5b15942a36a0d988521abb0cb34e41.json rename to backend/.sqlx/query-9ce6eecfa10c2f71cc536957ead498ad829ea8023ce449eab27225ec66738525.json index e377ffa830..855f87ceb9 100644 --- a/backend/.sqlx/query-773c145013623e4eb29a8df70e46d805dc5b15942a36a0d988521abb0cb34e41.json +++ b/backend/.sqlx/query-9ce6eecfa10c2f71cc536957ead498ad829ea8023ce449eab27225ec66738525.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "SELECT label, concat(substring(token for 10)) as token_prefix, expiration, created_at, last_used_at, scopes FROM token WHERE email = $1\n ORDER BY created_at DESC", + "query": "SELECT label, concat(substring(token for 10)) as token_prefix, expiration, created_at, last_used_at, scopes FROM token WHERE email = $1\n ORDER BY created_at DESC", "describe": { "columns": [ { @@ -48,5 +48,5 @@ true ] }, - "hash": "773c145013623e4eb29a8df70e46d805dc5b15942a36a0d988521abb0cb34e41" + "hash": "9ce6eecfa10c2f71cc536957ead498ad829ea8023ce449eab27225ec66738525" } diff --git a/backend/.sqlx/query-bc1f2f169b4960dae02f62e37bb4ae081146e598109860ee1f42cd3778c5ebaf.json b/backend/.sqlx/query-bc1f2f169b4960dae02f62e37bb4ae081146e598109860ee1f42cd3778c5ebaf.json new file mode 100644 index 0000000000..cc28561ed5 --- /dev/null +++ b/backend/.sqlx/query-bc1f2f169b4960dae02f62e37bb4ae081146e598109860ee1f42cd3778c5ebaf.json @@ -0,0 +1,52 @@ +{ + "db_name": "PostgreSQL", + "query": "SELECT label, concat(substring(token for 10)) as token_prefix, expiration, created_at, last_used_at, scopes FROM token WHERE email = $1 AND label != 'ephemeral-script'\n ORDER BY created_at DESC", + "describe": { + "columns": [ + { + "ordinal": 0, + "name": "label", + "type_info": "Varchar" + }, + { + "ordinal": 1, + "name": "token_prefix", + "type_info": "Text" + }, + { + "ordinal": 2, + "name": "expiration", + "type_info": "Timestamptz" + }, + { + "ordinal": 3, + "name": "created_at", + "type_info": "Timestamptz" + }, + { + "ordinal": 4, + "name": "last_used_at", + "type_info": "Timestamptz" + }, + { + "ordinal": 5, + "name": "scopes", + "type_info": "TextArray" + } + ], + "parameters": { + "Left": [ + "Text" + ] + }, + "nullable": [ + true, + null, + true, + false, + false, + true + ] + }, + "hash": "bc1f2f169b4960dae02f62e37bb4ae081146e598109860ee1f42cd3778c5ebaf" +} diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs index 5edd5487d2..c3855c0abf 100644 --- a/backend/src/monitor.rs +++ b/backend/src/monitor.rs @@ -719,7 +719,7 @@ async fn handle_zombie_jobs &db, &job.workspace_id, &job.permissioned_as, - "ephemeral-zombie-jobs", + "ephemeral-script", *SCRIPT_TOKEN_EXPIRY, &job.email, ) diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml index 8ab97ce5c0..90cf58255b 100644 --- a/backend/windmill-api/openapi.yaml +++ b/backend/windmill-api/openapi.yaml @@ -1634,6 +1634,11 @@ paths: operationId: listTokens tags: - user + parameters: + - name: exclude_ephemeral + in: query + schema: + type: boolean responses: "200": description: truncated token @@ -2192,7 +2197,8 @@ paths: /w/{workspace}/resources/get_value_interpolated/{path}: get: - summary: get resource interpolated (variables and resources are fully unrolled) + summary: + get resource interpolated (variables and resources are fully unrolled) operationId: getResourceValueInterpolated tags: - resource @@ -2880,7 +2886,8 @@ paths: schema: type: string - name: first_parent_hash - description: mask to filter scripts whom first direct parent has exact hash + description: + mask to filter scripts whom first direct parent has exact hash in: query schema: type: string @@ -3075,7 +3082,8 @@ paths: /workers/custom_tags: get: - summary: get all instance custom tags (tags are used to dispatch jobs to + summary: + get all instance custom tags (tags are used to dispatch jobs to different worker groups) operationId: getCustomTags tags: @@ -3126,7 +3134,8 @@ paths: /w/{workspace}/scripts/delete/h/{hash}: post: - summary: delete script by hash (erase content but keep hash, require admin) + summary: + delete script by hash (erase content but keep hash, require admin) operationId: deleteScriptByHash tags: - script @@ -3318,14 +3327,16 @@ paths: type: string format: date-time - name: scheduled_in_secs - description: schedule the script to execute in the number of seconds starting now + description: + schedule the script to execute in the number of seconds starting now in: query schema: type: integer - $ref: "#/components/parameters/ParentJob" - $ref: "#/components/parameters/NewJobId" - name: invisible_to_owner - description: make the run invisible to the the script owner (default false) + description: + make the run invisible to the the script owner (default false) in: query schema: type: boolean @@ -4298,7 +4309,8 @@ paths: type: string format: date-time - name: scheduled_in_secs - description: schedule the script to execute in the number of seconds starting now + description: + schedule the script to execute in the number of seconds starting now in: query schema: type: integer @@ -4306,7 +4318,8 @@ paths: - $ref: "#/components/parameters/NewJobId" - $ref: "#/components/parameters/IncludeHeader" - name: invisible_to_owner - description: make the run invisible to the the flow owner (default false) + description: + make the run invisible to the the flow owner (default false) in: query schema: type: boolean @@ -4358,7 +4371,8 @@ paths: type: string format: date-time - name: scheduled_in_secs - description: schedule the script to execute in the number of seconds starting now + description: + schedule the script to execute in the number of seconds starting now in: query schema: type: integer @@ -4366,7 +4380,8 @@ paths: - $ref: "#/components/parameters/NewJobId" - $ref: "#/components/parameters/IncludeHeader" - name: invisible_to_owner - description: make the run invisible to the the flow owner (default false) + description: + make the run invisible to the the flow owner (default false) in: query schema: type: boolean @@ -4404,7 +4419,8 @@ paths: type: string format: date-time - name: scheduled_in_secs - description: schedule the script to execute in the number of seconds starting now + description: + schedule the script to execute in the number of seconds starting now in: query schema: type: integer @@ -4412,7 +4428,8 @@ paths: - $ref: "#/components/parameters/NewJobId" - $ref: "#/components/parameters/IncludeHeader" - name: invisible_to_owner - description: make the run invisible to the the script owner (default false) + description: + make the run invisible to the the script owner (default false) in: query schema: type: boolean @@ -4443,7 +4460,8 @@ paths: - $ref: "#/components/parameters/WorkspaceId" - $ref: "#/components/parameters/IncludeHeader" - name: invisible_to_owner - description: make the run invisible to the the script owner (default false) + description: + make the run invisible to the the script owner (default false) in: query schema: type: boolean @@ -4476,7 +4494,8 @@ paths: - $ref: "#/components/parameters/WorkspaceId" - $ref: "#/components/parameters/IncludeHeader" - name: invisible_to_owner - description: make the run invisible to the the script owner (default false) + description: + make the run invisible to the the script owner (default false) in: query schema: type: boolean @@ -4691,7 +4710,8 @@ paths: - job responses: "200": - description: the timestamp of the db that can be used to compute the drift + description: + the timestamp of the db that can be used to compute the drift content: application/json: schema: @@ -4927,7 +4947,8 @@ paths: /w/{workspace}/jobs/resume_urls/{id}/{resume_id}: get: - summary: get resume urls given a job_id, resume_id and a nonce to resume a flow + summary: + get resume urls given a job_id, resume_id and a nonce to resume a flow operationId: getResumeUrls tags: - job @@ -5478,7 +5499,8 @@ paths: - $ref: "#/components/parameters/WorkspaceId" - name: only_member_of in: query - description: only list the groups the user is member of (default false) + description: + only list the groups the user is member of (default false) schema: type: boolean responses: @@ -5666,7 +5688,8 @@ paths: - $ref: "#/components/parameters/WorkspaceId" - name: only_member_of in: query - description: only list the folders the user is member of (default false) + description: + only list the folders the user is member of (default false) schema: type: boolean responses: @@ -6567,7 +6590,8 @@ components: type: integer PerPage: name: per_page - description: number of items to return for a given page (default 30, max 100) + description: + number of items to return for a given page (default 30, max 100) in: query schema: type: integer @@ -6701,7 +6725,8 @@ components: type: boolean ArgsFilter: name: args - description: filter on jobs containing those args as a json subset (@> in postgres) + description: + filter on jobs containing those args as a json subset (@> in postgres) in: query schema: type: string @@ -6713,7 +6738,8 @@ components: type: string ResultFilter: name: result - description: filter on jobs containing those result as a json subset (@> in postgres) + description: + filter on jobs containing those result as a json subset (@> in postgres) in: query schema: type: string diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs index 7411dbf73d..a458a77277 100644 --- a/backend/windmill-api/src/users.rs +++ b/backend/windmill-api/src/users.rs @@ -2127,19 +2127,37 @@ async fn impersonate( Ok((StatusCode::CREATED, token)) } +#[derive(Deserialize)] +struct ListTokenQuery { + exclude_ephemeral: Option, +} + async fn list_tokens( Extension(db): Extension, ApiAuthed { email, .. }: ApiAuthed, + Query(query): Query, ) -> JsonResult> { - let rows = sqlx::query_as!( - TruncatedToken, - "SELECT label, concat(substring(token for 10)) as token_prefix, expiration, created_at, \ - last_used_at, scopes FROM token WHERE email = $1 - ORDER BY created_at DESC", - email, - ) - .fetch_all(&db) - .await?; + let rows = if query.exclude_ephemeral.unwrap_or(false) { + sqlx::query_as!( + TruncatedToken, + "SELECT label, concat(substring(token for 10)) as token_prefix, expiration, created_at, \ + last_used_at, scopes FROM token WHERE email = $1 AND label != 'ephemeral-script' + ORDER BY created_at DESC", + email, + ) + .fetch_all(&db) + .await? + } else { + sqlx::query_as!( + TruncatedToken, + "SELECT label, concat(substring(token for 10)) as token_prefix, expiration, created_at, \ + last_used_at, scopes FROM token WHERE email = $1 + ORDER BY created_at DESC", + email, + ) + .fetch_all(&db) + .await? + }; Ok(Json(rows)) } diff --git a/frontend/src/lib/components/UserSettings.svelte b/frontend/src/lib/components/UserSettings.svelte index 1692cf2028..417a18081d 100644 --- a/frontend/src/lib/components/UserSettings.svelte +++ b/frontend/src/lib/components/UserSettings.svelte @@ -76,7 +76,7 @@ } async function listTokens(): Promise { - tokens = await UserService.listTokens() + tokens = await UserService.listTokens({ excludeEphemeral: true }) } async function deleteToken(tokenPrefix: string) {