starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-03 08:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: let custom workspace error handlers send email with the instance SMTP (#11365)

Browse Source 
* fix: let custom workspace error handlers send email with the instance SMTP

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: state what the error handler email allowlist guarantees

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-09-25 22:18:40 +02:00
committed by GitHub
co-authored by Claude Opus 5.5
parent 3974bbeac6
commit e2be584ca5
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api/src/jobs.rs
+7 -3
View File
@@ -117,7 +117,8 @@ use windmill_common::{
scripts::{ScriptHash, ScriptLang},
users::username_to_permissioned_as,
utils::{
not_found_if_none, now_from_db, paginate, require_admin, Pagination, ScheduleType, StripPath,
not_found_if_none, now_from_db, paginate, require_admin, Pagination, ScheduleType,
StripPath,
},
};
@@ -2762,7 +2763,7 @@ async fn send_email_with_instance_smtp(
Json(send_email): Json<SendEmail>,
) -> error::Result<Json<String>> {
use windmill_common::jobs::EMAIL_ERROR_HANDLER_USER_EMAIL;
use windmill_queue::SCHEDULE_ERROR_HANDLER_USER_EMAIL;
use windmill_queue::{ERROR_HANDLER_USER_EMAIL, SCHEDULE_ERROR_HANDLER_USER_EMAIL};
if *CLOUD_HOSTED {
tracing::warn!(
@@ -2771,12 +2772,15 @@ async fn send_email_with_instance_smtp(
return Err(anyhow::anyhow!("Feature not supported in cloud hosted windmill").into());
}
// Any code pushed as a workspace or schedule error handler, custom ones included, runs as
// one of these identities: this keeps out ad-hoc job tokens, not who authors handler code.
let is_handler_job = authed.email == EMAIL_ERROR_HANDLER_USER_EMAIL
|| authed.email == ERROR_HANDLER_USER_EMAIL
|| authed.email == SCHEDULE_ERROR_HANDLER_USER_EMAIL;
if !is_handler_job && !windmill_api_auth::is_super_admin_authed(&db, &authed).await? {
return Err(Error::NotAuthorized(
"Only super admin or whitelisted token can access email workspace error handler feature"
"Only super admin or a workspace/schedule error handler job can send emails with the instance SMTP"
.to_string(),
));
}