fix: add HIDE_WORKERS_FOR_NON_ADMINS env var and workspace-scoped custom_tags endpoint (#7613)

backend/windmill-api/openapi.yaml

@@ -5920,11 +5920,6 @@ paths:
       tags:
         - worker
       parameters:
-        - name: workspace
-          in: query
-          schema:
-            type: string
-          required: false
         - name: show_workspace_restriction
           in: query
           schema:
@@ -5940,6 +5935,24 @@ paths:
                 items:
                   type: string
 
+  /w/{workspace}/workers/custom_tags:
+    get:
+      summary: get custom tags available for this workspace
+      operationId: getCustomTagsForWorkspace
+      tags:
+        - worker
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      responses:
+        "200":
+          description: list of custom tags for workspace
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: string
+
   /workers/get_default_tags:
     get:
       summary: get all instance default tags

backend/windmill-api/src/lib.rs

@@ -508,6 +508,7 @@ pub async fn run_server(
                             users::workspaced_service().layer(Extension(argon2.clone())),
                         )
                         .nest("/variables", variables::workspaced_service())
+                        .nest("/workers", workers::workspaced_service())
                         .nest("/workspaces", workspaces::workspaced_service())
                         .nest("/oidc", oidc_oss::workspaced_service())
                         .nest("/openapi", {

backend/windmill-api/src/workers.rs

@@ -7,7 +7,7 @@
  */
 
 use axum::{
-    extract::{Extension, Query},
+    extract::{Extension, Path, Query},
     routing::get,
     Json, Router,
 };
@@ -18,7 +18,7 @@ use uuid::Uuid;
 use windmill_common::{
     db::UserDB,
     error::JsonResult,
-    jobs::TAGS_ARE_SENSITIVE,
+    jobs::{HIDE_WORKERS_FOR_NON_ADMINS, TAGS_ARE_SENSITIVE},
     utils::{paginate, Pagination},
     worker::{ALL_TAGS, CUSTOM_TAGS_PER_WORKSPACE, DEFAULT_TAGS, DEFAULT_TAGS_PER_WORKSPACE},
     DB,
@@ -41,6 +41,10 @@ pub fn global_service() -> Router {
         .route("/queue_running_counts", get(get_queue_running_counts))
 }
 
+pub fn workspaced_service() -> Router {
+    Router::new().route("/custom_tags", get(get_custom_tags_for_workspace))
+}
+
 #[derive(FromRow, Serialize, Deserialize)]
 struct WorkerPing {
     worker: String,
@@ -93,6 +97,9 @@ async fn list_worker_pings(
     Query(query): Query<ListWorkerQuery>,
 ) -> JsonResult<Vec<WorkerPing>> {
     let is_super_admin = require_super_admin(&db, &authed.email).await.is_ok();
+    if *HIDE_WORKERS_FOR_NON_ADMINS && !is_super_admin {
+        return Ok(Json(vec![]));
+    }
     let mut tx = user_db.begin(&authed).await?;
 
     let (per_page, offset) = paginate(Pagination { page: query.page, per_page: query.per_page });
@@ -189,24 +196,15 @@ async fn exists_workers_with_tags(
 
 #[derive(Deserialize)]
 struct CustomTagQuery {
-    workspace: Option<String>,
     show_workspace_restriction: Option<bool>,
 }
+
 async fn get_custom_tags(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
     Query(query): Query<CustomTagQuery>,
 ) -> JsonResult<Vec<String>> {
-    if query.show_workspace_restriction.is_some_and(|x| x) && query.workspace.is_some() {
-        return Err(windmill_common::error::Error::BadRequest(
-            "Cannot use both workspace and show_workspace_restriction".to_string(),
-        ));
-    }
-    if let Some(workspace) = query.workspace {
-        let tags_o = CUSTOM_TAGS_PER_WORKSPACE.read().await;
-        let all_tags = tags_o.to_string_vec(Some(workspace));
-        return Ok(Json(all_tags));
-    } else if query.show_workspace_restriction.is_some_and(|x| x) {
+    if query.show_workspace_restriction.is_some_and(|x| x) {
         let tags_o = CUSTOM_TAGS_PER_WORKSPACE.read().await;
         let all_tags = tags_o.to_string_vec(None);
         return Ok(Json(all_tags));
@@ -220,6 +218,15 @@ async fn get_custom_tags(
     Ok(Json(ALL_TAGS.read().await.clone().into()))
 }
 
+async fn get_custom_tags_for_workspace(
+    _authed: ApiAuthed,
+    Path(w_id): Path<String>,
+) -> JsonResult<Vec<String>> {
+    let tags_o = CUSTOM_TAGS_PER_WORKSPACE.read().await;
+    let all_tags = tags_o.to_string_vec(Some(w_id));
+    Ok(Json(all_tags))
+}
+
 async fn get_default_tags_per_workspace() -> JsonResult<bool> {
     Ok(Json(
         DEFAULT_TAGS_PER_WORKSPACE.load(std::sync::atomic::Ordering::Relaxed),

backend/windmill-common/src/jobs.rs

@@ -825,6 +825,9 @@ lazy_static::lazy_static! {
     pub static ref TAGS_ARE_SENSITIVE: bool = std::env::var("TAGS_ARE_SENSITIVE").map(
         |v| v.parse().unwrap()
     ).unwrap_or(false);
+    pub static ref HIDE_WORKERS_FOR_NON_ADMINS: bool = std::env::var("HIDE_WORKERS_FOR_NON_ADMINS").map(
+        |v| v.parse().unwrap()
+    ).unwrap_or(false);
 }
 
 pub async fn check_tag_available_for_workspace_internal(

frontend/src/lib/components/RunFormAdvancedPopup.svelte

@@ -30,7 +30,7 @@
 
 	async function loadWorkerGroups() {
 		if (!$workerTags) {
-			$workerTags = await WorkerService.getCustomTags({ workspace: $workspaceStore })
+			$workerTags = await WorkerService.getCustomTagsForWorkspace({ workspace: $workspaceStore! })
 		}
 	}
 </script>

frontend/src/lib/components/ScriptBuilder.svelte

@@ -967,7 +967,7 @@
 	loadWorkerTags()
 	async function loadWorkerTags() {
 		if (!$workerTags) {
-			$workerTags = await WorkerService.getCustomTags({ workspace: $workspaceStore })
+			$workerTags = await WorkerService.getCustomTagsForWorkspace({ workspace: $workspaceStore! })
 		}
 	}
 </script>

frontend/src/lib/components/WorkerTagPicker.svelte

@@ -23,7 +23,7 @@
 	loadWorkerTags()
 	async function loadWorkerTags(force = false) {
 		if (!$workerTags || force) {
-			$workerTags = await WorkerService.getCustomTags({ workspace: $workspaceStore })
+			$workerTags = await WorkerService.getCustomTagsForWorkspace({ workspace: $workspaceStore! })
 		}
 	}
 </script>

frontend/src/lib/components/WorkerTagSelect.svelte

@@ -52,7 +52,7 @@
 		loading = true
 		try {
 			if (!$workerTags || force) {
-				$workerTags = await WorkerService.getCustomTags({ workspace: $workspaceStore })
+				$workerTags = await WorkerService.getCustomTagsForWorkspace({ workspace: $workspaceStore! })
 			}
 		} catch (e) {
 			$workerTags = []

frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte

@@ -26,7 +26,7 @@
 
 	async function loadWorkerGroups() {
 		if (!$workerTags) {
-			$workerTags = await WorkerService.getCustomTags({ workspace: $workspaceStore })
+			$workerTags = await WorkerService.getCustomTagsForWorkspace({ workspace: $workspaceStore! })
 		}
 	}
 </script>