starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-27 08:02:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: return variable.value as text so widening it changes no result type (#11976)

Browse Source 
* fix: return variable.value as text so widening it changes no result type

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 16858ac4cf7326ed3d5a6fae1a97fcade5a97af7

This commit updates the EE repository reference after PR #920 was merged in windmill-ee-private.

Previous ee-repo-ref: dcf6219b5635fc93f11dcb2fd0564c1c5f8407b3

New ee-repo-ref: 16858ac4cf7326ed3d5a6fae1a97fcade5a97af7

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
This commit is contained in:
Ruben Fiszel
2026-10-23 16:10:12 +02:00
committed by GitHub
co-authored by Claude Opus 5.5 windmill-internal-app[bot]
parent d6c2b2c683
commit f6f3a0a1f2
31 changed files with 157 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/.sqlx/query-020c031c3de6c85577e30421ada9d39a5a47ca1b6cf3dbfd6988aa0694d7364c.json
Generated
-23
View File
@@ -1,23 +0,0 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value FROM variable WHERE path = $1 AND workspace_id = $2 AND is_secret = true",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value",
"type_info": "Varchar"
}
],
"parameters": {
"Left": [
"Text",
"Text"
]
},
"nullable": [
false
]
},
"hash": "020c031c3de6c85577e30421ada9d39a5a47ca1b6cf3dbfd6988aa0694d7364c"
}
backend/.sqlx/query-7a92837ad2a1181580c1e0d059fd6bc0ece84d3c315635de52bd2b364c238a71.json → backend/.sqlx/query-08af141e847f9bb6a4c26ccad3bd84d2a06b9e55557757d407787078af1ecad7.json
Generated
+5 -5
View File
@@ -1,12 +1,12 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value, account, (now() > account.expires_at) as is_expired, is_secret, path from variable\n LEFT JOIN account ON variable.account = account.id WHERE variable.path = $1 AND variable.workspace_id = $2",
"query": "SELECT value::text AS \"value!\", account, (now() > account.expires_at) as is_expired, is_secret, path from variable\n LEFT JOIN account ON variable.account = account.id WHERE variable.path = $1 AND variable.workspace_id = $2",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value",
"type_info": "Varchar"
"name": "value!",
"type_info": "Text"
},
{
"ordinal": 1,
@@ -36,12 +36,12 @@
]
},
"nullable": [
false,
null,
true,
null,
false,
false
]
},
"hash": "7a92837ad2a1181580c1e0d059fd6bc0ece84d3c315635de52bd2b364c238a71"
"hash": "08af141e847f9bb6a4c26ccad3bd84d2a06b9e55557757d407787078af1ecad7"
}
backend/.sqlx/query-146f0e42ada3068a5cdae0ffdbb54b63f8c06c9143b16ce399170c1b5a6b911e.json → backend/.sqlx/query-1cf81ee935e6e820463820519e3a402d5290b494dac690c9a11f121eeefeab8e.json
Generated
+5 -5
View File
@@ -1,12 +1,12 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value, is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
"query": "SELECT value::text AS \"value!\", is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value",
"type_info": "Varchar"
"name": "value!",
"type_info": "Text"
},
{
"ordinal": 1,
@@ -21,9 +21,9 @@
]
},
"nullable": [
false,
null,
false
]
},
"hash": "146f0e42ada3068a5cdae0ffdbb54b63f8c06c9143b16ce399170c1b5a6b911e"
"hash": "1cf81ee935e6e820463820519e3a402d5290b494dac690c9a11f121eeefeab8e"
}
backend/.sqlx/query-2c0ab7571e1a7c4290315bc3efccb4db9e0c9aee05596a594f81975a0cdb74d1.json
Generated
-23
View File
@@ -1,23 +0,0 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value FROM variable WHERE workspace_id = $1 AND path = $2",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value",
"type_info": "Varchar"
}
],
"parameters": {
"Left": [
"Text",
"Text"
]
},
"nullable": [
false
]
},
"hash": "2c0ab7571e1a7c4290315bc3efccb4db9e0c9aee05596a594f81975a0cdb74d1"
}
backend/.sqlx/query-b656f38e5f1d6a0799767a775b8550027cf7a3bb202269e8dda92d31bc8789dd.json → backend/.sqlx/query-3420c007c141c5d9e3748c18de03d4b51216ba05e2951ce045ff58112c1db361.json
Generated
+5 -5
View File
@@ -1,6 +1,6 @@
{
"db_name": "PostgreSQL",
"query": "SELECT path, value, is_secret FROM variable WHERE workspace_id = $1",
"query": "SELECT path, value::text AS \"value!\", is_secret FROM variable WHERE workspace_id = $1",
"describe": {
"columns": [
{
@@ -10,8 +10,8 @@
},
{
"ordinal": 1,
"name": "value",
"type_info": "Varchar"
"name": "value!",
"type_info": "Text"
},
{
"ordinal": 2,
@@ -26,9 +26,9 @@
},
"nullable": [
false,
false,
null,
false
]
},
"hash": "b656f38e5f1d6a0799767a775b8550027cf7a3bb202269e8dda92d31bc8789dd"
"hash": "3420c007c141c5d9e3748c18de03d4b51216ba05e2951ce045ff58112c1db361"
}
backend/.sqlx/query-71b410dbc6cdd0252de2f8646395903c9fa60a5435fa73c587da2b913203cf18.json → backend/.sqlx/query-36121d10cb03d45fc14aacd08750fb944a54c1172ffa2b990ba157e676f66f51.json
Generated
+5 -5
View File
@@ -1,12 +1,12 @@
{
"db_name": "PostgreSQL",
"query": "SELECT v.value, a.id AS account_id, a.refresh_token\n FROM variable v\n JOIN account a ON a.workspace_id = v.workspace_id AND a.id = v.account\n WHERE v.workspace_id = $1 AND v.path = $2\n AND a.client = $3 AND a.is_workspace_integration = true",
"query": "SELECT v.value::text AS \"value!\", a.id AS account_id, a.refresh_token\n FROM variable v\n JOIN account a ON a.workspace_id = v.workspace_id AND a.id = v.account\n WHERE v.workspace_id = $1 AND v.path = $2\n AND a.client = $3 AND a.is_workspace_integration = true",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value",
"type_info": "Varchar"
"name": "value!",
"type_info": "Text"
},
{
"ordinal": 1,
@@ -27,10 +27,10 @@
]
},
"nullable": [
false,
null,
false,
false
]
},
"hash": "71b410dbc6cdd0252de2f8646395903c9fa60a5435fa73c587da2b913203cf18"
"hash": "36121d10cb03d45fc14aacd08750fb944a54c1172ffa2b990ba157e676f66f51"
}
backend/.sqlx/query-40790b7f44b40b0c64bbabd3bc6c984000e12f33bc1cea460e8f5dd55ea59eec.json
Generated
+23
View File
@@ -0,0 +1,23 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value::text AS \"value!\" FROM variable WHERE workspace_id = $1 AND path = $2",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value!",
"type_info": "Text"
}
],
"parameters": {
"Left": [
"Text",
"Text"
]
},
"nullable": [
null
]
},
"hash": "40790b7f44b40b0c64bbabd3bc6c984000e12f33bc1cea460e8f5dd55ea59eec"
}
backend/.sqlx/query-2d5ff8fc102ae0c452c1f9cd5cd30fd0a3b4e6e746c659da1767edafd139d45e.json → backend/.sqlx/query-4ff75cdf9ee681cccb4b793704c9d154f36986ee0da73725a40c860037b63310.json
Generated
+5 -5
View File
@@ -1,12 +1,12 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value, is_secret, description\n FROM variable\n WHERE workspace_id = $1 AND path = $2",
"query": "SELECT value::text AS \"value!\", is_secret, description\n FROM variable\n WHERE workspace_id = $1 AND path = $2",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value",
"type_info": "Varchar"
"name": "value!",
"type_info": "Text"
},
{
"ordinal": 1,
@@ -26,10 +26,10 @@
]
},
"nullable": [
false,
null,
false,
false
]
},
"hash": "2d5ff8fc102ae0c452c1f9cd5cd30fd0a3b4e6e746c659da1767edafd139d45e"
"hash": "4ff75cdf9ee681cccb4b793704c9d154f36986ee0da73725a40c860037b63310"
}
backend/.sqlx/query-1587639f13a1a3ad97bd324df38661f3e846f1992704c86ddad74dea151b0ec4.json → backend/.sqlx/query-5d344853a65a2438c87f12124428609933e4363c11455709e1785228abd3366f.json
Generated
+5 -5
View File
@@ -1,12 +1,12 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value, is_secret, path from variable WHERE variable.path = $1 AND variable.workspace_id = $2",
"query": "SELECT value::text AS \"value!\", is_secret, path from variable WHERE variable.path = $1 AND variable.workspace_id = $2",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value",
"type_info": "Varchar"
"name": "value!",
"type_info": "Text"
},
{
"ordinal": 1,
@@ -26,10 +26,10 @@
]
},
"nullable": [
false,
null,
false,
false
]
},
"hash": "1587639f13a1a3ad97bd324df38661f3e846f1992704c86ddad74dea151b0ec4"
"hash": "5d344853a65a2438c87f12124428609933e4363c11455709e1785228abd3366f"
}
backend/.sqlx/query-0c2e53960dc7786c848079b155e62994d4a861f1dbb9752c0a27428d83040e13.json → backend/.sqlx/query-698758d7ef61b3f1de00088a36fe9f2e94c1c25b02bf324a730e4f734eb61c16.json
Generated
+5 -5
View File
@@ -1,12 +1,12 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value, is_secret FROM variable WHERE path = $1",
"query": "SELECT value::text AS \"value!\", is_secret FROM variable WHERE path = $1",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value",
"type_info": "Varchar"
"name": "value!",
"type_info": "Text"
},
{
"ordinal": 1,
@@ -20,9 +20,9 @@
]
},
"nullable": [
false,
null,
false
]
},
"hash": "0c2e53960dc7786c848079b155e62994d4a861f1dbb9752c0a27428d83040e13"
"hash": "698758d7ef61b3f1de00088a36fe9f2e94c1c25b02bf324a730e4f734eb61c16"
}
backend/.sqlx/query-61f3627cbd2a50b745c4e491ed8ee71e58db22b7f53202c5360a01c92091fc08.json → backend/.sqlx/query-a0f799d0211f0a7bd649747a6627b82cd0127581ad831089231317af587bb25a.json
Generated
+5 -5
View File
@@ -1,12 +1,12 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value, is_secret\n FROM variable\n WHERE path = $1 AND workspace_id = $2",
"query": "SELECT value::text AS \"value!\", is_secret\n FROM variable\n WHERE path = $1 AND workspace_id = $2",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value",
"type_info": "Varchar"
"name": "value!",
"type_info": "Text"
},
{
"ordinal": 1,
@@ -21,9 +21,9 @@
]
},
"nullable": [
false,
null,
false
]
},
"hash": "61f3627cbd2a50b745c4e491ed8ee71e58db22b7f53202c5360a01c92091fc08"
"hash": "a0f799d0211f0a7bd649747a6627b82cd0127581ad831089231317af587bb25a"
}
backend/.sqlx/query-a4badf66d2ae524d15925869c9bfa6b590cb357e19233318d2a2a31555dbc515.json
Generated
+23
View File
@@ -0,0 +1,23 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value::text AS \"value!\" FROM variable WHERE path = $1 AND workspace_id = $2 AND is_secret = true",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value!",
"type_info": "Text"
}
],
"parameters": {
"Left": [
"Text",
"Text"
]
},
"nullable": [
null
]
},
"hash": "a4badf66d2ae524d15925869c9bfa6b590cb357e19233318d2a2a31555dbc515"
}
backend/.sqlx/query-44a12919fb154055f1142cc078ef131f8a0c9cdb37cfba6283a6718480b02a4b.json → backend/.sqlx/query-b2c35e00474b8fa335d9485c1f98018dc033582642988ed7a3181989fef72fed.json
Generated
+5 -5
View File
@@ -1,12 +1,12 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value, is_secret, expires_at FROM variable WHERE path = $1",
"query": "SELECT value::text AS \"value!\", is_secret, expires_at FROM variable WHERE path = $1",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value",
"type_info": "Varchar"
"name": "value!",
"type_info": "Text"
},
{
"ordinal": 1,
@@ -25,10 +25,10 @@
]
},
"nullable": [
false,
null,
false,
true
]
},
"hash": "44a12919fb154055f1142cc078ef131f8a0c9cdb37cfba6283a6718480b02a4b"
"hash": "b2c35e00474b8fa335d9485c1f98018dc033582642988ed7a3181989fef72fed"
}
backend/.sqlx/query-ade0696ec69bec2258d2e3ff86bfba6ed3b1d573c298f9d7fe8056ba7e32ed81.json → backend/.sqlx/query-bc004ad060664cc75fc000229af16538576b978a1083365b5a98fc4ca7ea9576.json
Generated
+5 -5
View File
@@ -1,6 +1,6 @@
{
"db_name": "PostgreSQL",
"query": "SELECT workspace_id, path, value FROM variable WHERE is_secret = true AND value IS NOT NULL AND value != ''",
"query": "SELECT workspace_id, path, value::text AS \"value!\" FROM variable WHERE is_secret = true AND value IS NOT NULL AND value != ''",
"describe": {
"columns": [
{
@@ -15,8 +15,8 @@
},
{
"ordinal": 2,
"name": "value",
"type_info": "Varchar"
"name": "value!",
"type_info": "Text"
}
],
"parameters": {
@@ -25,8 +25,8 @@
"nullable": [
false,
false,
false
null
]
},
"hash": "ade0696ec69bec2258d2e3ff86bfba6ed3b1d573c298f9d7fe8056ba7e32ed81"
"hash": "bc004ad060664cc75fc000229af16538576b978a1083365b5a98fc4ca7ea9576"
}
backend/.sqlx/query-bda9fc0c6e41d8afebee538e6997c6bad7843f93d0a5780632b02fa215aa404b.json
Generated
-29
View File
@@ -1,29 +0,0 @@
{
"db_name": "PostgreSQL",
"query": "SELECT path, value FROM variable\n WHERE path LIKE ('u/' || $1 || '/%')\n AND workspace_id = $2\n AND is_secret = true\n AND (value LIKE '$vault:%' OR value LIKE '$azure_kv:%')",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "path",
"type_info": "Varchar"
},
{
"ordinal": 1,
"name": "value",
"type_info": "Varchar"
}
],
"parameters": {
"Left": [
"Text",
"Text"
]
},
"nullable": [
false,
false
]
},
"hash": "bda9fc0c6e41d8afebee538e6997c6bad7843f93d0a5780632b02fa215aa404b"
}
backend/.sqlx/query-c0aff25f0cc3b71842b0ba9ae55b6bc5eca203bf02f46164db08580d128b860a.json
Generated
-29
View File
@@ -1,29 +0,0 @@
{
"db_name": "PostgreSQL",
"query": "SELECT value, account FROM variable WHERE workspace_id = $1 AND path = $2",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "value",
"type_info": "Varchar"
},
{
"ordinal": 1,
"name": "account",
"type_info": "Int4"
}
],
"parameters": {
"Left": [
"Text",
"Text"
]
},
"nullable": [
false,
true
]
},
"hash": "c0aff25f0cc3b71842b0ba9ae55b6bc5eca203bf02f46164db08580d128b860a"
}
backend/.sqlx/query-dec3b1a5a743bfcee0c6a1efdfc7398c1c11277e968af4acb9393ba2b340dd1e.json
Generated
+29
View File
@@ -0,0 +1,29 @@
{
"db_name": "PostgreSQL",
"query": "SELECT path, value::text AS \"value!\" FROM variable\n WHERE path LIKE ('u/' || $1 || '/%')\n AND workspace_id = $2\n AND is_secret = true\n AND (value LIKE '$vault:%' OR value LIKE '$azure_kv:%')",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "path",
"type_info": "Varchar"
},
{
"ordinal": 1,
"name": "value!",
"type_info": "Text"
}
],
"parameters": {
"Left": [
"Text",
"Text"
]
},
"nullable": [
false,
null
]
},
"hash": "dec3b1a5a743bfcee0c6a1efdfc7398c1c11277e968af4acb9393ba2b340dd1e"
}
backend/ee-repo-ref.txt
+1 -1
View File
@@ -1 +1 @@
6858e4cbd515b52713afea8dc32b23072af2248c
16858ac4cf7326ed3d5a6fae1a97fcade5a97af7
backend/windmill-api-workspaces/src/datatable_clone.rs
+1 -1
View File
@@ -104,7 +104,7 @@ pub(crate) async fn connection_snapshot(
continue;
}
let row: Option<(String, bool)> = sqlx::query_as(
"SELECT value, is_secret FROM variable WHERE workspace_id = $1 AND path = $2",
"SELECT value::text, is_secret FROM variable WHERE workspace_id = $1 AND path = $2",
)
.bind(w_id)
.bind(var)
backend/windmill-api-workspaces/src/workspaces.rs
+3 -3
View File
@@ -6524,7 +6524,7 @@ async fn set_encryption_key(
);
let all_variables = sqlx::query!(
"SELECT path, value, is_secret FROM variable WHERE workspace_id = $1",
"SELECT path, value::text AS \"value!\", is_secret FROM variable WHERE workspace_id = $1",
w_id
)
.fetch_all(&mut *tx)
@@ -14503,7 +14503,7 @@ async fn compare_two_variables(
// Get variable from each workspace
let source_variable = sqlx::query!(
"SELECT value, is_secret, description
"SELECT value::text AS \"value!\", is_secret, description
FROM variable
WHERE workspace_id = $1 AND path = $2",
source_workspace_id,
@@ -14513,7 +14513,7 @@ async fn compare_two_variables(
.await?;
let target_variable = sqlx::query!(
"SELECT value, is_secret, description
"SELECT value::text AS \"value!\", is_secret, description
FROM variable
WHERE workspace_id = $1 AND path = $2",
fork_workspace_id,
backend/windmill-api/src/offboarding.rs
+1 -1
View File
@@ -1075,7 +1075,7 @@ async fn offboard_user_from_workspace<'c>(
let new_var_prefix = format!("{}/", reassign_to);
let vault_secrets: Vec<(String, String)> = sqlx::query!(
r#"SELECT path, value FROM variable
r#"SELECT path, value::text AS "value!" FROM variable
WHERE path LIKE ('u/' || $1 || '/%')
AND workspace_id = $2
AND is_secret = true
backend/windmill-api/src/users.rs
+1 -1
View File
@@ -632,7 +632,7 @@ async fn update_username_in_workpsace<'c>(
// Fetch all externally-stored secret variables under this user's path
let vault_secrets: Vec<(String, String)> = sqlx::query!(
r#"SELECT path, value FROM variable
r#"SELECT path, value::text AS "value!" FROM variable
WHERE path LIKE ('u/' || $1 || '/%')
AND workspace_id = $2
AND is_secret = true
backend/windmill-api/src/workspaces_export.rs
+2 -2
View File
@@ -972,9 +972,9 @@ pub(crate) async fn tarball_workspace(
// would never match the variable it created and every sync would report it changed.
let variables =
sqlx::query_as::<_, ExportableListableVariable>(if !skip_secrets.unwrap_or(false) {
"SELECT workspace_id, path, value, is_secret, description, extra_perms, NULL::int AS account, is_oauth, expires_at, labels FROM variable WHERE workspace_id = $1 AND expires_at IS NULL"
"SELECT workspace_id, path, value::text AS value, is_secret, description, extra_perms, NULL::int AS account, is_oauth, expires_at, labels FROM variable WHERE workspace_id = $1 AND expires_at IS NULL"
} else {
"SELECT workspace_id, path, value, is_secret, description, extra_perms, NULL::int AS account, is_oauth, expires_at, labels FROM variable WHERE workspace_id = $1 AND is_secret = false AND expires_at IS NULL"
"SELECT workspace_id, path, value::text AS value, is_secret, description, extra_perms, NULL::int AS account, is_oauth, expires_at, labels FROM variable WHERE workspace_id = $1 AND is_secret = false AND expires_at IS NULL"
})
.bind(&w_id)
.fetch_all(&mut *tx)
backend/windmill-common/src/min_version.rs
+6 -2
View File
@@ -27,9 +27,13 @@ pub const MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES: VC = vc(1, 822, 0, "Restricted
// stored secret variables. Reading it ships one release earlier (1.831), so a rollback to
// that release still reads every secret; below it, secrets written after the switch stay
// unreadable until rolled forward. Only worker versions are seen here, not servers.
// Also gates widening `variable.value`, which needs every process to retire the connections
// the widening poisons (`db::retire_connections_opened_before_now`): that also ships in 1.832.
pub const MIN_VERSION_SUPPORTS_AEAD_SECRETS: VC = vc(1, 832, 0, "AES-GCM secret encryption");
// Gates widening `variable.value`. Every query returning that column casts it to text from
// this release, so the widening changes no result type: before it, each statement prepared on
// the column fails once per connection, and behind PgBouncer until its server connection
// closes. Must name the release this ships in.
pub const MIN_VERSION_SUPPORTS_VARIABLE_VALUE_WIDENING: VC =
vc(1, 848, 0, "variable.value widening");
// A renewed license key replaces the one every process reads, and a worker that predates
// Ed25519 support rejects an Ed25519-signed key and stops pulling jobs, so renewal only offers
// to accept one once this is met. Only worker versions are seen here, not servers. Must name
backend/windmill-common/src/secret_backend/database.rs
+1 -1
View File
@@ -39,7 +39,7 @@ impl DatabaseBackend {
impl SecretBackend for DatabaseBackend {
async fn get_secret(&self, workspace_id: &str, path: &str) -> Result<String> {
let variable = sqlx::query!(
"SELECT value FROM variable WHERE path = $1 AND workspace_id = $2 AND is_secret = true",
"SELECT value::text AS \"value!\" FROM variable WHERE path = $1 AND workspace_id = $2 AND is_secret = true",
path,
workspace_id
)
backend/windmill-common/src/variables.rs
+9 -8
View File
@@ -451,7 +451,7 @@ pub async fn get_secret_value_as_admin(
path: &str,
) -> crate::error::Result<String> {
let variable_o = sqlx::query!(
"SELECT value, is_secret, path from variable WHERE variable.path = $1 AND variable.workspace_id = $2", path, w_id
"SELECT value::text AS \"value!\", is_secret, path from variable WHERE variable.path = $1 AND variable.workspace_id = $2", path, w_id
)
.fetch_optional(db)
.await?;
@@ -542,9 +542,8 @@ pub fn variable_value_widen_pending() -> bool {
/// Widen `variable.value` to [`VARIABLE_VALUE_WIDTH`], or `false` when it is too early to.
/// Not a migration: changing a column's type, even its length, fails every statement a live
/// process prepared on it until its connection closes. It waits for v2 writes, gated on a
/// worker version that retires such connections on the first failure, so that no process too
/// old to recover is still running.
/// process prepared on it until its connection closes. It waits until no process returns the
/// column uncast. Any new query returning `variable.value` must select `value::text`.
async fn widen_variable_value(db: &DB) -> error::Result<bool> {
if VARIABLE_VALUE_WIDENED.load(Ordering::Relaxed) {
return Ok(true);
@@ -556,7 +555,9 @@ async fn widen_variable_value(db: &DB) -> error::Result<bool> {
.fetch_one(db)
.await?;
if typmod >= 0 && typmod - 4 < VARIABLE_VALUE_WIDTH {
if crate::db::process_uptime() < crate::db::PREVIOUS_RELEASE_ROLLOUT_UPTIME {
if !crate::min_version::MIN_VERSION_SUPPORTS_VARIABLE_VALUE_WIDENING.met_conservatively()
|| crate::db::process_uptime() < crate::db::PREVIOUS_RELEASE_ROLLOUT_UPTIME
{
return Ok(false);
}
tracing::info!("widening variable.value to VARCHAR({VARIABLE_VALUE_WIDTH})");
@@ -669,7 +670,7 @@ async fn upgrade_workspace_secret_variables(db: &DB, w_id: &str) -> error::Resul
};
let mc = crypt_from_key_with_suffix(&key, "");
let rows: Vec<(String, String)> = sqlx::query_as(
"SELECT path, value FROM variable WHERE workspace_id = $1 AND is_secret AND path > $2 \
"SELECT path, value::text FROM variable WHERE workspace_id = $1 AND is_secret AND path > $2 \
ORDER BY path LIMIT $3",
)
.bind(w_id)
@@ -1009,7 +1010,7 @@ pub async fn get_variable_or_self(
let path = path.strip_prefix("$var:").unwrap().to_string();
let record = sqlx::query!(
"SELECT value, is_secret
"SELECT value::text AS \"value!\", is_secret
FROM variable
WHERE path = $1 AND workspace_id = $2",
&path,
@@ -1057,7 +1058,7 @@ pub async fn get_variable_or_self_as<T: Authable + Sync>(
// Use an RLS-scoped transaction so the query respects row-level security
let mut tx = user_db.clone().begin(authed).await?;
let record = sqlx::query!(
"SELECT value, is_secret
"SELECT value::text AS \"value!\", is_secret
FROM variable
WHERE path = $1 AND workspace_id = $2",
&var_path,
backend/windmill-common/src/workspaces.rs
+1 -1
View File
@@ -3805,7 +3805,7 @@ async fn transform_json_unchecked(
serde_json::Value::String(s) if s.starts_with("$var:") => {
let path = &s[5..];
let (value, is_secret): (String, bool) = sqlx::query_as(
"SELECT value, is_secret FROM variable WHERE workspace_id = $1 AND path = $2",
"SELECT value::text, is_secret FROM variable WHERE workspace_id = $1 AND path = $2",
)
.bind(&w_id)
.bind(path)
backend/windmill-native-triggers/src/lib.rs
+1 -1
View File
@@ -815,7 +815,7 @@ pub async fn decrypt_oauth_data<T: DeserializeOwned>(
let mc = build_crypt(db, workspace_id).await?;
let row = sqlx::query!(
"SELECT v.value, a.id AS account_id, a.refresh_token
"SELECT v.value::text AS \"value!\", a.id AS account_id, a.refresh_token
FROM variable v
JOIN account a ON a.workspace_id = v.workspace_id AND a.id = v.account
WHERE v.workspace_id = $1 AND v.path = $2
backend/windmill-store/src/oauth_refresh_oss.rs
+1 -1
View File
@@ -182,7 +182,7 @@ where
async fn current_token(db: &DB, w_id: &str, path: &str) -> error::Result<String> {
let value = sqlx::query_scalar!(
"SELECT value FROM variable WHERE workspace_id = $1 AND path = $2",
"SELECT value::text AS \"value!\" FROM variable WHERE workspace_id = $1 AND path = $2",
w_id,
path
)
backend/windmill-store/src/resources.rs
+1 -1
View File
@@ -2189,7 +2189,7 @@ async fn update_resource(
// Handle Vault secret rename if the linked variable is a Vault-stored secret
let linked_var = sqlx::query!(
"SELECT value, is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
"SELECT value::text AS \"value!\", is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
path,
w_id
)
backend/windmill-store/src/variables.rs
+3 -3
View File
@@ -337,7 +337,7 @@ async fn get_variable(
let mut tx = user_db.begin(&authed).await?;
let variable_o = sqlx::query_as::<_, ListableVariable>(
"SELECT variable.workspace_id, variable.path, variable.value, variable.is_secret,
"SELECT variable.workspace_id, variable.path, variable.value::text AS value, variable.is_secret,
variable.description, variable.extra_perms, variable.account, variable.is_oauth,
variable.expires_at, variable.labels,
folder_labels(variable.workspace_id, variable.path) as inherited_labels,
@@ -1243,7 +1243,7 @@ async fn update_variable(
// Handle Vault secret rename if the variable is a secret stored in Vault
let current_var = sqlx::query!(
"SELECT value, is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
"SELECT value::text AS \"value!\", is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
path,
w_id
)
@@ -1537,7 +1537,7 @@ pub async fn get_value_internal<'a>(
let mut tx = db_with_opt_authed.begin().await?;
let variable_o = sqlx::query!(
"SELECT value, account, (now() > account.expires_at) as is_expired, is_secret, path from variable
"SELECT value::text AS \"value!\", account, (now() > account.expires_at) as is_expired, is_secret, path from variable
LEFT JOIN account ON variable.account = account.id WHERE variable.path = $1 AND variable.workspace_id = $2", path, w_id
)
.fetch_optional(&mut *tx)