starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-13 08:02:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(frontend): scope the handler identity notice to the chosen destination

Browse Source 
The notice told every admin to grant g/variable_expiration_handler write access
to the variables it rotates. That is right for a custom handler and wrong for
the built-ins, which only post a message and are granted the Slack bot token by
migration. Following it for a Slack handler would hand a group write access to
the workspace's secrets for no reason.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
This commit is contained in:
AlexRV12
2026-09-03 19:00:03 +02:00
co-authored by Claude Opus 5
parent a6a4b18240
commit fd97de7226
1 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
+15 -5
View File
@@ -2199,11 +2199,21 @@ export async function main(
</SettingCard>
<Alert type="info" title="Runs as g/variable_expiration_handler">
The handler is executed by the automatically created group
g/variable_expiration_handler. Rotating a variable means writing to it, so grant
that group write access to the variables it is meant to rotate. It starts with
none. A script that carries an on-behalf-of identity is the exception: it runs
as that user, with their permissions rather than the group's.
{#if variableExpirationSelected === 'custom'}
The handler is executed by the automatically created group
g/variable_expiration_handler. Rotating a variable means writing to it, so
grant that group write access to the variables it is meant to rotate. It
starts with none. A script that carries an on-behalf-of identity is the
exception: it runs as that user, with their permissions rather than the
group's.
{:else}
The handler is executed by the automatically created group
g/variable_expiration_handler. It only posts a message, so it needs no access
to your variables: it is given the path and the expiry date, never the value.
{#if variableExpirationSelected === 'slack'}
Access to the Slack bot token is granted for you.
{/if}
{/if}
</Alert>
</div>