* feat: stamp ui vs webhook trigger_kind on direct job runs
* fix: gate ui trigger kind on min worker version and dedupe display names
* docs: state that the ui trigger kind attributes rather than proves
* refactor: fold the trigger fallback into one trigger_or_fallback helper
* feat: hold trigger_kind as a tolerant label on the worker paths
* chore: refresh the sqlx offline cache for the trigger_kind label queries
* chore: update ee-repo-ref to 7de7daff5eed410e0c815ad6b292d2b4303f02f2
This commit updates the EE repository reference after PR #700 was merged in windmill-ee-private.
Previous ee-repo-ref: 974ab910d9a30c5565e1198ee312acc6d11239f3
New ee-repo-ref: 7de7daff5eed410e0c815ad6b292d2b4303f02f2
Automated by sync-ee-ref workflow.
* fix: keep the API job structs tolerant of unknown trigger kinds too
* chore: point ee-repo-ref at the merged EE main
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: credit the token owner instead of the token label in the audit trail
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address review findings on token-owner audit attribution
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: carry token-label provenance explicitly instead of inferring it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: point ee-repo-ref at the companion branch
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: trust only non-forgeable token labels to name the acting entity
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: reject reserved system-token labels at token creation
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: narrow the token-label guard to server-minted namespaces
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: add the provenance field to the remaining ApiAuthed literals
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop trusting the email- label, which no mint produces
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(postgres-triggers): enforce resource-path scopes on slot/publication routes
The Postgres trigger ancillary routes (slot management, publication
management, version/logical-level checks, template script creation) relied
only on the route-level middleware, which validates the scope domain+action
but delegates resource-path enforcement to each handler. These handlers made
no check_scopes call, so a token scoped to one postgres resource path (e.g.
postgres_triggers:write:u/alice/*) could drive these endpoints against any
postgres resource in the workspace, including the destructive drop_slot_name
(pg_terminate_backend + pg_drop_replication_slot).
Add a check_scopes call at the top of each affected handler, before any
connection is opened, mirroring the generic trigger CRUD handlers. Read
endpoints require postgres_triggers:read:{path}; write endpoints require
postgres_triggers:write:{path}.
Fixes WIN-2213
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: condense postgres_trigger_scope test module comment
Address Codex nit: state the durable constraint (mismatched scope must fail
before DB access) instead of narrating pre-fix behavior and change history.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ruben Fiszel