* fix: scope a fork's cloned app policy and custom path to its creator
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: gate a cloned anonymous app on the parent's own deployment rule
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: state why a cloned anonymous app is gated more strictly than create_app
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* style: wrap an over-long comment line in clone_apps
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: clone an app's execution_mode unchanged
Forcing `publisher` on a cloned app was a speed bump rather than a boundary:
protection rules are workspace-scoped and are not cloned, so the fork's creator
can publish an anonymous app there with no rule in the way. It was also the one
policy field a deploy back to the parent carries verbatim, since `update_app`
recomputes the identity but writes the policy wholesale, so a fork's copy could
silently close the parent's public endpoint.
The identity rewrite is what closes the hole this addresses: the fork's endpoint
no longer runs as whoever the parent published it as.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: ignore an app's run-as identity when comparing workspaces
`compare_two_apps` hashed the whole policy, so a fork whose apps were re-pointed
at their creator reported every one of them as changed. Nothing could clear those
entries: the deploy offers the target's current identity, the deployer's, or a
typed-in one, never the source's, so the difference survives however many times
the item is deployed. `script` and `flow` already compare no identity.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: scope cloned app policy and custom path to the fork's creator
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: share the app custom-path scoping rule across its call sites
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: tighten the cloned-app-policy comments
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: correct the execution_mode and custom-path scoping rationale
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: make on_behalf_of control permissions for scripts and flows
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: inherit the recorded on-behalf-of identity when a preserving deploy omits it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep an omitted permissioned_as from re-versioning an unchanged script
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: derive the on-behalf-of principal from the email and reject mismatched pairs
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop workspace deploys from carrying a source-workspace principal
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: correct the onBehalfOfPermissionedAs param doc
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: pin that workspace deploys never carry a source-workspace principal
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: correct the omitted-principal contract and refresh generated prompts
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep external-superadmin principals on email-only redeploys
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: scope the recorded principal to its workspace and prefer real accounts
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: carry the recorded principal correctly through drafts and set-permissioned-as
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: sweep draft identity pairs on email change and offboarding
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: leave group identities alone when sweeping a user's email
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: treat only g/ without an email as a group, and match the offboard preview
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop the group guard from skipping rows with no recorded principal
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: state the group guard once instead of restating it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: make the permissioned_as the only stored on-behalf-of identity
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* perf: skip resolving the on-behalf-of address for sync clients that discard it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address the local review of the identity refactor
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: resolve the on-behalf-of identity coherently across clones, offboarding and no-op deploys
* test: pin that a fork keeps only the on-behalf-of identities that resolve in it
* fix: decide a principal prefix-first everywhere and canonicalize bare addresses
* fix: prefix a slash-containing address so a reader cannot take it for a group
* fix: read an address as a username before the group- convention
* fix: rewrite the canonical principal when an account's address moves
* fix: keep the address form of a principal to accounts without a usr row
* fix: reject an identity a job row cannot carry and read it uncached at dispatch
* fix: count characters against the job identity width and cap the backfill
* refactor: name the script/flow principal on_behalf_of, as apps do
* docs: state the caller-must-authorize contract on the identity resolvers
* fix: keep writing on_behalf_of_email until every worker reads the principal
* fix: err high on the compatibility version and document the last resolver
* fix: keep the compatibility address current through identity mutations
* fix: carry the compatibility address with the principal on every copy path
* chore: re-pin the EE ref to the companion branch merged with EE main
* fix: key the dbt retry lookup on the stored principal
* fix: keep a mixed-version address recoverable through a fork
* fix: read a round-tripped address uncached so a redeploy is not rejected
* fix: refuse an email change that would make a principal unenqueueable
* chore: update ee-repo-ref to ac3d7d015296f041ae44ab6bc4953485f44d36e4
This commit updates the EE repository reference after PR #704 was merged in windmill-ee-private.
Previous ee-repo-ref: 219b0b03905a1a0028054b3a4985724e77d09036
New ee-repo-ref: ac3d7d015296f041ae44ab6bc4953485f44d36e4
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
hugocasaandClaude Opus 5
