* upgrade duckdb
* basic ducklake works
* ducklake works with custom db catalogs
* fix: pwsh skip already installed modules outside of cache (#6037)
* improve query performance of user stats
* separate ducklake_catalog db
* ducklake settings
* DucklakeSettings frontend
* Ducklake ws settings saved in backend
* fetch ducklake catalog resource
* Ducklake works with configured s3 storage
* Ducklake as asset
* ducklake asset icon
* Fix duckdb array and object args not working properly (#6254)
* Fix bug with comments in duckdb
* Avoid multiple queries when doing ATTACH ducklake
* trunc sig no longer needed now that comments are trimmed
* cache DuckdbConnectionSettingsResponse
* duplicated code
* transform_attach_ducklake contributes to duckdb_connection_settings_cache
* eliminate the need for used_storages
* nit
* cleaner management of the bigquery credentials file
* DBManagerDrawer refactor to prepare for Ducklake
* get ducklake schema
* implement delete for ducklake
* load column metadata for ducklake
* Select query works for ducklake, basic db explorer works !
* duckdb count query
* Support all db ops for ducklake
* clean migrations
* SQL repl for Ducklake
* fix broken database studio
* nit
* assert function
* Ducklake in Editor Bar
* default ducklake syntax + allow extra args
* DucklakeCatalogWizard UI
* nit + remove extra $
* modal when databases do not exist
* cannot be windmill
* Ducklake works safely with instance database
* Avoid sending instance db credentials on network
* resource leak security
* remove fetch_attach_db_conn_str
* prevent instance pg password leak
* hide asset usage count when not available
* case unsensitivity duckdb
* warnings
* disable instance catalog
* use shorthand syntax when inserting with EditorBar
* Instance ducklake catalog is now safe to use
* use safer argon2 pwd
* update package json parsers
* update package json
* better msgs
* tooltips
* disable explore button until saved
* nit
* fix warnings
* better ducklake_user password management
* nit
* Sanitize passwords from errors in ducklake
* DisplayResult broken in job result
* remove superadmin requirement to check databases_exist
* duckdb_connection_settings_v2_inner
* Ducklake works on agent worker (finally)
* ci
* #[allow(dead_code)]
* fix openapi missing response
* Separate +Database button for DuckDB in EditorBar
* Fix dropdown in ducklake settings
* Attempt to fix migration race condition in CI
* update sqlx failing for some offline queries
* avoid temp password for ducklake_user
* nits
* ducklake settings nits
* update duckdb default script
* fix sql repl resetting text on refresh
* avoid pgcrypto extension
---------
Co-authored-by: HugoCasa <hugo@casademont.ch>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* add base struct
* feat resolve interface and type declarion in entrypoint param's function
* nits
* fix reset dependencies
* update package
* fix handle infinite recursion
* add depth level and handle enum for referenced type
* nits
* nits
* nits
* perf
* fix
* done
* fix schema form cache inconsistency
* fix default type and nits
* remove
* update Object typ for parser
* one level ref from from parent when resolving types and use format for resource
* update cli and use resource type
* nits
* update parsers
* fix: use specific parser versions
---------
Co-authored-by: HugoCasa <hugo@casademont.ch>
* Moved logic to FlowAssetsProvider
* Remove assetsMap in flow
* do not parse everything on mount + only check for missing assets fields
* add assets field in backend
* remove fallbackAccessTypes
* better structure and less queries / parsing
* Fix assets not showing when pulling raw_flow from jobs
* flow assets ctx for job run
* Fix transitive assets fetching
* Fix input args asset node
* enablePathScriptAndFlowAssets flag
* edit btn for variable
* untrack refresh
* move parseInputArgsAssets
* Assets tab in runs
* Update FlowStatusViewerInner to svelte 5 + fix asset sync bug
* avoid toast error on bad resource
* fetch res metadata for input arg asset
* Job assets viewer in run page
* r/w selector
* remove indigo badge
* store alt_access_type state in ScriptEditor
* Don't parse assets in flow script editor
* Add alt_access_type in backend
* show Read as selected by default to avoid giving the feeling of having made a decision
* keep alt_access_type when reparsing in flow raw scripts
* Remove variable asset kind, and save assets for scripts
* remove all backend asset parsing
* R/W/RW selector button nits
* fix insert into assets not saving alt access type
* support named arguments in python asset parser
* improve asset usage drawer R/W indicator
* update legacy $res: syntax
* reactivity issue
* remove last variable asset stuff
* sqlx prepare
* tooltip explainer
* deprecated variable asset nit
* assets migration
* parse assets (duckdb)
* iterate on assets
* S3 object Preview
* remove pagination
* filterText
* better occurence list
* tweak
* assets in JobPreview
* clone impl
* AssetsDetectedBadge
* improve DbManagerButton + asset dropdown button
* edit resource btn
* warning when incorrect resource
* +Resource in DuckDB
* +S3 Object editor bar
* nit fix rename
* flow asset badge
* More Generic OnChange
* Highlight assets used in modules
* Show occurence count in flow
* Better UX, avoid moving parts
* nit
* Asset nodes
* move to dedicated Asset ctx
* fix layoutNodes not handling first assetsMap
* explore asset btn in flow asset node
* correct offset
* single computeAssetNodes function
* Fix y positioning of nodes with assets
* resource editor
* write mode node (ui)
* accessType in ctx + fix insert button positioning
* right positioning when mixing read and write nodes
* right positioning when mixing R and W assets
* Better layout fix algorithm
* listAssetsByUsage and asset nodes on transitive usages
* refactor + remove linkAssets
* Refactor to allow for custom R/W modes
* AssetsDropdownButton in flow script editor
* R/W/RW selection and changes node pos in flow
* layoutNodes doesnt need recompute now
* fix wrong assumption that nodes recompute when assets change
* r/w/rw multi toggle
* MultiToggle cool animation + clearable
* rename + 1px nit
* remove mini toggle button group, use ToggleButtonGroup
* Combinator parser that detects R / W asset context
* nit fix missing flex-1
* missing order by
* better ui indication for access type
* special x offset case when only one asset node for clarity
* parse getResource in TS with swc ecma parser
* support load and write s3 detection in TS
* Python asset parser
* support wmill api calls without special $res: or s3:// syntax
* detect out of context asset uris python
* do not use access type override when not ambiguous in flow graph
* parse_assets match case in rust
* AsRef<str> refactor
* From impl
* Save flow assets
* Save script asset usages + fixes + save fallback access types
* asset sub icon
* max total asset node width to avoid overlap
* small refactor
* don't parse comments in duckdb assets
* fix assets clearing on parse error
* fix script asset save in wrong place
* load initial asset fallback access types
* support variables
* ui fixes
* Support S3Object as URI in TS client
* support new syntax in python client
* Support +S3Object in EditorBar for TS and python
* Reduce resource requests in assets page
* import windmill client when necessary
* update s3Types.d.ts
* nit fix
* Show input resources and s3 objects as assets
* improve asset icons
* DarkModeObserver refactor
* asset page tabs
* Moved resource variables and s3object pages to assets tabs
* fetch resource usages
* Get variables usages
* move assets usage dropdown to component
* Revert "move assets usage dropdown to component"
This reverts commit 622ea4ab12.
* Revert "Get variables usages"
This reverts commit b11ced4e29.
* Revert "fetch resource usages"
This reverts commit aa5187ad4b.
* Revert "Moved resource variables and s3object pages to assets tabs"
This reverts commit 4430487be4.
* Revert "asset page tabs"
This reverts commit dacc2f0da5.
* move assets usage dropdown to component
* asset icon in asset pages
* tooltip
* details
* Storage selector in S3 File Picker
* make edge less opaque
* Refactor computeAssetNodes to separate in and out nodes
* AssetsOverflowedNode
* nits
* fix assets not being parsed in flows sometimes
* show asset kind and resource_type
* ui nits
* support res:// in duckdb
* add banner for old deployments
* Fix permissionning
* fix broken disable /enable all
* assets page view permission for operators
* Disable ExploreAssetButton for operators
* asset kind as subtitle
* do not spam getResource in assets page. prob. revert fail
* update assets page on workspace change
* reload storage names on ws change
* delete assets on archive / deletion
* sqlx prepare
* missing update when updating user
* add indexes on asset
* better message
* missing loadInit: false
* dead code
* use transaction
* typo
* update package.json
* update package.json
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: allow change_workspace_id on CLOUD_HOSTED for superadmins
- Import is_super_admin_email function from windmill_common::auth
- Modify CLOUD_HOSTED restriction to bypass for superadmin users
- Resolves request to allow workspace ID changes for superadmins only
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* feat: allow superadmins to change workspace ID on cloud hosted environments
Update frontend conditional logic to show workspace ID change button for superadmins on cloud hosted environments. This complements the backend changes that already allow superadmins to perform the workspace ID change operation.
Changes:
- Add superadmin import from $lib/stores
- Update condition from `!isCloudHosted()` to `!isCloudHosted() || $superadmin`
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* feat: add optional CSP headers when ENABLE_CSP_HEADERS is set
- Add middleware to conditionally set Content-Security-Policy headers
- Check for ENABLE_CSP_HEADERS environment variable
- Apply secure default CSP policy suitable for web applications
- Follows existing middleware patterns in codebase
Resolves#6031🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* perf: optimize CSP headers with lazy_static and add configurability
- Cache CSP_ENABLED and CSP_POLICY using lazy_static to avoid env var lookups on every request
- Add comprehensive documentation to add_csp_headers middleware function
- Make CSP policy configurable via CSP_POLICY environment variable
- Maintain backward compatibility with secure default policy
- Implement proper error handling for custom CSP policy values
Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>
* refactor: conditionally add CSP middleware layer instead of NO-OP
- Use .option_layer() to only add CSP middleware when ENABLE_CSP_HEADERS is set
- Remove runtime conditional check from add_csp_headers function
- Improve performance by avoiding unnecessary middleware execution when disabled
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* refactor: conditionally add CSP middleware layer instead of NO-OP
Remove CSP_ENABLED variable and instead check if CSP_POLICY is not empty.
This eliminates the need for a separate enable flag and simplifies the logic
to just check if a meaningful CSP policy is configured.
- Remove CSP_ENABLED lazy_static variable
- Simplify CSP_POLICY to use unwrap_or_default()
- Update conditional middleware logic to check !CSP_POLICY.is_empty()
- Update documentation to reflect new behavior
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* refactor: conditionally add CSP middleware layer instead of NO-OP
Move CSP headers from general middleware stack to static assets only.
CSP headers are only relevant for browsers consuming static content,
not for API endpoints.
Changes:
- Add CSP headers directly to static asset responses in serve_path()
- Remove CSP middleware from general middleware stack
- Remove unused add_csp_headers middleware function
- Maintain same CSP_POLICY environment variable configuration
Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>
* fix: conditionally compile CSP header imports with static_frontend feature
Fixes unused import errors by wrapping HeaderValue and CSP_POLICY imports
with #[cfg(feature = "static_frontend")] to match their usage context.
Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>
* refactor: move CSP lazy static block to static_assets.rs
- Move CSP_POLICY lazy static from lib.rs to static_assets.rs for better encapsulation
- Remove crate-level import since CSP_POLICY is now local to static_assets module
- Maintain same functionality with proper feature gating for static_frontend
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>
* nit(mcp): filter out scripts without main function from tools list
- Add no_main_func field to ScriptInfo struct
- Update SQL query to select no_main_func from database
- Filter scripts where no_main_func is true in list_tools function
- Hub scripts remain unaffected as requested
Resolves#6021
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* perf(mcp): optimize script filtering with SQL WHERE clause
Move the no_main_func filtering from Rust code to SQL WHERE clause for better performance:
- Add conditional WHERE clause in inner_get_items for scripts only
- Remove Rust-level filtering loop in list_tools function
- Reduces data transfer and improves query performance by filtering at database level
- Handles NULL values properly with (o.no_main_func IS NOT TRUE OR o.no_main_func IS NULL)
Co-authored-by: centdix <centdix@users.noreply.github.com>
* fix
* refactor(mcp): optimize filtering by removing no_main_func field selection
Remove no_main_func field from ScriptInfo struct and SQL selection while keeping WHERE clause filtering. This improves performance by filtering at the database level without transferring unnecessary data to the application layer.
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
Co-authored-by: centdix <centdix@users.noreply.github.com>
Co-authored-by: centdix <farhadg110@gmail.com>
* feat: allow devOps role to edit worker groups config
- Updated backend permission checks in configs.rs to use require_devops_role() instead of require_super_admin()
- Updated frontend UI in workers page to show worker group management for devOps users
- Updated WorkerGroup component to allow devOps role access to all configuration features
- Updated AssignableTagsInner component to allow devOps users to manage tags
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* Update configs.rs
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
claude[bot]
Diego Imbert
dieriba
Alexander Petric
Ruben Fiszel
centdix
iqdecay
pyranota
HugoCasa
wendrul
Tom Deckers
Ruben Fiszel