* feat(alerts): let a workspace fall back to the instance critical alert channels
A workspace with no error handler had no way to surface failed jobs, and the
instance critical alert channels a superadmin already configured (Slack, Teams,
email) were unreachable from a workspace: the workspace Slack error handler
posts with the workspace's own bot token, not the instance one.
Adds an opt-in workspace setting that reports failed jobs to those channels
when, and only when, no workspace error handler is configured. The report is
send-only: it skips the `alerts` table so workspace job failures never flood the
instance-wide feed superadmins triage.
Rejected on cloud (the channels belong to the instance operator, who is not the
tenant) and on fork workspaces (throwaway copies of a parent's runnables).
Settable from workspace settings and from the new-workspace screen.
The opt-in and the existing `mute_critical_alerts` flag are folded into the
query already behind WORKSPACE_ERROR_HANDLER_CACHE, so a failed job costs no
extra round trip, and workspaces with neither a handler nor the opt-in return
before the per-runnable mute lookup.
* chore(sqlx): add offline query cache entries for the new settings queries
* refactor(alerts): make instance alerts a destination tab and address review
Instance alerts are a fifth error-handler destination rather than a separate
toggle: the backend already treats them as mutually exclusive with a handler
script, so one "where do failures go?" control matches the semantics and drops
the inert-while-a-handler-is-set state. The tab is offered on the workspace
error handler only, not on schedules or triggers.
Review fixes:
- the fork boundary is enforced at dispatch (join on parent_workspace_id), so a
workspace attached as a fork/dev after opting in stops reporting; attaching
also clears the stored flag, and the settings page never selects a tab it does
not render, which would have submitted a value the API rejects on a fork
- mute_critical_alerts no longer gates this path: it is the UI-feed mute, and
this path writes no feed entry
- cancellations are not reported: they are a human action, and this destination
has no per-workspace mute of its own
- per-workspace throttle with a rollup count, so a flapping runnable cannot turn
into unbounded Slack/SMTP traffic on channels shared by the whole instance
- log the dispatch, audit the flag, name the columns in the rename INSERT, drop
the generated migration placeholders
* chore(alerts): state the fork/cloud invariant on canUseInstanceAlerts
* chore(sqlx): cache the attach_dev_workspace settings update
* fix(frontend): scope session pipeline trigger editors to the session workspace
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(frontend): hoist triggerWorkspace decl above GCP init-time getBaseUrl call
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(frontend): scope nested trigger pickers to the session workspace
The triggerWorkspace resolver scoped direct trigger CRUD calls to the
session's (forked) workspace, but nested pickers still defaulted to the
nav `$workspaceStore`: in a fork session, resource lists/creation,
variable creation, and path-existence checks ran against the parent
workspace while save/delete targeted the fork — misleading options and
false path-validation failures.
Thread `wsId` into the nested controls of the 9 pipeline-canvas kinds:
- `<Path workspaceOverride={wsId}>` (8 editors) — path + folder checks
- `<ResourcePicker workspace={wsId}>` (6 config sections; add the
resolver to MqttEditorConfigSection, which lacked `wsId`)
- SQS `<VariableEditor workspace={wsId}>` — variable creation
Also drop the per-site `wsId` rationale comment repeated across ~20
files; the invariant is documented once in triggerWorkspace.ts.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(frontend): scope trigger runnable picker to the session workspace
The runnable picker (`ScriptPicker`, reached via `TriggerRunnablePicker`
and directly in the schedule editor) listed scripts/flows/apps from the
nav `$workspaceStore` with no override, so a forked session offered the
parent workspace's runnables when attaching a script/flow to a trigger.
Add an optional `workspace` prop to `ScriptPicker` (defaults to
`$workspaceStore` → no change for existing callers), pass it through
`TriggerRunnablePicker`, and wire `wsId` from the 7 trigger editors that
use it plus the schedule editor's 3 direct pickers.
Completes the nested-picker workspace scoping; the excluded kinds
(azure/http/websocket/native) keep their own ScriptPickers unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(frontend): scope trigger error-handler, folder default, and runnable actions
Follow-up to the trigger-workspace scoping: three subtrees still read the
nav `$workspaceStore` in a forked session.
- ErrorOrRecoveryHandler (via TriggerRetriesAndErrorHandler in the 7 in-scope
editors): add a `workspace` prop (defaults to `$workspaceStore`) and route
handler lookup/schema, Slack/Teams settings, test jobs, and run links
through it, so the error handler is resolved/tested/saved in the session
workspace instead of A while the trigger lives in B.
- useFolderDefaultPermissionedAs: accept an optional workspace getter so a
`f/...` trigger's default permissioned-as is read from the session
workspace, not the nav one (PermissionedAsLine passes `() => wsId`).
- ScriptPicker actions: scope the View drawer (`getScriptByPath`) and
`FlowPathViewer` to `effectiveWorkspace`, and carry `?workspace=` onto the
Edit/View routes when an explicit override is set (the layout consumes the
param, same mechanism as editInFork). The param is only appended when a
workspace override is passed, so existing callers' links are unchanged.
Also consolidate the repeated workspace-scoping comment in
PipelineTriggerEditors (the invariant lives in triggerWorkspace.ts).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(frontend): scope error-handler/schedule nested consumers to the session workspace
Address CI Codex review on #10032 — the error-handler and schedule
subtrees still had nested consumers reading the nav workspace:
- ErrorOrRecoveryHandler: pass the resolved workspace to its own nested
`ScriptPicker` (custom-handler list + View/Edit) and add a `workspace`
prop to `ChannelSelector` (Teams channel listing); carry the acting
workspace onto the "create from template" link.
- ScheduleEditorInner: pass `workspace={wsId}` to the error/recovery/
success `ErrorOrRecoveryHandler` panels, `workspaceId={wsId}` to
`WorkerTagPicker`, and the workspace query param onto the dynamic-skip
template link.
Template-link and picker overrides only diverge from `$workspaceStore`
when a session override is set, so non-session callers are unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: redact GitHub App tokens and Slack OAuth secret for non-admins
`GET /workspaces/get_settings` returned the full `git_app_installations`
JSONB to any workspace member. That column caches the GitHub App JWT and
installation token used by git-sync; the installation token is refreshed
on every git-sync action and valid for ~55 minutes, so the value sitting
in the DB is essentially always live. Null it out for non-admins,
matching the existing `slack_oauth_client_secret` redaction.
The tarball export's v2 settings format (added in #8935) included
`slack_oauth_client_secret` with no admin gating, regressing the same
redaction. Mirror the admin check there.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: split get_settings into admin-only + public endpoint
Adds `WorkspacePublicSettings` and `GET /workspaces/get_public_settings`,
which returns only fields safe for any workspace member to read
(workspace_id, slack/teams team identity, mute_critical_alerts, deploy_ui,
large_file_storage, datatable). `get_settings` is now admin-only via
`require_admin`.
Migrates frontend callers: every caller that read non-sensitive fields
(deploy_ui on trigger pages, mute_critical_alerts on the root layout, slack
team identity for handler pickers, etc.) now uses `getPublicSettings`. The
admin-managed settings UI, git-sync admin context, operator settings,
checkout polling, and full settings page stay on `getSettings`.
This replaces the field-level redactions added in the previous commit:
the type system itself defines the public surface, so adding a sensitive
column to `workspace_settings` no longer defaults to leaking — it stays
out of `WorkspacePublicSettings` unless explicitly added.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Add vertical nav bar to workspace settings
* harmonize settings content titles
* remove sidebar icons
* add background to sidebar
* nit user section
* EEonly display
* Workspace settings general design
* Add schema validation and dirty detection
* Put critical alerts in a separated tab
* separate error success handler
* only enable save when there is some changes
* Fix dirty detection for deployment UI
* Only enable save button when changes for datatables ws storage
* Add setting footer component
* Use new footer setting for saving configs
* nit
* apply setting footer
* improve save button
* nit
* nit
* nit
* make ws app use same pattern as other tabs
* Separate scrolling between sidebar and content
* Gather error handlers
* use universal save button for object storage
* Title sentence case
* nit
* nit
* improve dirty config logic
* nit
* nit
* clean dead code
* Use settings footer for deployment settings
* Git sync settings
* move tabs
* fix dirty stats of error handlers
* nit
* nit
* improve collapsible link
* do not show superadmin ws link when already in it
* improve OAuth UI
* sso/oauth instance settings ui
* refactor instance settings alerts WIP
* Indexer and Oauth to brand guidelines
* refactor ws error handler page
* Create a tab SMTP in the Instance Settings
* Ractivity isssue fix for tabs
* nit
* Add smtp settings status in Error handler
* Add smtp configuration status
* Display teams connection status for instance alerts
* nit
* Add critical alerts description
* nit
* nit
* improve ee display
* nit
* nit
* fix typo
* nit
* restore vit config
---------
Co-authored-by: Alexander Petric <alex@windmill.dev>
* fix: teams, need both guid and thread id format
* chore: update ee-repo-ref to 576abf6519d1aa12a2b989a58a123501206284fb
This commit updates the EE repository reference after PR #368 was merged in windmill-ee-private.
Previous ee-repo-ref: ae41589212f16ff0cec8516c66227f30e17c5564
New ee-repo-ref: 576abf6519d1aa12a2b989a58a123501206284fb
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* move settings and static inputs into top node
* Move test button in the top nodes
* Revert "Move test button in the top nodes"
This reverts commit 1c8648a538.
* Add error handler to top toolbar
* nit
* polishing
* add flow settings to topbar dropdown
* remove unused files
* progress
* progress
* fixes
* fix
* fix
* fix
* fix
---------
Co-authored-by: Ruben Fiszel <ruben@rubenfiszel.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* new select component
* fix search
* arrow keys
* placeholder color not working darkmode
* Popover forceContentToTriggerWidth
* select with popover
* Revert "select with popover"
This reverts commit 61aece9ed0.
* Revert "Popover forceContentToTriggerWidth"
This reverts commit 48c4d16111.
* select fixes
* fix select clipping with portal
* started replacing select components
* nit
* AppSelect upgraded
* no items
* new Selector in Team and Channel selector
* replace Select components
* remove redundant select in ServiceLogsInner
* replaced more selects
* gcp trigger new select component
* fix disablePortal position
* fix broken clear in teams and channel selecrt
* Finish Select component migration
* fix empty entries in select
* open Select above when no space below
* fix sizing on disablePortal
* Select loading feature + fix npm check
* fix text contrast in select dropdown
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Expose base path from $lib/navigation
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow deploying frontend in sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow deploying frontend in sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow deploying frontend in sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow deploying frontend in sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow deploying frontend in sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* update
* update
---------
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: Ruben Fiszel <ruben@rubenfiszel.com>
* Fix schedule path for scheduled scripts
* feat: Add possibility to mute workspace error handler on schedules and define an error/recovery handler as default
* Permission error handlers to the error handler group for consistency, and small refactoring
* Fix recovery handler
* Add parent job to recovery handler for consistency
* Fix tests
* Locking feature to EE in FE
Ruben Fiszel
GuilhemandClaude Opus 4.8
Alexander Petricandwindmill-internal-app[bot]
hugocasaanddieriba
Diego Imbert
Guillaume Bouvignies
Faton Ramadani