* fix: make on_behalf_of control permissions for scripts and flows
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: inherit the recorded on-behalf-of identity when a preserving deploy omits it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep an omitted permissioned_as from re-versioning an unchanged script
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: derive the on-behalf-of principal from the email and reject mismatched pairs
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop workspace deploys from carrying a source-workspace principal
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: correct the onBehalfOfPermissionedAs param doc
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: pin that workspace deploys never carry a source-workspace principal
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: correct the omitted-principal contract and refresh generated prompts
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep external-superadmin principals on email-only redeploys
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: scope the recorded principal to its workspace and prefer real accounts
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: carry the recorded principal correctly through drafts and set-permissioned-as
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: sweep draft identity pairs on email change and offboarding
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: leave group identities alone when sweeping a user's email
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: treat only g/ without an email as a group, and match the offboard preview
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop the group guard from skipping rows with no recorded principal
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: state the group guard once instead of restating it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: make the permissioned_as the only stored on-behalf-of identity
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* perf: skip resolving the on-behalf-of address for sync clients that discard it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address the local review of the identity refactor
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: resolve the on-behalf-of identity coherently across clones, offboarding and no-op deploys
* test: pin that a fork keeps only the on-behalf-of identities that resolve in it
* fix: decide a principal prefix-first everywhere and canonicalize bare addresses
* fix: prefix a slash-containing address so a reader cannot take it for a group
* fix: read an address as a username before the group- convention
* fix: rewrite the canonical principal when an account's address moves
* fix: keep the address form of a principal to accounts without a usr row
* fix: reject an identity a job row cannot carry and read it uncached at dispatch
* fix: count characters against the job identity width and cap the backfill
* refactor: name the script/flow principal on_behalf_of, as apps do
* docs: state the caller-must-authorize contract on the identity resolvers
* fix: keep writing on_behalf_of_email until every worker reads the principal
* fix: err high on the compatibility version and document the last resolver
* fix: keep the compatibility address current through identity mutations
* fix: carry the compatibility address with the principal on every copy path
* chore: re-pin the EE ref to the companion branch merged with EE main
* fix: key the dbt retry lookup on the stored principal
* fix: keep a mixed-version address recoverable through a fork
* fix: read a round-tripped address uncached so a redeploy is not rejected
* fix: refuse an email change that would make a principal unenqueueable
* chore: update ee-repo-ref to ac3d7d015296f041ae44ab6bc4953485f44d36e4
This commit updates the EE repository reference after PR #704 was merged in windmill-ee-private.
Previous ee-repo-ref: 219b0b03905a1a0028054b3a4985724e77d09036
New ee-repo-ref: ac3d7d015296f041ae44ab6bc4953485f44d36e4
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: allow changing an account email in the superadmin settings
* fix: cover slack_email and usage rows, and scope job rewrites to the queue
* fix: compare the destination email case-insensitively
* fix: only warn about the consequences once the email is edited
* docs: warn that changing an account email is a last resort
* fix: repoint app policies and raw-email permissioned_as, reject self-change
* fix: repoint folder default rules and guard the varchar(55) job column
* feat: edit scopes on existing API tokens
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: address PR review feedback on token scope edit
- add SECURITY DEFINER to notify_token_scopes_change so trigger fires under windmill_user/admin roles (cubic P1)
- drop banned $bindable(default) on optional props (CLAUDE.md): make ScopesPicker.value and EditTokenScopesModal.open required
- detect MCP only when *every* scope starts with mcp: so mixed/null-scope tokens fall back to standard picker without dropping non-mcp scopes
- audit log scope payload via serde_json instead of Rust {:?}
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Diego ImbertandClaude Opus 5
hugocasaandClaude Opus 4.7