* feat: allow change_workspace_id on CLOUD_HOSTED for superadmins
- Import is_super_admin_email function from windmill_common::auth
- Modify CLOUD_HOSTED restriction to bypass for superadmin users
- Resolves request to allow workspace ID changes for superadmins only
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* feat: allow superadmins to change workspace ID on cloud hosted environments
Update frontend conditional logic to show workspace ID change button for superadmins on cloud hosted environments. This complements the backend changes that already allow superadmins to perform the workspace ID change operation.
Changes:
- Add superadmin import from $lib/stores
- Update condition from `!isCloudHosted()` to `!isCloudHosted() || $superadmin`
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* feat: add optional CSP headers when ENABLE_CSP_HEADERS is set
- Add middleware to conditionally set Content-Security-Policy headers
- Check for ENABLE_CSP_HEADERS environment variable
- Apply secure default CSP policy suitable for web applications
- Follows existing middleware patterns in codebase
Resolves#6031🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* perf: optimize CSP headers with lazy_static and add configurability
- Cache CSP_ENABLED and CSP_POLICY using lazy_static to avoid env var lookups on every request
- Add comprehensive documentation to add_csp_headers middleware function
- Make CSP policy configurable via CSP_POLICY environment variable
- Maintain backward compatibility with secure default policy
- Implement proper error handling for custom CSP policy values
Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>
* refactor: conditionally add CSP middleware layer instead of NO-OP
- Use .option_layer() to only add CSP middleware when ENABLE_CSP_HEADERS is set
- Remove runtime conditional check from add_csp_headers function
- Improve performance by avoiding unnecessary middleware execution when disabled
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* refactor: conditionally add CSP middleware layer instead of NO-OP
Remove CSP_ENABLED variable and instead check if CSP_POLICY is not empty.
This eliminates the need for a separate enable flag and simplifies the logic
to just check if a meaningful CSP policy is configured.
- Remove CSP_ENABLED lazy_static variable
- Simplify CSP_POLICY to use unwrap_or_default()
- Update conditional middleware logic to check !CSP_POLICY.is_empty()
- Update documentation to reflect new behavior
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* refactor: conditionally add CSP middleware layer instead of NO-OP
Move CSP headers from general middleware stack to static assets only.
CSP headers are only relevant for browsers consuming static content,
not for API endpoints.
Changes:
- Add CSP headers directly to static asset responses in serve_path()
- Remove CSP middleware from general middleware stack
- Remove unused add_csp_headers middleware function
- Maintain same CSP_POLICY environment variable configuration
Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>
* fix: conditionally compile CSP header imports with static_frontend feature
Fixes unused import errors by wrapping HeaderValue and CSP_POLICY imports
with #[cfg(feature = "static_frontend")] to match their usage context.
Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>
* refactor: move CSP lazy static block to static_assets.rs
- Move CSP_POLICY lazy static from lib.rs to static_assets.rs for better encapsulation
- Remove crate-level import since CSP_POLICY is now local to static_assets module
- Maintain same functionality with proper feature gating for static_frontend
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>
* nit(mcp): filter out scripts without main function from tools list
- Add no_main_func field to ScriptInfo struct
- Update SQL query to select no_main_func from database
- Filter scripts where no_main_func is true in list_tools function
- Hub scripts remain unaffected as requested
Resolves#6021
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* perf(mcp): optimize script filtering with SQL WHERE clause
Move the no_main_func filtering from Rust code to SQL WHERE clause for better performance:
- Add conditional WHERE clause in inner_get_items for scripts only
- Remove Rust-level filtering loop in list_tools function
- Reduces data transfer and improves query performance by filtering at database level
- Handles NULL values properly with (o.no_main_func IS NOT TRUE OR o.no_main_func IS NULL)
Co-authored-by: centdix <centdix@users.noreply.github.com>
* fix
* refactor(mcp): optimize filtering by removing no_main_func field selection
Remove no_main_func field from ScriptInfo struct and SQL selection while keeping WHERE clause filtering. This improves performance by filtering at the database level without transferring unnecessary data to the application layer.
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
Co-authored-by: centdix <centdix@users.noreply.github.com>
Co-authored-by: centdix <farhadg110@gmail.com>
* feat: allow devOps role to edit worker groups config
- Updated backend permission checks in configs.rs to use require_devops_role() instead of require_super_admin()
- Updated frontend UI in workers page to show worker group management for devOps users
- Updated WorkerGroup component to allow devOps role access to all configuration features
- Updated AssignableTagsInner component to allow devOps users to manage tags
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* Update configs.rs
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* use open router of model lists
* draft
* allow get in ai proxy
* add fetch available models function
* use func
* fix for anthropic
* fix
* fetch on mount
* fix ai settings
* fix
* handle azure
* draft for http streamable usage
* good stuff
* add workspace_id to extensions
* fix shutdown
* cleaning
* fix
* adapt frontend
* Revert "adapt frontend"
This reverts commit 331dffaf98.
* dont use new path
* cleaning
* cleaner way of closing sessions
* app compiles with every ee substituted
* Replace all oss files content
* Revert "Replace all oss files content"
This reverts commit ea4017d59f.
* delete all ee
* hide all _ee files under private flag
* hide every oss stuff when private flag set
* pub use *
* gitignore and substitute script
* pub mod for ee needed for ee repo
* small mistakes
* remove oidc_oss impl
* ee ref (temp)
* ee ref
* fix --all-features selecting private in OSS CI
* ee repo ref
* allow unused
* feat: add skip_email option to user creation endpoint
- Added optional skip_email field to NewUser struct in users.rs
- Added send_email_if_possible_with_skip function in users_ee.rs
- Updated user creation flow to support conditionally skipping email notifications
- Addresses issue #5823 requested by @alpetric
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: rubenfiszel <rubenfiszel@users.noreply.github.com>
* feat: add skip_email parameter to user creation endpoint OpenAPI spec
Add optional skip_email boolean parameter to the /users/create endpoint
schema to match the backend implementation that was added for skipping
email notifications during user creation.
Co-authored-by: alpetric <alpetric@users.noreply.github.com>
* revert users_ee
* ee repo ref
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: rubenfiszel <rubenfiszel@users.noreply.github.com>
Co-authored-by: alpetric <alpetric@users.noreply.github.com>
Co-authored-by: Alex Petric <petric.al@gmail.com>
* backend
* iterate
* all
* all
* all
* iterate
* revert
* all
* add tracing to get of authed client
* all
* all
* lal
* all
* update
* fix
* push
* all
* all
* revert
* frontend
* fix checks
* avoid deadlock
* safer
* fix
* fix
* make resolver
* more updates
* fix build
* fix raw_dependencies job type
* compat with http agent workers
* refactor
* rename
* more refactor
* cleanup
* more tests
* fix s3
* small fixes
* more fixing
* fix endpoint
* nit: update comment
* update ee ref
* update ee ref
* update ee ref
* implement safer `list_available_python_versions`
* add tracing to get of authed client
* internal: Trigger claude when commenting with /aider (#5783)
* add claude instructions files
* call claude too when using aider
* fix
* add draft for linear claude integration
* fix build
* update ee ref
* ignore versions <=3.9
* fix windows build
* correct versions filter
* fix windows build (this time for real)
* inject error to debug CI
* update CI
* undo debug of CI
* fix tests
* remove outdated comment
* update ee repo ref
* Update ee-repo-ref.txt
* Update backend/parsers/windmill-parser-py-imports/src/lib.rs
Co-authored-by: graphite-app[bot] <96075541+graphite-app[bot]@users.noreply.github.com>
* Update InstanceSetting.svelte
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: centdix <40307056+centdix@users.noreply.github.com>
Co-authored-by: graphite-app[bot] <96075541+graphite-app[bot]@users.noreply.github.com>
* add tracing to get of authed client
* internal: Trigger claude when commenting with /aider (#5783)
* add claude instructions files
* call claude too when using aider
* fix
* add draft for linear claude integration
* fix: workspace preprocessor fixes
* tmp ee ref
* fix build
* update ee ref
* fix: hub script preprocessor handling
* fix build
* good ref
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: centdix <40307056+centdix@users.noreply.github.com>
wendrul
Ruben Fiszel
HugoCasa
claude[bot]
Tom Deckers
Ruben Fiszel
dieriba
centdix
Alexander Petric
Diego Imbert
pyranota
Guilhem