40 Commits

Author	SHA1	Message	Date
Diego Imbert	d63315ed35	feat(frontend): pick workspace members from a searchable instance user list (#10474) ... * feat(frontend): pick workspace members from a searchable instance user list Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FoPnHJJTRrkZ2UnzWuFM2m * fix: exclude non-addable users in the query and keep the picker input editable Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FoPnHJJTRrkZ2UnzWuFM2m * fix: cancel a superseded user search so its result cannot overwrite a newer one Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FoPnHJJTRrkZ2UnzWuFM2m * fix: treat the typed address as the email so Add works without the dropdown Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FoPnHJJTRrkZ2UnzWuFM2m * fix: only submit the typed picker text when it is a whole email address Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FoPnHJJTRrkZ2UnzWuFM2m * fix: keep the typed address visible in the picker once its dropdown closes Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FoPnHJJTRrkZ2UnzWuFM2m --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-04 18:27:48 +02:00
Ruben Fiszel	fb82748296	fix: make on_behalf_of control permissions for scripts and flows (#10438) ... * fix: make on_behalf_of control permissions for scripts and flows Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: inherit the recorded on-behalf-of identity when a preserving deploy omits it Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: keep an omitted permissioned_as from re-versioning an unchanged script Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: derive the on-behalf-of principal from the email and reject mismatched pairs Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: stop workspace deploys from carrying a source-workspace principal Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: correct the onBehalfOfPermissionedAs param doc Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test: pin that workspace deploys never carry a source-workspace principal Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: correct the omitted-principal contract and refresh generated prompts Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: keep external-superadmin principals on email-only redeploys Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: scope the recorded principal to its workspace and prefer real accounts Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: carry the recorded principal correctly through drafts and set-permissioned-as Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: sweep draft identity pairs on email change and offboarding Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: leave group identities alone when sweeping a user's email Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: treat only g/ without an email as a group, and match the offboard preview Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: stop the group guard from skipping rows with no recorded principal Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: state the group guard once instead of restating it Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor: make the permissioned_as the only stored on-behalf-of identity Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * perf: skip resolving the on-behalf-of address for sync clients that discard it Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: address the local review of the identity refactor Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: resolve the on-behalf-of identity coherently across clones, offboarding and no-op deploys * test: pin that a fork keeps only the on-behalf-of identities that resolve in it * fix: decide a principal prefix-first everywhere and canonicalize bare addresses * fix: prefix a slash-containing address so a reader cannot take it for a group * fix: read an address as a username before the group- convention * fix: rewrite the canonical principal when an account's address moves * fix: keep the address form of a principal to accounts without a usr row * fix: reject an identity a job row cannot carry and read it uncached at dispatch * fix: count characters against the job identity width and cap the backfill * refactor: name the script/flow principal on_behalf_of, as apps do * docs: state the caller-must-authorize contract on the identity resolvers * fix: keep writing on_behalf_of_email until every worker reads the principal * fix: err high on the compatibility version and document the last resolver * fix: keep the compatibility address current through identity mutations * fix: carry the compatibility address with the principal on every copy path * chore: re-pin the EE ref to the companion branch merged with EE main * fix: key the dbt retry lookup on the stored principal * fix: keep a mixed-version address recoverable through a fork * fix: read a round-tripped address uncached so a redeploy is not rejected * fix: refuse an email change that would make a principal unenqueueable * chore: update ee-repo-ref to ac3d7d015296f041ae44ab6bc4953485f44d36e4 This commit updates the EE repository reference after PR #704 was merged in windmill-ee-private. Previous ee-repo-ref: 219b0b03905a1a0028054b3a4985724e77d09036 New ee-repo-ref: ac3d7d015296f041ae44ab6bc4953485f44d36e4 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>	2026-08-01 20:37:21 +02:00
Ruben Fiszel	032300e28e	feat: run dbt projects as a first-class Windmill runtime (#10326) ... * fix: mount only the engine in the dbt jail, reject shadowed and malformed args Review round 42. The jail mounted the whole dbt cache directory, whose siblings of the engine are `repos/` and `packages/` — other workspaces' private checkouts and package trees, kept apart by cache key rather than by permissions. A jailed project could read them. It now mounts the engine's own directory, which the provisioner names; verified from inside the jail that `repos/`, `packages/` and `state/` are invisible while the engine stays usable. A `{{ placeholder }}` may no longer take the name of a run argument this runtime defines. It was silently dropped from the signature, so a descriptor like `value: "{{ select }}"` deployed and then could not be run at all: the built-in `select` is an array and the interpolation needs a scalar. Refused at parse, so the deploy says so. A `vars` override that is not an object is refused rather than ignored. Argument-schema validation is opt-in, so a string or an array silently ran the descriptor's own vars — against a different schema or alias than the caller asked for. `select` and `exclude` already refused theirs. * feat(dbt): the project is the script's module bundle, not a git checkout A dbt script now carries its whole dbt project as its module bundle. The descriptor is the script content; `<script>__dbt/` holds the project verbatim, so importing an existing project is `cp -r` plus `wmill sync push`, and the worker materialises the bundle into the job directory instead of cloning. Backend - `prepare_project` writes the script's modules and requires `dbt_project.yml` at the bundle root. `checkout`, the git-ssh command, the clone cache and the repository resource are gone, along with `repo`, `project`, `ref` and `git_ssh_identity` on the descriptor. - Run identity and the package cache key take a `project_digest` (sorted SHA256 over the bundle) where the commit used to sit, so an edited project cannot resume a previous run's `run_results.json` or reuse its `dbt_packages`. - The per-run graph re-ingest is now gated on `vars` placeholders and `$var:` env alone. - `capture_dependency_job` takes the script's modules so a dependency job, which has no generic module-writing step, materialises them itself. - `dbt deps` caching strips the git remote from every package it cached, not just the tree root: `packages.yml` can render a token into a `git:` URL. - `git_clone.rs` is dropped and `ansible_executor.rs` returns to its own copy of the clone helpers. CLI - `wmill sync pull` keeps a dbt script's lock beside its folder rather than inside it, so the folder holds nothing but the project. - Directories dbt generates (`target-path`, `packages-install-path`, `clean-targets` and the usual defaults, read from `dbt_project.yml`) are excluded from the bundle, from the sync diff and from staleness hashing. - A module-only edit now pushes its parent dbt script and is reported as a changed module rather than passing unnoticed. * fix: keep a script's modules in the worker's file-system cache The first fetch of a script version reads the database and carries its modules; every later fetch imports from the worker's cache directory, whose `RawScript::import` hard-coded `modules: None` and whose `export` never wrote them. A worker restart therefore started running the script without its own files, silently — for a dbt script, without its project, which fails with "carries no project"; for any other script with a module bundle, with the imports missing. `modules.json` is now written on every export and required on import, so an entry written by an older version fails to import and is refetched rather than serving a stripped script for as long as the directory lives. Also derives a dbt run's `project_digest` from the bundle the run actually carries: `handle_dbt_job` was passing `None`, which collapsed every project in a workspace onto one digest and let `dbt retry` resume a different project's `run_results.json`. * fix(dbt): give every phase the script's environment, bound the cache copies `dbt deps` ran without the script's environment variables on an unsandboxed worker, so a `packages.yml` resolving a private package URL through `env_var()` could not see them while the package cache key was still built on their digest. `with_invocation_env`, applied at three of the four call sites, is folded into `dbt_command` so no phase can be added without it, and `DBT_TARGET_PATH` is set after both environments rather than before. The package cache copies ran through a bare `Command::output()`: the tree is the project's, so a cancelled or timed-out job held its worker slot until `cp` finished. Both the restore and the publish now run under the job poller like every other phase. * fix(dbt): only offer commands whose writes match the graph, honour packages-install-path `dbt_command: run` is dropped from the allowed overrides. Asset dispatch fires a script's deploy-time writes on any successful job, and `dbt run` covers models only, so a project with seeds or snapshots notified consumers of relations the invocation left stale. That is the same reason `test` was already excluded. Narrowing what a run touches is `select`/`exclude`, which scope the graph too. `dbt deps` writes to the project's `packages-install-path`, so a project that moved it got no package cache at all: the publish found nothing at `dbt_packages` and every job resolved its dependencies over the network again. The path is read from `dbt_project.yml` and validated as project-relative, since both cache copies are rooted at it. Also states the sidecar's mutator contract at the module level: the dbt manifest tables carry no RLS and grant `windmill_user` full access, so a user-scoped transaction is not enforcement and every caller must have verified write access to the script itself. CLI: a module file is now grouped with its parent script for the push. Left in a group of its own it got its own `alreadySynced`, so a push touching several files of one bundle deployed the script once per file; the resulting versions raced, and the asset graph could end up describing none of them. * fix(dbt): seed a project for browser-created scripts, refuse a no-op retry A dbt script created in the browser only got a descriptor, and the runtime refuses a script whose bundle has no `dbt_project.yml`, so the advertised Create → Deploy → Run path always failed its dependency job. New dbt scripts now start with a project that builds: pointing `profile.resource` at a warehouse is the one edit, and growing it is `wmill sync pull` plus a local editor, which is where dbt development happens. `dbt retry` builds its graph from the previous run's error, fail and skipped nodes alone, so retrying an all-green run selected nothing and wrote nothing — and a job that succeeds having written nothing still dispatches every deploy-time write, waking every downstream consumer for relations no one touched. Refused, with the reason. CLI: a configured `target-path` or `packages-install-path` may be nested (`build/target`), and `clean-targets` has a block form as well as an inline one. Both are now parsed, and the exclusion compares the project-relative path rather than the top-level segment, so a nested generated tree no longer lands in the bundle and no longer makes a local `dbt run` look like a project change. * fix(dbt): lock a project once, find the parent on either path separator A dbt script's modules are its dbt project, not helper code with dependencies of its own, so the generic per-module lock loop is skipped for it: the parent lock already ran `dbt deps` and `dbt parse` over the whole project. Locking each file separately re-materialised the bundle and re-invoked dbt once per file, so a project of N files paid N project-sized passes and a large one timed the deploy out. The 13-file fixture went from 14 relock passes to 1. `pushParentScriptForModule` searched the raw path for `__dbt/`, so on Windows, where the folder is spelled `__dbt\`, a module-only edit returned without deploying its parent while the caller still recorded the file as synced. It now goes through `getScriptBasePathFromModulePath`, which normalizes separators. Also drops the last of the external-repository wording from the descriptor's module docs and from the `codebase` rejection a user can hit. * feat(dbt): infer the run form locally, keep test-only retries from cascading `windmill-parser-wasm-yaml` 1.770.0 carries `parse_dbt`, so the browser and the CLI derive a dbt script's run arguments from its descriptor instead of waiting for the deploy to hand back a schema. Pins bumped in both. `generate-metadata` was rewriting a dbt script's `lock` field on every run: a dbt lock comes from the dependency job on a worker, so nothing generates it locally and the resolved `!inline` reference was left inlined into the metadata or blanked. It is restored instead, and a push straight after `generate-metadata` is a no-op again. A retry now needs a failed node that materialises something. `dbt retry` builds its graph from error, fail and skipped nodes, and with `test_behavior: after_all` a failing test is what `run_results.json` ends up describing — so the retry reran tests, wrote nothing, succeeded, and still dispatched every deploy-time write. The dbt badge's destination is deterministic: writers outrank readers, and among several writers of one relation (which the backend permits) the smallest id wins, rather than whichever write edge arrived last. * feat(dbt): browse the project and read a run's per-node result Two views a dbt user expects and that the generic script surfaces do not give. **The project.** A dbt script's editor gains a Project tab beside its descriptor: the module bundle as the tree dbt itself expects, each file read-only with syntax highlighting. The existing module tab strip is a flat row built for a couple of helper files and does not survive a real project; a 13-file fixture already overflows it. Directories sort before files so it reads like the checkout on disk, and an empty bundle explains the `cp -r` instead of showing a blank pane. **The run.** `DisplayResult` renders a dbt invocation's per-node breakdown above the raw payload: totals, then a table of node, kind, target relation, rows and time, with failures and warnings sorted first and carrying their message. The data was already structured; it was being shown as JSON to scroll and PASS/WARN counts to find in the log. On a failed run the same JSON rides in the error message after the exit-status line, so it is parsed back out — that is the case worth rendering, since the failing node is what the user came for. * docs(dbt): say that profile.resource is what buys the asset graph The starter descriptor described `profile.resource` as the thing rendered into profiles.yml, with the project's own file as an equal alternative. It is not equal: the resource PATH is the warehouse's identity in the asset graph, so a project bringing its own profiles.yml runs fine and silently gets no assets, no lineage and no cascade. The deploy already says so in its log; now the descriptor a user starts from says it too, before they choose. * fix(dbt): authorize a resource used only for asset identity, clean up after failed installs A descriptor setting both `profile.profiles_yml` and `profile.resource` took its connection from the project's file but returned the resource path as the graph's warehouse identity without ever reading it. A script editor could therefore publish `table://<any resource>/...` writes, and wake that warehouse's subscribers, while connecting somewhere else. The resource is now read on that path too — reading is what authorizes it — so the combination keeps working for the case that wants it (keep your own profiles.yml, still get lineage) and fails closed otherwise. Provisioning cleaned up its staging directory only on the paths someone remembered, so a run of failed or cancelled first-use installs accumulated venvs, tarballs and installer scripts until the worker's disk was gone. All three engines now hold their scratch paths in a guard that removes them on drop, which is the one exit every path takes, cancellation included. Frontend: `partial success` is dbt's word for a node that built but whose tests failed, counted in `totals.error` and redone by a retry, so it ranks with the failures instead of rendering green with its message hidden. And the run panel now keys off the worker's engine discriminator rather than `{nodes, totals}`, which is a shape an ordinary script can return. Both pinned by unit tests on the extracted `parseDbtRun` helpers. * feat(dbt): show a run's models on the run page The run page is where you land on a running job, and until now it showed a dbt run as streaming text: the per-node table only renders once the job has produced a result, and the graph that moves per model lived on the pipeline page you had to navigate to. A Models section now sits above the result, scoped to the running script's own relations and its `ref()` lineage, polling while the job is in flight so nodes move as dbt walks the DAG. No `resolveGraph`: that merges drafts and live editor buffers into the persisted graph, and a run page has neither. * feat(dbt): retry failed nodes automatically, and from any worker **Node-level retry, in the job.** `retry_failed_nodes: {attempts, delay_seconds}` rebuilds only what a failed build left failed or skipped, before the job reports failure. dbt confines a failure to its own subtree and `dbt retry` resumes exactly that set, so a transient warehouse error costs those nodes rather than the project. Doing it in-job is what keeps the state question out of it: the previous attempt's `run_results.json` is still in the job directory, so there is nothing to persist and no worker to land back on. This is the granularity astronomer-cosmos gets from one Airflow task per model, without the ~6x that per-model tasks measured. A retry's `run_results.json` names only the nodes it redid, so it overlays the accumulated results rather than replacing them: the job's result has to be every node the job touched, or the nodes that succeeded before the retry settle no materializations. Pinned by a test. **Durable retry state.** `run_results.json` is now saved to `dbt_run_state` as well as the worker's local cache, so an explicit `dbt_command: retry` works from any worker of the group rather than only the one that failed. Only the results are stored: `dbt retry` also needs `manifest.json`, roughly sixty times larger and growing with the project (732 KB against 12 KB on the six-node fixture), but the manifest is a pure function of the project files, vars and env, all of which the stored identity already pins, so a worker restoring from the database re-derives it with a `dbt parse` of about a second. * fix(dbt): restore the sqlx cache, make retries cancellable and path-aware **SQLx cache.** A `cargo sqlx prepare` deleted 750 entries, including the enterprise queries CI needs under `SQLX_OFFLINE=true`, and the check that was supposed to catch it reported zero losses because it was run from `backend/` with a `backend/`-prefixed path, so its baseline was empty and it failed open. All 750 are restored; the branch now adds 19 and deletes none, and `SQLX_OFFLINE=true cargo check` passes. **Retry backoff observes cancellation.** `canceled_by` is only written by the job poller, which does not run between attempts, so re-reading it reported the state as of the failed attempt and missed every cancel issued during the wait — the whole window the check exists to cover. The wait now reads `v2_job_queue.canceled_by` each second, and the job's deadline is honoured before starting another dbt process. **Retry state follows its script.** `dbt_run_state` is path-keyed like the manifest sidecar but, unlike it, nothing regenerates it: a rename moves the row so a resumable failure survives, while archive and delete clear it, so a script later created at that path cannot inherit a stranger's failure and its arguments. **CLI.** `table` joins ducklake and s3object in the local graph's auto-trigger kinds, matching `is_auto_trigger_kind` and the frontend's set; without it a local graph and the generated docs omitted a cascade edge the deploy has. * fix(dbt): carry only the project files a bundle can hold, and say what it drops Exploring real and edge-case projects surfaced three frictions, all in the import path a user hits first. **A binary file broke the push, opaquely.** dbt projects carry images under `docs/`, stray `.DS_Store` files and occasionally a parquet seed. Read as text they become mojibake, and a NUL among them is rejected by Postgres with `unsupported Unicode escape sequence` — which `wmill sync push` then reported as success, exiting 0 with the script never created. Binary files are now detected the way `git` detects them, by a NUL in the first 8000 bytes rather than by extension, and skipped with the reason. **The size guard the docs promised did not exist.** Now it does: 5 MB per file, which only ever catches a committed dataset. Real dbt code is about 500 bytes median and 1.9 KB at p90. **Skipped files became a permanent phantom diff.** The push dropped them while the sync diff still offered them, so every push reported changes no push could resolve. One predicate now answers for the push, the staleness hash and the diff. Verified on a project with unicode filenames and content, CRLF endings, an empty model, an ephemeral model, a disabled model, a `.md` docs block, an extensionless README, six levels of nesting, a 7.6 MB seed and a PNG: it pushes, round-trips byte-for-byte through pull, deploys to 7 dbt nodes and 6 `table://` assets (ephemeral and disabled correctly absent), and runs green. * fix(dbt): resolve dbt-core against the adapter, settle partial success, unify status **Adapters could not be provisioned.** The 1.x engine pinned `dbt-core` to a fixed version independent of the adapter, but several adapters cap below it: `dbt-mysql` at `~=1.7`, `dbt-oracle` and `dbt-databricks` below 1.12, and `dbt-salesforce` has no package at all (it exists only inside Fusion). Those projects failed at provisioning with a uv resolver dump. The install now asks for a range and lets the adapter choose, and records what the resolver picked so the lock pins a version that adapter can take. The floor is the CLI this runtime invokes: resolving down to dbt-core 1.7 produced a working venv that then failed with `No such option '--target'`, which is worse than not resolving. An adapter with no release in range now fails naming itself and pointing at `dbt-core-2x` or `fusion`, instead of a resolver dump. Salesforce is refused up front with the reason. **`partial success` left a model stuck on `Running`.** It is dbt's word for a node that built and then failed its tests, and it was already treated as a failure when counting totals and deciding a retry — but the two sites that settle the RELATION fell through to "says nothing", so the tailer's `Running` was never replaced and a finished job showed a model still building. Six status comparisons had drifted apart, two folding case and four not, while dbt-core 1.x echoes the author's casing and 2.x uppercases; they are now one classifier. **Agent workers.** The durable retry state and the cancellation poll both need a database, which an agent worker reaches only through the API. The automatic node retry is refused there rather than running a wait it could not interrupt, and the docs say "any worker with a database connection" instead of overclaiming. Also clears `dbt_run_state` when a path stops being a dbt script, and moves `run_identity`'s contract onto `run_identity` from the digest helper below it. * feat(dbt): show the transform behind a model on the run graph The run page's graph carried a node for the script itself and drew every relation as a bare table. Both were wrong for that page: the graph there is already scoped to one script, so a node standing for it distinguishes nothing (on the pipeline page it separates one project from another, which is why it exists), and dbt's own DAG node is the model — the SQL and the relation it writes are one thing, so a graph of relations alone leaves out what a reader came to see. The script node is dropped, and selecting a model now shows its SQL underneath the canvas with its file path and materialization, read-only, the same view the pipeline details pane gives. * feat(dbt): move the graph with the run The worker has always recorded a state per relation as dbt walks the DAG — `running` when a model starts, `materialized` or `failed` when it ends — but nothing rendered it: the graph response carries what a relation IS, not what a particular run is doing to it, so the canvas had nothing to show and a running job looked identical to a finished one. `assets/run_progress/{job_id}` returns that state for one job, the run page polls it beside the graph, and the asset node carries a spinner or its outcome. Errors and retries need nothing extra: a failed node writes `failed`, and an in-job retry rewrites the same row, so the node returns to `running` and on to its new outcome by itself. `materialized_partition` holds a relation's CURRENT state keyed by relation, so filtering on `job_id` returns exactly what this run last touched — which is the question a run page asks, and why a superseded older run shows nothing. * feat(dbt): a dbt project is not a data pipeline Deploying a dbt script marked it `auto_kind = 'pipeline'`, which enrolled it in pipeline membership: the folder became a Pipeline entry on the home page, the script folded into it, and `/pipeline/<folder>` opened a canvas holding the project's whole model DAG next to the pipeline's own scripts. A folder holding both then read as two projects in one editor, and the pipeline editor offered to author transforms that are in fact authored in a local `dbt run` loop and pushed as the script's bundle. A dbt script is now never a pipeline member, and the pipeline canvas drops the dbt script node. Its models stay, with their `ref()` lineage: the relations are what a downstream pipeline script reads, and dropping them would break the cascade from a dbt run — the point of giving dbt models `table://` identity. Also drops a screenshot committed to this branch by accident. * fix(dbt): authorize run_progress through the job, drop dbt from the local graph `run_progress` read `materialized_partition` through `user_db` on the assumption that RLS would scope the rows. That table has RLS disabled and no policies, so any workspace member could pass a job id and read that run's relation paths, row counts and error text. It now joins `v2_job`, which does carry per-user policies, so a caller who cannot see the job sees nothing — the same pattern `v2_job_completed` reads need. Verified as a plain member: the old query returned 6 rows for another user's run, the new one returns 0, while the job's owner still sees all 6. The CLI's local graph still forced `in_pipeline` on every dbt script, so `pipeline docs --local` and `pipeline dev` kept presenting a dbt project as a pipeline the deploy no longer enrolls. It now skips them, matching the server. A dbt descriptor has no asset parser locally, so nothing is lost: its models come from the manifest the deploy derives. Declares `run_progress` in openapi.yaml so the frontend uses the generated client instead of a handwritten fetch; the generated `status` union also replaces a hand-rolled string mapping. * fix(dbt): drop the dbt node from the CLI's deployed pipeline views too `pipeline dev` and `pipeline docs` (without `--local`) read `/assets/graph` directly. That endpoint is asset-usage driven rather than membership driven, so it returns a dbt script like any producer — and both commands render every runnable, so a dbt project still showed up as a pipeline script there after the local builder stopped emitting one. `hideDbtRunnables` mirrors the frontend's projection of the same payload. It is generic over the graph shape so the bounded-cascade view (`BCGraph`, a narrower type over identical JSON) passes through without a cast. The relations stay: they are what a downstream pipeline script reads, and the node is what attributes them to a producer for every other consumer of the endpoint, so the filter belongs in the views rather than the query. * fix(dbt): narrow a selective run's cascade, settle the finished run graph Review-round fixes. A `select`/`exclude` run builds part of the project, but asset dispatch reads the deploy-time write set for the whole script, so a run selecting one model woke the subscribers of every other. Dispatch now intersects that set with the relations the run actually recorded as materialized, scoped to dbt because it is the only producer whose write set is decided per run. A run that recorded nothing still dispatches everything, so an agent worker whose reconciliation failed cascades as before. Verified both ways: `select: [extra_model]` no longer wakes the `fct_orders` subscriber, and a full run still does. `hideDbtRunnables` keyed its removal set on path alone while the graph keys runnables by `(usage_kind, path)`, so a flow sharing a path with a dbt script lost its node, edges and triggers too. Both copies now key on the pair. The run graph never took a final reading when a job finished, so the last state shown was whatever the tick before completion saw. Only `dbt-core-1x` streams node events; the other engines record every relation during end-of-run reconciliation, so their finished graph showed nothing until a reload. `DbtNodeOutcome::Inconclusive` collapsed statuses the tally has to tell apart, so two sites re-lowercased the status beside the classifier and `no-op` landed in `totals.error` — a clean run reporting an error in its own result. Split into Warn / Skipped / NoOp / Unknown so every site falls out of one match; `no-op` is kept out of the retry set, which dbt spells as error / fail / skipped. Also: reattach two doc comments to the items they describe, and correct the engine-distribution table — only dbt-core-2x is baked into the images, 1.x is a per-adapter venv provisioned on first use, and the default is compiled in rather than an instance setting. * fix(dbt): make the model chip inert where its project node is not on the graph The canvas passed `onDbtSelect` unconditionally, so the chip always rendered `cursor-pointer` and hover-highlighted — but the owner map is empty on both graphs this feature added, since the run page carries no runnables and the pipeline page hides the dbt node. The chip advertised a click that resolved to nothing. It now takes its handlers only when the relation has an owner on this graph, so it stays live on the surfaces that do show the project node. `classify_status` and `DbtNodeOutcome` were `pub` in a private module with no caller outside the file, unlike every neighbour. * fix(dbt): take the cascade's write set from the run's own result The previous narrowing read `materialized_partition`, which was wrong twice. That table keeps one row per relation and the newest writer takes `job_id`, so two overlapping runs over the same model erase each other's claim to it: the earlier job would dispatch a subset of what it built, or none of it. And an empty row set was read as "recording failed, dispatch everything" when it is also a real answer. A `select` matching no model, or one resolving to tests only, exits 0 having built nothing — and then woke every consumer of every model in the project, which is the opposite of what the narrowing exists to do and is reachable by a typo in a run argument. The run now reports the relations it materialized in its own result, which is immutable and per job. Absent means the producer said nothing (a job from before the field, a non-dbt producer) and the whole deploy-time set dispatches as before; present-and-empty means it built nothing and dispatches nothing. Verified on all three: an unmatched selector builds nothing and wakes nobody, a selector naming one unsubscribed model wakes nobody, and a full run wakes the subscriber. Also indexes `materialized_partition (workspace_id, job_id)` -- the run page polls that shape every 2s and no existing index leads with `job_id` -- corrects the selective-cascade section of the design doc, which still described the old deploy-time behavior, and reattaches `buildLocalPipelineGraph`'s doc comment. * docs(dbt): attach the CLI JSDoc to its function, correct the index rationale The `hideDbtRunnables` JSDoc ended up documenting the type declared beneath it — made while fixing the same mistake one function down. The migration's comment credited the cascade with a `job_id` lookup that the same commit replaced with a read of the job's own result. The run page's poll is the only reader keyed on that column. * fix(dbt): refuse graph publication for a removed script, allow test-only retries An archived or hard-deleted script could still republish its graph: the publication guard filtered `deleted` but not `archived`, and treated a missing row as "nothing newer exists" rather than "nothing left to publish for". A dependency job or dynamic run finishing after the removal put the asset, provenance and subscription rows back with nothing left to clear them. `dbt_command: retry` refused a run whose only failures were tests, which is precisely what `test_behavior: after_all` produces. That restriction existed because a successful job dispatched its whole deploy-time write set, so a test-only retry would have woken every consumer for relations no one touched — the cascade now dispatches what the run reports materializing, so it wakes nobody and the restriction only blocked a legitimate retry. * fix(dbt): gate run progress behind the job-read check, not RLS alone The endpoint joined `v2_job` so RLS would decide visibility, which it does — but `require_job_read_access` adds two things RLS does not: a scoped token's `if_jobs:filter_tags` restriction, and the app-embed cutoff that stops untrusted app JS from inheriting the viewer's broader job access. A scoped or embed token could therefore read relation names, statuses, row counts and errors for jobs the ordinary job endpoints deny it. That helper is private to `windmill-api`, which depends on `windmill-api-assets` rather than the reverse, so the endpoint moves to the job routes instead of the check being duplicated. It is job-scoped anyway: `/w/{ws}/assets/run_progress/{job_id}` becomes `/w/{ws}/jobs/run_progress/{id}`, and the frontend follows the generated client. * feat(dbt): a dbt run does not trigger downstream runs dbt orders its own DAG, so a cascade only ever adds one thing: waking a Windmill script that reads a mart. That edge is narrow, and only half of it can even be expressed — nothing outside dbt can declare a `table://` write, since `// materialize` accepts DuckLake targets only, so an ingestion script cannot wake a dbt project. Against that, dispatching correctly is not cheap. A run's `select` can build any subset of the project, so the deploy-time write set is not what ran; using it wakes consumers of relations the run never touched, and narrowing it needs a per-job record of what was built. The per-relation state table cannot supply one (it keeps a single row per relation stamped with the last writer), and the result field added for it made a run's own output carry the cascade's bookkeeping. So `asset_dispatch` returns early for `ScriptLang::Dbt`, before the producer gate. dbt still materializes, records per-model state and publishes its graph: models, `ref()` lineage and live run progress are unchanged, and a `# on table://<mart>` reader still renders beside the model it reads. It simply does not fire. Wiring it up later means deciding what a selective run should notify, which is the actual work. Verified: a full run of a 6-model project succeeds and starts nothing, where it previously triggered its subscriber; the run page still reports all 6 relations and the folder graph still carries 14 tables and 8 ref() edges. * fix(dbt): remove the cascade surface, settle stranded models, fix nested __mod Stopping dispatch left its surface behind. `table://` was still an auto-trigger kind, `persist_ingest` still derived subscriptions from a manifest's reads, and the deploy still accepted `# on table://` — so the canvas drew cascade arrows into scripts nothing could wake. All three are gone: the kind no longer derives, the ingest only deletes rows earlier versions wrote, and the deploy refuses the annotation with a message saying why rather than persisting a silent no-op. `DescriptorTriggers` went with them; every field it parsed was cascade config. A model marked `running` by the live tailer was never settled when the run did not finish: reconciliation only revisits nodes `run_results.json` names, and a cancelled or timed-out run has none for the model in flight, so the finished job showed a relation building forever. It is now settled on every exit path. Verified by cancelling a run mid-flight: 3 models `running` before, 3 `failed` after, none stranded. `getScriptBasePathFromModulePath` took the first matching suffix rather than the outermost boundary, so `proj__dbt/models/legacy__mod/a.sql` resolved to `proj__dbt/models/legacy`. dbt owns its directory names verbatim, so a folder ending `__mod` is legal inside a project, and a module-only sync would have looked for a descriptor that is not there and skipped the deploy. * fix(dbt): colour a finished run's models from its own result `materialized_partition` keeps one row per relation stamped with whichever job wrote it last, so reopening a run showed only the models no later run had touched since — down to none for an old run, which reads as a broken page rather than as stale data. Reproduced: a 6-model run reported 6 relations, then a second run rebuilt one shared model and the first reported 5. A finished run already carries the answer. Its result lists every node with a status, and the graph carries each asset's dbt `unique_id`, so the two join directly — no path derivation, nothing stored twice, and nothing a later run can overwrite. The endpoint stays for the live window, where the result does not exist yet, and as the fallback for a run that never produced one (cancelled or killed, whose relations the worker settles in the table instead). `relationOutcome` mirrors the worker's `classify_status` so the colour drawn over a record agrees with the record: `warn`, `skipped` and `no-op` leave the relation untouched and stay uncoloured, as do tests and analyses, which match no asset. Verified in the browser on the run whose model had been stolen: all six relations green again, both sources correctly uncoloured. * docs(dbt): record why only dbt-core 1.x has live per-model progress `emits_node_events()` reads as "the Rust engines produce no node events", which is false and would close off the option. They produce exactly the same events; they put them on the console and ignore `--log-format-file json`, which both accept. Measured on 2.0.0-alpha.5 and fusion 2.0.0-preview.202: 15 node events each on stdout, 0 in the file log, for a three-model project. Taking them means owning the job log's presentation to work around a flag that is documented and simply unimplemented, so the note records the measurement, the sample event, and that flipping the predicate is the whole change once either engine honours it. * fix(dbt): give HighlightCode a dialect-agnostic sql language `npm run check` had three errors the fast check does not reach: `"sql"` is not a value `HighlightCode` accepts. Every SQL dialect it knows maps to one grammar, but a dbt model is compiled by whichever adapter the project targets, so naming a dialect would be a guess — `sql` is now a value in its own right. `langOf` was typed `string` and returned `markdown`, `python` and `text`, none of which the component accepts either, so a dbt project's YAML and Python files rendered unhighlighted. It now returns the component's own prop type, which is what caught them, and `undefined` for what has no grammar rather than a name that silently means the same thing. Verified in the project panel: SQL 22 tokens, YAML 27, where YAML was plain. * fix(dbt): stop failing no-op models, drop table triggers client-side, keep cross-selection edges The sweep that settles a run's stranded relations was marking `no-op`, `warn` and `skipped` models FAILED on successful runs: reconciliation reports those nodes without settling their record, so they were indistinguishable from a model the run never reached. It now excludes every relation the run accounted for, so only the genuinely abandoned ones are settled. `table` was removed from the backend's auto-trigger kinds but left in both client mirrors, so the editor and `pipeline dev`/`docs` kept drawing cascade arrows the deploy will not create. `isModuleEntryPoint` scanned for the first `__mod/`, the same bug its sibling just had: a `legacy__mod/script.ts` nested in a dbt project — dbt owns those names verbatim — read as that script's entry point. Both now anchor on the outermost boundary. A script selecting a model whose parent another script builds dropped the parent entirely, so no `dbt_edge` could reach it and the two relations sat on the graph unconnected. The parent is now kept as an endpoint and recorded as a READ, since this script does not build it — splitting a project across selections only composes if the seam still draws. * fix(dbt): don't double-run after-all tests, count only models a script builds An `after_all` run whose test phase failed saves a `run_results.json` holding tests alone. Retrying it reran exactly those tests — and then the test phase ran the whole suite again, appending a second copy of every result: duplicate ids in the run table, doubled totals. A retry whose saved results are tests alone IS the test phase, so the suite is not run after it, and the two phases now merge by node id rather than concatenating. Keeping a selection's unselected parents as nodes made them count toward the `×N` badge, whose tooltip says "materializes N models" — a script selecting one mart claimed the staging models upstream of it, and the number grew with the seam. The count now comes from the relations the script writes. That change also made the cross-selection read block dead, with a comment asserting the inverse of what now happens; it is removed, and the test that covered it still passes on the new arm. The test I added landed between a neighbouring test's comment and its `#[test]`, orphaning the attribute so that test stopped running. Two display fixes: the run page no longer shows a relation's SQL when the provenance belongs to another project that materializes the same relation, and the editor no longer draws an explicit `# on table://` arrow the deploy refuses. The starter descriptor no longer promises the removed cascade. * fix(dbt): clear untouched models, reject unknown descriptor fields A `no-op` model was left `running` forever on a successful run. The previous attempt at this stopped the sweep marking such models FAILED but gave them no terminal state instead, so they simply never settled. Reconciliation now returns what it settled and what the run reported but did not build, and the two get opposite treatment: a relation the run left untouched has its row DELETED, which is what the finished run's own result says about it (`relationOutcome` colours a `no-op` nothing), so the live and settled views agree; only a relation the run never reached at all is failed. The descriptor accepted unknown fields, so `selcet:` was ignored and left an empty selection — building the whole project — and a misspelled `target` fell back to the profile's default. It rejects them now. That immediately caught two of our own test fixtures still passing `repo:`, a field removed with the git path, which is exactly the class of mistake it exists to stop. `isDbtModulePath` matched `__dbt/` anywhere in a path, the third site with that bug: `foo__mod/vendor/x__dbt/a.ts` read as a dbt project file, and the push then looked for `foo.script.yaml` and could skip the edit. A verbatim dbt bundle dropped any file named `*.lock` before it reached the module map, so an authored `uv.lock` never deployed and the unmodified-project round trip quietly lost it. The exclusion now applies only to `__mod` bundles, where `.lock` really is the script's own lockfile — in the walker that hashes modules too, or a change to such a file would not register as one. Also: `langOf` fell back to `undefined`, which HighlightCode resolves to TypeScript rather than to no highlighting, so seeds and Markdown were coloured as code; and four comments still gave the removed cascade as the reason for sharing an asset node, which is now lineage. * fix(dbt): retry failed tests too, anchor the last __dbt path check `retry_failed_nodes` only ran after the model phase, which fails before the `after_all` test phase exists — so a project whose models built and whose tests failed got no retry at all, exempting exactly the failure mode that separate phase produces. The loop is now a function, called after both phases. `isDbtGeneratedPath` matched `__dbt/` anywhere, the fourth site with that bug: `foo__mod/vendor/x__dbt/target/a.ts` counted as generated dbt output, so `ignoreF` excluded an ordinary module file and a module-only edit never deployed its parent script. `wmill sync push` still dropped an ADDED or DELETED `.lock` three branches before the module arm, so the earlier fix only covered a first push: adding a `uv.lock` to a deployed project was reported as a change forever and never applied, and deleting one left it deployed. Editing worked, which is what made the round trip look whole. Also removes a duplicate `#[test]` that was double-registering a test and detaching its neighbour's comment, and rewrites seven comments that still gave the cascade as the reason for behaviour that now serves lineage only. * fix(dbt): bound the excluded-file read, keep the retry budget job-wide `isBundledModuleFile` read a file in full before deciding it was too big or binary, so a project sitting next to a multi-gigabyte parquet seed loaded the whole thing only to reject it. It now takes the size from `stat` and reads at most the 8 KB the NUL check needs: a 191 MB file is rejected in 0.0ms at 82 MB RSS. Calling the retry helper after both phases gave each its own `attempts` budget, so a job could spend double what the descriptor asked for — the bound exists because every attempt is a real dbt invocation holding a worker slot. The budget is now the job's, spent across whichever phases fail, and the field says so. Extracting that helper had also placed it between `#[allow(clippy:: too_many_arguments)]` and `run_dbt`, taking the attribute off the 12-argument function it was written for. * fix(dbt): actually spend the retry budget `retry_failed_nodes` looped on `while *remaining > 0` and never decremented it, so a failing job reissued `dbt retry` — logging "attempt 1 of 3" each time — until the job's deadline instead of `attempts` times. The decrement existed briefly and was lost when the function was re-extracted by hand. Claiming and counting are now one operation, `claim_attempt`, because keeping them apart is exactly how the bound goes missing: the loop cannot iterate without spending the budget. Its test is bounded by its own `for` rather than by the function under test. An earlier version collected `std::iter::from_fn(|| claim_attempt(..))`, which against a non-spending `claim_attempt` is an infinite iterator — it allocated until the machine died. A test for a loop bound must fail an assertion when the bound regresses, not consume the host: it now reports `[1, 1, 1, …]` against `[1, 2, 3]` in 0.00s. * fix(dbt): ask before reading, not after Bounding `isBundledModuleFile` did nothing for the bundle builder, which read the whole file into memory and only then asked whether to keep it — so a multi-gigabyte seed beside a project was still loaded in full just to be skipped. The predicate is now consulted first, and the read happens only for files the bundle actually carries. * feat(dbt): animate the ref() edges feeding the model being built The nodes moved during a run but the edges did not, so the graph showed where dbt had got to without showing it flowing there. Reuses the canvas's existing rule rather than adding a second one: an edge animates when it touches what is happening. For a pipeline that is the running script; for dbt the unit of work is the model, so a `ref()` edge animates while its target builds. Same `animated` field, same visual language, no new styling. Verified mid-run on a 7-model project: of six `ref()` edges only the two feeding the model then building were animated, and none once the job finished. * feat(dbt): show what each model wrote, and say when its SQL is another project's Three things a reader wanted from the run graph and could not get. Row counts: the worker already records one per relation and `run_progress` already returned it, but the graph used only `status` and dropped the number. A model that built green having emitted zero rows is the failure that looks like a success, so the count is on the node. The relation's fully-qualified name, copyable: there is no table browser to open, so the next best affordance is the exact identifier to paste into a SQL client. It is parsed with `splitRelation`, which honours quoting the way the worker's `split_relation` does — splitting on every period renders `"wh"."analytics.v2"."orders"` as a relation `orders` in a schema `v2`, which does not exist. And when two projects materialize one relation, the graph keeps a single provenance winner, so the losing project's node carries the other's model. The SQL was already suppressed there — correctly, it is not this run's code — but silently, which reads as a dead click. It now says so. * fix(dbt): a finished run's graph is the models it built, not today's project `/assets/graph` is the current deploy, so an old run's graph drifted with the project: a model added after it appeared as though the run had built it, and the older the run the wronger the picture. A finished run's node set now comes from its own result, which named exactly what it touched. Sources survive the filter regardless — dbt never lists them in `run_results.json` because it does not build them, but they are the upstream the run read, and dropping them would leave the models hanging. The graph is still the current deploy's, so a model renamed or deleted since cannot be drawn at all. Rather than a silently shorter graph, the count is stated above it. Verified by adding a model after a run: the old run renders 7 models without it, a fresh run renders 8 with it. * feat(dbt): preview a model's rows with `dbt show` There was no way to see the data behind a node — only its SQL and its row count. `dbt show` selects from a model and returns rows, and every engine ships it, so the preview needs no adapter code of ours: no connection path, no dialect-correct quoting, no type coercion for ten warehouses. It runs against the profile the run already renders. It is a `dbt_command` rather than a new endpoint, so it inherits the whole job path — authorization, isolation, cancellation, logs, engine provisioning — and `limit` joins the run form beside it. That the allowlist can admit it at all is a consequence of dropping the cascade: while a successful job dispatched its deploy-time write set, a command that wrote nothing woke every consumer for relations nothing had touched. Read-only, and treated as such: no graph republish, no materialization records, no retry state, no test phase. Captured rather than streamed, like `dbt ls` — these rows are the result, not commentary, and the job-log writer is what `NO_LOGS_AT_ALL` discards. Verified: `{"dbt_command":"show","select":["stg_customers"],"limit":3}` returns three rows; a preview leaves `materialized_partition` untouched (62 → 62, 0 rows for the job); `clean` is still refused by the allowlist. * feat(dbt): preview a model's rows from the graph, and keep our locks out of dbt projects The run page could show a model's SQL and how many rows it wrote, but not the data. Selecting a model now offers "Preview rows", which runs the script with `dbt_command: show` and renders the result as a table. Explicit rather than on-select: a preview is a job, so it costs a worker slot and the engine's start-up, and previewing on every click would spend both on mere navigation. Sources are excluded — dbt shows what a model SELECTs, and a source is not one. Also: `updateModuleLocks` was the one module helper that never learned about verbatim bundles, so it walked a dbt project writing `foo.lock` beside `foo.sql`. None of those files is a Windmill script needing a lockfile, and the bundle promises to round-trip the project byte-for-byte — our artifacts have no business in it. Verified in the browser: selecting `stg_customers` and previewing returns the columns `id`/`src` and five rows from the warehouse. * fix(dbt): keep a run's models when another project owns their provenance Scoping a finished run's graph to the ids it named dropped relations whose provenance winner belongs to a different project — so a run of a project sharing a schema showed 3 of the 6 models it had built. An id that was never this run's package cannot be judged against its result, so it is kept: the relation IS one the run wrote, and hiding it understates the run. The same rule applies to the "no longer in the project" count, which otherwise reported deletions that were only provenance collisions. Previews are now cached per model and survive the selection moving. One was thrown away whenever the reader clicked elsewhere, which for a job costing a worker slot and an engine start-up meant re-running it to see it again — and the run continues in the background, so leaving and returning finds the rows there. The spinner also never span: `startIcon` takes the icon and its classes separately, so the animation has to be passed alongside. How long it took is shown with the rows. A preview is a job, and its cost should not be something the reader has to guess at. * fix(dbt): resolve argument references, clamp the show limit, flag renamed relations `handle_dbt_job` cloned `job.args` where every other executor calls `build_args_map`, so a `$var:` / `$res:` / `$encrypted:` argument reached dbt as the literal string. A placeholder holding a schema or an `enabled` flag would then build a different slice of the project than the caller asked for. `--limit` took any positive i64, and the worker buffers the whole of dbt's stdout to read the rows out of it — so a caller with only run permission could make it hold an unbounded allocation. It is clamped to a ceiling now, extracted as `show_limit` so the bound is pinned by a test rather than inline in an async function nothing can reach. And a model keeps its id when its alias or schema changes, so an old run's node showed today's relation while the run wrote another — the page asserting it had materialized a table that did not exist yet. The run's result carries the relation each node actually wrote, so the drift is detectable without a graph snapshot, and the count is stated above the graph. Rendering the run's own lineage still needs a per-job snapshot; this stops the page claiming otherwise. * fix(dbt): stop persisting resolved secrets, bound the preview by bytes Resolving `$var:` / `$res:` / `$encrypted:` for dbt — added in the previous commit — meant `save_run_state` wrote the resolved PLAINTEXT into `dbt_run_state.args` and the worker's `state.json`. The row outlives the job, so a secret stayed in the database and a later `dbt_command: retry` replayed it after the grant was revoked or the value rotated. The invocation now carries the args as submitted alongside the resolved ones, run state persists those, and the restore path resolves them again under whoever is retrying. Clamping `--limit` bounded the row COUNT, not the size: one column can hold a megabyte, so a thousand rows is a thousand megabytes, and `run_capturing` buffers all of it. The captured output has a byte ceiling now. `limit` became a built-in argument without joining `RESERVED_ARG_NAMES`, so a descriptor writing `{{ limit }}` was silently handed the preview control's default instead of being told the name is taken. Two display fixes: the relation-drift banner compared a canonicalized (lower case) asset path against the warehouse's own spelling, so it fired on every model of every finished Snowflake run; and caching a preview's failure left `Preview rows` dead for that model until reload. * feat(dbt): key the graph by script version so a run renders its own project The dbt graph was keyed by path alone, so a deploy overwrote the only copy and a run page could only ever show today's project — an older run rendered today's models, SQL and `ref()` lineage no matter what it had run. My previous attempt filtered that view to the ids the run named, which stopped it lying but could not show what was gone: the data no longer existed. `dbt_node` / `dbt_edge` now carry `script_hash` in their primary key, so each deployed version keeps its own graph, and the run page passes the version its job recorded. Per DEPLOY, not per run — ten thousand runs of one version share one graph — and a composite FK to `script (workspace_id, hash)` with ON DELETE CASCADE means a version's graph dies with it. Nothing pruned these before, because there was one copy per path; they would otherwise have accumulated with no sweep. Two deploys of one path now write disjoint rows, so the graph can no longer be lost to a race. `claim_graph_publication` remains only for what is still path-keyed — the `asset` usage rows — and an older deploy finishing late records its own graph before declining to touch those, where before it published nothing at all. A pinned request is scoped by the version's own nodes rather than by `asset`: that table describes the current deploy, so scoping through it would filter a model out of the very run that built it. Verified end to end: deployed v1 (8 models), ran it, deployed v2 with four models removed and one rewritten. The old run renders 8 models, 6 ref() edges and v1's SQL; a new run renders 4 and the v2 rewrite. * fix(dbt): scope graph cleanup to one version, bound the preview capture Archive and delete both act on a single `hash`, but the graph cleanup they called deleted every row for the path. Now that the graph is keyed per version, archiving an old version erased the live one's models, SQL and lineage, and nothing repaired it. Both callers have the path in hand, so the by-hash wrapper is gone and they use the version-scoped clear directly. `dbt show` checked its 8 MB ceiling after `wait_with_output` had already buffered everything, so the ceiling could not bound what the worker held. `run_capturing` now reads both pipes incrementally against a caller-supplied limit and kills the child on overflow. The read buffers are heap-allocated: as arrays they were baked into the future, which the job poller boxes several layers deep, and that overflowed the worker thread's stack — a `dbt show` run aborted the whole worker process. A retry's `dbt parse` ran on the arguments as submitted while the build ran on resolved ones, so a `$var:` shaping the graph parsed verbatim. The parse moves to the caller, after resolution. A run that names its own `select`/`exclude` now drops the descriptor's `selector`: dbt resolves `--selector` instead of `--select`, so passing both made a preview of one model return another's rows. Also: log instead of silently swallowing a `modules` column that fails to deserialize (pre-existing, but for dbt it means running with no project at all); keep the model SQL reachable once a preview has landed; render which node the rows came from; stringify object-valued cells; document `dbt_script_hash` in the OpenAPI spec. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: record the per-worktree dev environment and the backend-run check Three mistakes this guidance would have prevented, each of which cost a cycle: A worktree has its own database and ports, but AGENTS.md stated the single-checkout defaults as facts. Pointing `DATABASE_URL` at another worktree's database makes `cargo sqlx prepare` fail on every query touching a table your migrations added — and it deletes `.sqlx/` before it fails, so the cache is gutted rather than merely stale. Starting a backend on the wrong port leaves the UI up with every call 502ing, which reads as an application bug. Both values are now discoverable with commands that work as written. `prepare` is also documented as the wrong tool for a removal-only change: the cache is already complete for CI, and the only residue is orphaned entries that can be found by text-matching against the sources without a database. Nothing told a reader that `cargo check` does not exercise a worker path. A read buffer declared as an array inside an async block is baked into the future, and once boxed by the job poller it overflows the worker thread's stack — compiling and unit-testing clean while aborting the whole worker process at runtime. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): scope the remaining path-wide reads and clears to one version Four places still spoke for a whole path after the graph became per-version: The relation-root drift check read `dbt_node` by path with an unordered `LIMIT 1`, so with v1 at root A and v2 at root B it could answer with v1's row, suppress the refresh v2 needed, and leave v2's graph naming relations the run does not build. It now reads this job's version. `dbt_dep`'s no-resource branch cleared the path, so a descriptor edited to bring its own `profiles.yml` emptied every earlier version's graph and with it every finished run's page. The ownership being given up is the path-keyed `asset` usages cleared beside it; the graph clear is now this version's. The graph was inserted before the publication claim checked the version was still live. Archive and delete only soft-update `script`, so the foreign key still accepted an in-flight dependency job's rows and the failed claim committed them — and because pinned queries deliberately serve archived versions, deleted model SQL became readable again. The write is now gated on a `FOR UPDATE` liveness check. `clear_dbt_run_state_by_script_hash` resolved a hash to a path and deleted the path's saved run. `dbt_run_state` is keyed by path by design — one saved run per script — so archiving one version discarded the live version's resumable failure. It clears only once no live version of the path is left; `identity` already refuses a resume whose project, warehouse or engine moved. "Preview rows" ran `runScriptByPath` while the SQL beside it was pinned to a hash, so an old run showed its own SQL over today's rows. Verified end to end: with v3 deployed, the v2 run's preview runs v2's hash and returns v2's rows. Also: keep the TAIL of a captured stderr, since dbt prints its summary last; one `$derived` for the parsed result rather than five; collapse three near-identical argument accessors onto one generic; fold the single-use `copy_dir_command` into its caller; and give `parseDbtRun.ts` one status classifier instead of spelling dbt's failure vocabulary twice. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(dbt): one JobCtx down the executor, one table per adapter Two changes aimed at the operations this code will keep having: adding a phase, and adding a warehouse. `JobCtx` already bundled the five values every phase needs, and nine functions took it — but the top of the executor threaded the fields apart and rebuilt the struct at each call, so the same literal appeared eight times and each new phase meant five more parameters. It is now built once per entry point and reborrowed. `prepare_project` goes from 21 parameters to 17, `retry_failed_nodes` from 15 to 11, and `run_dbt` drops below the lint threshold. The two remaining constructions are the worker boundary, where the pieces genuinely arrive apart. `DbtAdapter` answered five questions with five parallel matches over the same eleven variants, plus a sixth list of adapters kept by hand in a test. The facts now live in one `AdapterSpec` per adapter, reached through one exhaustive match, so adding a warehouse states its name, driver, package, port, database key and licensing together and the compiler demands the arm. Each arm spreads from a Postgres base, which makes the inheritance visible per adapter instead of hidden in the `_ =>` defaults `default_port` and `database_key` used to carry. `DbtAdapter::ALL` replaces the list the test kept separately. Verified by dumping all seven facts for all eleven adapters before and after: byte-identical. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): job-keyed run progress, and stop path-wide reads and clears Six findings from the last round, in the order they bite. The publication liveness gate refused on `archived`, but `create_script` archives the parent on every redeploy — so deploying v2 while v1's dependency job was still parsing left v1 without a graph, permanently, which is the exact case the unconditional write existed to serve. It gates on `deleted` alone now; an explicit archive is still covered by the `FOR UPDATE` ordering. A project-owned `profiles.yml` trusted `profile.type` instead of reading the file. The Rust engines carry every adapter, so a CE script could declare `postgres` over a target that is `sqlserver` and have dbt connect with the enterprise adapter. The file is read whichever way, and a descriptor that disagrees with it is refused. Renaming a dbt script, or editing one so its newest version is no longer dbt, cleared the graph for the whole path — every older version's models, SQL and lineage, which their own finished runs still render. Neither needs it: graph queries join on `(path, hash)` through a `language = 'dbt'` CTE, so an old version's rows cannot attach to whatever lives at that path next. Live progress read `materialized_partition`, whose key is the relation and whose `job_id` is only the last writer. Two runs of one project took rows from each other. Progress now has its own job-keyed table; the relation table is untouched, because one row per relation is right for the pipeline canvas and fork defer. Verified with two overlapping builds: both keep 6 rows in the new table, while the old one attributes 6 to one run and 0 to the other. `Scratch::drop` removed a half-installed virtualenv synchronously from inside the job future, blocking a runtime thread; it goes to `spawn_blocking`, with a direct call when there is no runtime to hand it to. The E2E list asked for a `# on table://` subscription the deploy now refuses. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(dbt): snapshot a dynamic descriptor's graph per run A `{{ }}` placeholder in `vars` can enable a different set of models per run, so those runs re-ingest the graph. Keyed by version alone, each re-ingest overwrote the last: reopening an older run showed the newer run's project, and a model only the older run built was gone entirely — no SQL, no lineage, and nothing the saved result could colour, since it can only tint nodes that are there. `dbt_node` / `dbt_edge` gain `job_id`. A run of a dynamic descriptor writes its own snapshot under its job id and its page reads it back; a static descriptor writes the version's graph once, under a zero-UUID sentinel, and every run of it reads that. The sentinel is a value rather than NULL because `job_id` is part of the primary key and Postgres does not treat two NULLs as the same key, so each re-ingest would add a row set instead of replacing one. `/assets/graph` takes `dbt_job_id` and prefers a snapshot when one exists, falling back to the version's graph otherwise — so a run page passes it unconditionally and static descriptors are unaffected. Snapshots age out after 30 days, pruned by the runs that write them, so no background sweep has to learn about these tables. Verified end to end: one deploy, two runs of it with `extra=yes` and `extra=no` gating a model's `enabled`. The version's graph holds 6 models, run 1's snapshot 7 including `opt_extra`, run 2's 6 without it; the endpoint returns each run's own and falls back to the version's when the parameter is omitted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * perf(dbt): only snapshot a run whose graph differs, and prune from every run Two costs the per-run snapshot carried, both found by measuring it rather than by reading it. A snapshot was written for every run of a dynamic descriptor, but marking one dynamic is conservative: `graph_is_per_run` is true whenever `vars` holds a `{{ }}` placeholder or `env` holds a `$var:`, which says the arguments reach dbt and not that they change which models exist. The usual case is a date var, whose graph is identical run after run, so the table filled with copies of an unchanging picture — around 1 KB per model per run, which is a gigabyte or so a month for a 200-model project on an hourly schedule. A row set now carries a digest of its nodes, edges and relation root, and a run whose digest matches the version's writes nothing; the read already falls back to the version's graph, so those pages are unchanged. Only a run whose model set really differs pays. The prune was hung off the progress reporter, which exists only for engines that emit node events — so a Fusion or dbt-core-2x instance accumulated snapshots and never deleted any. Retention that stops working because of an engine choice is not retention; it runs detached from every dbt run instead. Verified against a descriptor with a var-gated model: the version's graph holds 8 rows, a run that resolves to that same graph stores none at all, and a run that enables the extra model stores its own 9. Both pages still render their own project — 6 assets without the extra model, 7 with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): scope every dbt_node join to the chosen snapshot `job_id` joined the key, but only the scoping CTE and `dbt_edge` were taught to filter on it. The outer node SELECT and the parent/child joins in the edge query were not, so each model came back once per retained snapshot plus once for the version's graph, and each edge matched every combination of the two — the model count multiplied and the edge join fanned out quadratically. Measured against one stored snapshot: 17 node rows where 8 are wanted, and 28 edge pairs where 7 are. The response dedup hid the edge blow-up from the payload, not from the plan, and the run page refetches the graph every two seconds. The progress table gained writers it was missing. `terminalize_running_relations` settled only the relation-keyed table, so a cancelled or killed run — the case that function exists for, since it leaves no `run_results.json` — showed every in-flight model still spinning on the run page for as long as the row lived. An agent worker cannot write the new table at all, having no database of its own, so the read falls back to the relation-keyed one when a job has no rows there. Also: a wrapped string literal missing its backslash put eighteen spaces in the middle of the profile-disagreement error; a comment still described concurrent runs of one dynamic version overwriting each other's graph, which is what keying by job removed; and the `materialized_partition` index justified itself by a run-page poll that has since moved to another table, though the closing sweep still earns it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): give a graph snapshot a marker row, and scope what reads it Five findings, four of which are the same mistake in different places: a snapshot's identity was inferred from its contents. Existence was inferred from a `dbt_node` row, so a dynamic run that disabled every model — a legitimately empty graph — read as "no snapshot" and its page showed the deployed models instead. The digest was a column repeated on every node and read back with a `LIMIT 1` carrying no `job_id`, so a run could compare itself against another run's digest and suppress a snapshot it needed. The relation-root drift check read the same rows unscoped, so after a drift it could find a previous run's root and conclude nothing had moved. `dbt_graph_snapshot` holds one row per stored graph — path, version, job, digest, timestamp. Existence is that row, the digest lives there once, the drift check reads the deployed row explicitly, and the retention sweep deletes markers first and then the rows no marker stands for. The digest is SHA-256 rather than `DefaultHasher`, whose output is documented as unstable across Rust releases: this value outlives the process that computed it, so a toolchain bump would have silently stopped every comparison matching and quietly reinstated the duplicate snapshots the digest exists to prevent. `/run_progress` ignored the view token, so a share-link viewer got the graph and was refused the progress that colours it. A preview sent only its own three arguments, so a descriptor with a required `{{ }}` var could not be previewed at all and an overridden one previewed a different relation than the page was showing. The run's arguments go first now, with the preview's three overriding. Verified on a project whose only model is var-gated: the deploy stores a marker with zero nodes, a run with the var set stores a marker with one, and the endpoint answers 0 and 1 respectively rather than showing the deployed models for both. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(dbt): squash the runtime's migrations into one Ten migrations reshaping the same three tables is a history no installation ever had. `dbt_node` gained `script_hash`, then `job_id`, then `ingested_at`, with its primary key rebuilt twice; `graph_digest` was added by one migration and dropped by the next after the digest moved to its own table. On a fresh database all of that replays to arrive at a shape the schema can simply state, and this feature has never shipped, so there is no upgrade path to preserve. One migration now creates `dbt_node`, `dbt_edge`, `dbt_graph_snapshot`, `dbt_run_state` and `dbt_run_progress` in their final shape, carrying forward the rationale each of the replaced migrations recorded. The enum additions stay in `add_dbt_lang`, since a value cannot be added and used in one transaction, and the `materialized_partition` index stays separate because it belongs to a table this feature did not introduce. Verified by rebuilding: dropped the five tables, replayed from the single migration, and confirmed the result is identical — same primary keys, the same two composite `script` foreign keys, the same seven indexes. Every `sqlx::query!` in the workspace then compiled against it, which checks each column's name, type and nullability, and a deploy plus run on the rebuilt schema produced 8 nodes, 7 edges, a snapshot marker and 6 progress rows. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): authorize snapshot reads, bound the prune, give the marker a lifecycle `dbt_job_id` is caller-supplied and selected straight from `dbt_graph_snapshot`, which carries no RLS — so a caller who could see the script could read any run's model set and relation paths, which a dynamic alias or schema can encode. Both graph queries now require the job itself to be visible, in the authed transaction, the same gate `raw_code` already applies to the script that produced it. The drift check compared against the deployed graph alone, which misses the way back: a run at root B republishes the path-keyed `asset` usages at B, and returning the profile to A then matches the deploy and skips the refresh, leaving those usages at B while dbt builds A. It reads the most recent ingest for the version instead — the one that last wrote them — ordered rather than an arbitrary `LIMIT 1`. The prune anti-joined every non-deployed node and edge with no age predicate, so each run scanned the whole retained sidecar and concurrent runs duplicated it. All three deletes share one age bound again, with the sentinel spelled as a literal so the partial indexes apply — a bound parameter cannot be proven to match the index predicate. `dbt_graph_snapshot` was the one dbt table nothing in the script lifecycle deleted: no `script` foreign key and absent from both `clear_dbt_manifest*` sites. A marker outliving its rows is read as a snapshot with no nodes, and its digest still answers the suppression check, so an identical run would write nothing and then render an empty graph. It cascades like the rows now and both clears take it. Also: the preview cleared `exclude` rather than inheriting it, since previewing a model the run excluded reached dbt as `--select m --exclude m`; and `terminalize_running_relations` no longer claims to cover a killed worker, which never reaches it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): quote profile names, record where usages were published, stop polling the graph A profile name comes from the project's own `dbt_project.yml` and a target from the descriptor, and both were interpolated into `profiles.yml` as bare YAML — including as mapping keys. A name like `prod # hidden` truncates the mapping and a newline opens a sibling key of the author's choosing. Both are rendered as quoted scalars now, as are the BigQuery keyfile's keys, with a test that asserts the document still parses to exactly the keys we wrote. The drift check read the most recent ingest, which latches: a run that returns to the deployed root re-ingests but stores no snapshot (its digest matches the version's), so the moved run's rows stay newest and every later run pays an extra parse and ingest. The publisher now records the root it published the path-keyed usages at, which is the only thing that answers "where do the current usages point" — the deploy's own root goes stale as soon as a run republishes. The run page polled `/assets/graph` every two seconds alongside progress, so it re-sent every node's SQL for the length of a run — hundreds of KB a tick on a real project, for a graph that a dynamic descriptor re-ingests exactly once before the build. It fetches once more shortly after mount and then polls progress alone. Node results carry `outcome` beside `status`. `status` stays dbt's own word, but dbt owns that vocabulary — 1.x and 2.x differ on casing and `no-op` arrived in a minor release — so publishing only it would force a break or a lie the first time it moves. `outcome` is the stable half a downstream script branches on. Also: the worker's dbt entry points are `pub(crate)`, since nothing outside the crate calls them and they resolve secrets and launch processes; and the snapshot gate records that it is RLS-only where `/jobs/run_progress` also honours a share-link token, which is a gap in what a shared page shows rather than in what it protects. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(dbt): pin the graph storage invariants against a real database Every defect review found in this area was DB-shaped — which row set a read resolves to, which rows a clear takes, whether a snapshot exists at all — and none of it is reachable from a unit test on a pure function. Four rounds established these answers and nothing guarded them, which is why each round kept finding another. Six cases, on the harness the repo already uses for schema-shaped behaviour: an identical run stores no snapshot and leaves no marker; a differing run keeps its own while the version's is untouched; an empty run graph is still a snapshot rather than an absent one; clearing one version leaves the others whole; the path-wide clear takes the markers with it; and the sweep ages out run snapshots while never touching a version's own graph. `IngestedNode` gains `Default` so a test can state the two fields a case is about rather than the eighteen it is not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * perf(dbt): bound a script's stored graphs by deploy count Run snapshots expire on a clock, but a VERSION's graph could not: its reader is every finished run of that version, and a run page is as old as its job. So nothing reclaimed them — a deploy graph went only when its `script` row was hard deleted, which Windmill does not routinely do. A CI deploying on every commit added a full model set with SQL bodies per commit, forever: roughly 200 KB a deploy for a 200-model project, which is gigabytes a year across an instance. Bounded by COUNT instead of age, since age is the thing that cannot be right here. The newest 50 deploys per path keep their graph and older ones are reclaimed, making growth `versions x models` rather than unbounded in time. Generous on purpose: reaching the bound empties that version's run pages, so it exists to stop unbounded growth rather than to be hit in normal use. Ordered by the script's own `created_at`, so a late-finishing job re-ingesting an old version cannot promote it. Pinned by a test that deploys past the bound and asserts both halves: the count holds, and the newest version is always among the survivors. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): let the run page know when its snapshot has landed The one-shot graph refetch was wrong: a dynamic descriptor's ingest happens before the build but after cloning, dependency install and parse, so a fixed delay either fires too early — and the run page then shows the deployed models for the whole run, never that run's own — or keeps re-sending the whole graph for the length of it. Neither is a timing problem to tune; the page had no way to tell "the snapshot is not written yet" from "this run has none". `/assets/graph` answers that directly: `dbt_snapshot_job` is the job the dbt half resolved from, when one was asked for and found. The page polls the graph until that is its own job, and stops. A static descriptor never snapshots, so an attempt cap ends it there rather than polling for the run's duration. `dbt_node.relation_root` is gone. The drift check moved to the marker's `published_relation_root`, which left the column written on every node and read by nothing. `outcome` was published as the stable half of the result contract, but the in-tree consumer still ranked and coloured from dbt's own word — so the field existed and nothing used it. `statusRank` takes it, `DbtRunResult` passes it, and `classifyStatus` is documented as the fallback for results that predate it and for the live event stream, which carries dbt's word alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(dbt): record what a share-link viewer actually sees The comment at the snapshot gate said the graph "falls back to the deployed set", which is only the rarer half of it. A share link is an extra grant for a logged-in user who lacks access to the job, so the usual case is no read on the script either — and then the `live` CTE matches nothing and the whole dbt half comes back empty. A blank Models panel over working progress rows, not a fallback. `docs/dbt-runtime.md` now carries the analysis a follow-up needs: that relaxing this leaks nothing, because `v2_job_completed.result` already gives that viewer every node's `unique_id` and `relation_name` — the graph's only incremental exposure is `raw_code`, which is gated separately on seeing the script. And the shape of the fix: `OptViewToken` and `validate_view_token` are self-contained enough to move into `windmill-api-auth`, which `windmill-api-assets` already depends on, after which the gate can honour a token for that job's snapshot alone while `raw_code` stays where it is. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): keep model SQL behind the scripts:read scope, and unbreak CI `/assets/graph` is authorized as `assets:read`, and RLS decides whether the caller can see the script that produced a node — but RLS is not a scoped token's grants. A token deliberately narrowed to `assets:read` could therefore read model source and repository paths for scripts outside its `scripts:read` paths. The same `build_scope_path_predicate` the macro endpoint already applies now gates `raw_code` and `original_file_path`; the relation's shape is unaffected, only its body is withheld. `DbtAdapter::ALL` exists for the tests that must cover every adapter, so it is dead in a release build and `-D warnings` failed all four backend checks on it. It is `#[cfg(test)]` now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): stop the graph poll at the ingest, and type `limit` in the schema The poll's stop condition was a snapshot appearing, with a 40-attempt cap behind it — so a STATIC descriptor, which never snapshots, took the cap every time and re-fetched the whole graph forty times. That is most of what removing the poll was meant to save, and static is the common case. The ingest runs BEFORE the build, so the first model to report progress proves it has already happened: a snapshot absent by then is one this run never writes. Progress arriving is now the second exit, and the cap is only a backstop for a run that reports none at all. `limit` is declared `Typ::Int` but `dbt_arg_schema` had no integer arm, so the run form and the generated clients saw an untyped default and offered no numeric control for a value the worker clamps. Covered by the schema test. `relationOutcome` still re-derived from dbt's word while `statusRank` had moved to `outcome`; both read it now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): make a retry prove its arguments still resolve the same The saved arguments are the ones SUBMITTED, so a `$var:` in them is re-resolved on retry. The identity did not cover the resolved values, so a variable that changed between the failed run and the retry was accepted — and which graph the retry then used depended on WHERE it landed: a worker holding the local snapshot replays the saved manifest, while a database restore reparses with the new value. Placement decided whether the resumed failures described the relations being built. The identity gains a digest of the resolved arguments, and is compared in two halves because resolution happens between them. Project, warehouse, engine and env are checkable up front; the arguments are not, because a retry request carries only `dbt_command` and the ones to compare are the SAVED arguments after this caller has re-resolved them. Comparing the whole string up front would have refused every retry — which is what the obvious version of this fix does. A row written before the digest existed has no last segment, and still restores rather than being refused. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): keep pre-upgrade retries working, and stop losing a late snapshot Splitting the identity on its last `|` read a pre-upgrade row's env digest as an arguments digest and left only `<run_identity>` as the prefix, so every saved failure on an upgraded instance became unretryable — a regression the previous commit's own test missed by using an identity with no `|` in it at all, which is not what an old one looks like. The digest is tagged (`|args=`) rather than positional, and the test now uses a real pre-upgrade identity. The graph poll gave up after a bounded number of tries, but provisioning and `dbt deps` precede the ingest and can outlast that on a cold worker — and the engines that emit no node events never produce the progress that ends it early. A finished run now reloads the graph unconditionally, and the poll's own exit issues one last load: progress proves the ingest happened, not that the previous tick saw it, and dbt's compile window is wider than one tick. A `dbt retry` restores the failed run's arguments inside the worker and they are never written back to the retry job, whose own args are just `{"dbt_command": "retry"}` — so previewing a row on a retry's page ran without the vars the run used. The result now carries the invocation's arguments as SUBMITTED, so a `$var:` stays a reference and no resolved value is published. The deploy-count sweep ran instance-wide on every dbt run: `FROM script WHERE language = 'dbt'` has no index to stand on, and both orphan deletes are the complement of every partial index here. It is scoped to the running script's `(workspace_id, path)` — which `index_script_on_path_created_at` serves — and the orphan deletes only run when a marker actually went. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): hide dbt from module-less pickers, and stabilise the retry digests `processLangs` feeds every language picker, including flow steps and app inline scripts. Those are raw bodies with nowhere to carry a module bundle, and a dbt script IS its bundle — so choosing dbt there produced a job that could only fail once the worker looked for `dbt_project.yml`. Those two surfaces use `processInlineLangs`, which drops the languages that need modules; a flow still reaches dbt the way it reaches any script, by path to a deployed one. `graph_digest` moved to SHA-256 because it is persisted and compared by a later worker, and `DefaultHasher` is documented as unstable across Rust releases — but the retry identity's own digests were left on it, and they are persisted in `dbt_run_state.identity` for exactly the same comparison. A toolchain bump would have refused every saved failure as a different project. All three go through one `stable_digest`, length-prefixed so no split of the same bytes collides. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): enforce the tag scope on snapshot reads, reset state between runs A tag scope is an orthogonal hard restriction: a token limited to some tags must not read a job outside them however else it is authorized. The snapshot lookup went through `v2_job` RLS alone, which knows nothing about tags, so such a token could still retrieve a run's model set and its dynamic relation paths. The same predicate `require_job_read_access` applies for the progress half of the page is applied here — `get_scope_tags` is already public in `windmill-api-auth`, and it is `None` for an unscoped caller, so a normal session pays nothing. SvelteKit reuses the run graph between run ids, and `graphTries`, `polled` and `raw` all describe the previous job: a spent retry count stopped the next run's snapshot poll before it began, and stale progress coloured its models with another run's statuses. All three reset when the graph key changes. Also a wrapped string literal missing its backslashes, which put two ~22-space runs in the middle of the retry-refusal message. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(dbt): put each digest helper's rationale on its own function Inserting `stable_digest` above `split_identity` split that function's doc, so five lines describing where the identity divides ended up introducing the hasher. Each is back on the function it describes, stated once. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(dbt): read the run-pinned graph through the job, not the asset graph Pinning the asset graph to one run is job-scoped data, but `dbt_job_id` sat on `/assets/graph`, authorized as `assets:read`. The job-read contract — `require_job_read_access` — is five parts that pull in opposite directions (tag scope restrictive, `created_by` permissive, app-embed restrictive-overriding, view token permissive, RLS underneath), so plain RLS is neither a stricter nor a looser approximation of it. Restating the parts near the graph query kept leaving one out: first the job check entirely, then the share-link asymmetry, then the tag scope, and the app-embed restriction was still missing and failing open. The helper cannot be called from `windmill-api-assets`, because `windmill-api` depends on that crate. So move the read instead of the check: the run-pinned graph is now `GET /w/{w_id}/jobs/dbt_graph/{id}` in `windmill-api`, on the same gate as the `run_progress` it colours, and `/assets/graph` has no `dbt_job_id` parameter at all. - `asset_graph_for` takes the job as an argument from an already-authorized caller; the route handler passes `None`. - Extract the graph response into a `AssetGraph` component schema, now that two paths return it. - The run page fetches the job route when it has a job id. * fix(dbt): charge assets:read on the run-graph route, trust the job gate in SQL Round 13 findings on the route moved last commit. The scope domain comes from the URL segment, so putting the read under `/jobs` asked a scoped token for `jobs:read` alone while returning asset-graph data that `/assets/graph` charges `assets:read` for. A token narrowed to polling run status could read workspace topology, and the missing-job fallback made it cheaper still — any random UUID skipped the job gate. Both scopes are now required: the job gate reaches this run, `assets:read` reaches asset data at all. The `chosen` CTE re-decided job visibility under plain RLS after the caller had already passed `require_job_read_access`. It could only disagree, and did so silently by falling back to the deployed graph — a share-link viewer entitled to the run was shown a different run's model set. Dropped; the contract is that a job reaching `asset_graph_for` is already authorized. Also: the flow editor's `+` insert menu still offered dbt (the third `processLangs` caller, missed when the other two moved to `processInlineLangs`), the docs still described the deleted `dbt_job_id` parameter, and the new handler had again been inserted between `get_run_progress`'s doc comment and its function. * fix(dbt): resolve a pinned run's version from the job row, not script RLS Local codex review of the branch. A share-link viewer is entitled to the run and usually has no grant on the project — that is what the link works around. The graph's `live` CTE resolved the version by selecting `script` inside the viewer's RLS transaction, so it answered for their access to the project rather than for the run they were given: the Models panel came back blank beneath working progress rows. A pinned run now takes its path and hash from the job row the handler already read after authorizing the job, so `live` does not consult `script` at all. `raw_code` keeps its own `EXISTS` against `script`, so the model bodies stay behind access to the project. Verified under RLS as an unprivileged role: the shape query goes 0 rows -> 1, the `raw_code` gate stays 0. Taking the version from the job also means a caller can no longer pin one project's version while naming another's run, since `dbt_script_hash` is ignored when a job is given. The run page's graph fetch is a raw `fetch`, which bypasses the interceptor that adds `X-View-Token` to generated-client calls, so a shared page was refused before any of this mattered; it goes through `appendViewToken` now. Also trims three comments to the AGENTS.md limit, dropping drafting-history rationale that belongs in docs/dbt-runtime.md. * fix(dbt): snapshot vars-overridden runs, carry the pinned version everywhere Second local codex pass. A `vars` run argument overrides the descriptor's, and vars drive `enabled`, alias, schema, database and materialization — so such a run builds relations the deployed graph does not describe. It now snapshots under its own job id, which per-job keying makes safe: the version's graph stays for runs that did not override. The old comment claimed gating on it would strand the override's graph for the next default run, which was true only when the write went to the deployed slot. Two sites still read the caller's `dbt_script_hash` instead of the version resolved from the job, so `/jobs/dbt_graph/{id}` without that redundant parameter dropped models the run's version had and a later deploy removed. The `dbt_snapshot_job` marker re-checked `v2_job` under RLS — the recheck the graph query itself drops. A share-link viewer got the right graph and a null marker, so the run page refetched it 40 times before giving up. `wmill script preview` read the bundle with the generic `__mod` suffix and script-module parsing, so previewing a `.dbt.yaml` omitted the project and failed on the missing `dbt_project.yml`. It uses the same suffix and verbatim read as deploy. * fix(dbt): key retry state by principal, not by script path alone `dbt_run_state` held one row per (workspace, script path), and a retry replaces the caller's arguments with the saved ones. Anyone able to run the script could therefore retry whoever ran it last, replaying that run's literal `select` and `vars` against the warehouse and publishing them as their own job's `invocation_args`. Running the script was already theirs to do; seeing another principal's arguments was not. `permissioned_as` joins the key, so a retry resumes only state written under the same authority. Two runs sharing an authority can already act for each other, so this is the boundary that matches the rest of the job model. * test(dbt): pin what a caller without access to the project sees of its run The share-link case had no regression guard, and every fix in this area touched one of its two halves: the graph's SHAPE has to survive a caller who cannot read the script, and the model SQL must not. Two cases against a real database, calling `asset_graph_for` as a member with no grant on the project's folder: pinned to a run, the models render and `raw_code` is withheld; unpinned, the same caller sees nothing of it, so making the first work did not relax the second. Both assertions were checked by mutation — reverting the `live` bypass empties the graph, and dropping the `raw_code` script gate leaks `select 1` — so neither passes on the code it is meant to catch. * fix(dbt): key the worker-local retry cache by principal too Keying `dbt_run_state` by `permissioned_as` left its worker-local twin keyed by workspace and script path alone, so the boundary held only where the database row was consulted. An agent worker never reads that table — `Connection::Http` leaves `latest_job` as `None` — so there the local cache was the whole boundary and it had none: the next principal to retry the script on that worker restored the previous one's `select` and `vars`. Also records the sqlx `--all-targets` trap in the update-sqlx skill: it is needed for queries inside tests, and in a CE checkout it aborts on `tests/otel.rs` (EE-only `otel_ee`) after having already emptied the cache. * fix(dbt): log a dropped retry-state save, correct the run-progress contract Saving retry state is best-effort — losing it costs a retry, not the run that just finished — but `.ok()` dropped the reason too. The only symptom was `dbt retry` reporting nothing to resume, which reads as a bug in retry rather than a failed write. Found by running a real failing build against a worker whose binary predated the `permissioned_as` column: the insert violated NOT NULL and said nothing. The run-progress endpoint's OpenAPI description promised an empty list for a caller who cannot see the job. It is refused instead; an empty list means the job recorded nothing yet or is unknown here. * fix(dbt): return the retry-state write failure the warning was added to report `save_run_state` discarded the insert result, so the caller's warning could never fire and a lost retry row stayed silent — the symptom being `dbt retry` finding nothing on another worker. The error is held rather than returned at once: the worker-local copy is what an agent worker resumes from, so a failed insert must not cost that too. Every exit after it surfaces it, including the ones that give up on the local save. * fix(dbt): decide a retry's graph from its restored args, keep local state in step Three from the seventh local review. A retry submits only `dbt_command`, so the vars-override check ran against an empty argument set and left `graph_is_per_run` false. The failed run's arguments are restored afterwards, and those are what the retry builds with — an overridden one wrote no snapshot for its own job and its page fell back to the deployed graph, showing the wrong enabled models, aliases and schemas. The decision is re-asked once the restore has happened. A failed durable write no longer publishes the worker-local generation either. `restore` accepts a local generation only when the database row names it, so publishing one the database never recorded made this worker reject its own newest state and resume the previous run's — its selection and vars, or "nothing to retry" if that one had succeeded. An agent worker attempts no durable write, so it keeps its local copy as before. A rename that also converts away from dbt moved the old path's retry state onto the new one, reinstating what the conversion had just cleared and leaving one user's arguments and results under a path no dbt script occupies. It moves only while the destination stays dbt, and clears the source otherwise. * fix(dbt): drop retry state when a run produced none, let module pushes fail loudly Three from the eighth local review. A run that never wrote `run_results.json` — cancelled, timed out, or dead before dbt got there — left the PREVIOUS run's state authoritative in both the database and the local pointer, so a later `dbt retry` resumed that older invocation's failed nodes. Producing nothing resumable now clears both copies, so neither can answer for the other. `wmill sync push` wrapped the descriptor lookup and its deployment in one try/catch meant for a missing parent. Any API failure or invalid descriptor was reported as "no parent found" and swallowed, so a module-only push exited zero with the remote project unchanged. Only the lookup is tolerated now. Also condenses a comment that narrated how earlier status comparisons behaved. * fix(dbt): forget retry state on pre-build exits too, drop cascade claims A dynamic run whose pre-build `dbt parse` or graph ingest fails returns before the save that clears stale state, so the previous run stayed authoritative in both the database and the local pointer and `dbt retry` resumed ITS failed nodes — writing relations the run that just failed never touched. Both exits now invalidate, through one helper shared with the no-artifact case. Two frontend comments described dbt producer rows as driving cascade dispatch. The executor returns before dispatch for every dbt job and deployment rejects `table://` subscriptions, so they promised behaviour that cannot occur; they describe the lineage and ownership that is actually retained. * fix(dbt): let the database decide retry state where it is reachable A SQL worker treated "no `dbt_run_state` row" as no opinion and accepted any worker-local generation. But no row is the authoritative answer that the last invocation left nothing resumable, so a local pointer that outlived it — an unlink that failed, a process killed between the delete and the removal, a stale cache — resurrected a replaced run and let `dbt retry` write relations it never touched. An agent worker keeps accepting its local copy: it has no authority to consult. Invalidation failures are logged rather than dropped, since a silent one is exactly what leaves the pointer behind. * docs(dbt): record how to run an agent worker locally, keep archived graphs Every step of standing one up fails as something else: a normal build cannot start one at all, the server's routes need a separate feature, and all three token mistakes surface as a bare 401 on the agent with the reason only in the server log. Written down with the error each produces. Also keeps a dbt script's graph when it is ARCHIVED rather than deleted. The pinned read resolves versions through a CTE that already skips archived rows, so clearing bought nothing and emptied the Models panel of every completed run of the project. Deletion still clears it. * feat(dbt): let an agent worker publish its graph, through one endpoint An agent worker was refused any dbt script whose profile comes from a Windmill resource — the common case — because it could neither read the stored relation root to check for drift nor re-ingest a corrected one. Those look like two needs but collapse into one: verification exists only to decide whether the stored graph still describes reality, so a worker that can PUBLISH never has to ask. It stores what it just parsed. `POST /api/agent_workers/dbt_graph/{workspace_id}` is the whole addition. It wraps the same `replace_dbt_manifest` the SQL path calls, so digest suppression, the marker write and retention cannot drift between the two transports, and it refuses a job the token's tags do not cover. `IngestedManifest`/`IngestedNode` gain Deserialize to cross the wire. Two guards go, both now false: the pre-build refusal, and the `Connection::Sql` gate added earlier to stop a `vars` override grounding an agent run. Live progress stays SQL-only — that is a per-model event stream, and routing it through the API would mean a round trip per node. * docs(dbt): warn that a differing cargo feature set swaps the shared binary * docs(dbt): record the verified agent-worker behaviour and the tmpfs quota trap An agent worker now runs a dbt job end to end, retries, and publishes its graph — confirmed with a dynamic descriptor whose per-run snapshot came back through the new endpoint. The doc said it was refused; that was true before the endpoint existed. Also `WINDMILL_DIR`: on a dev box the job dies with `Disk quota exceeded (os error 122)` writing the project's files while `df` shows free space AND free inodes, because /tmp is a tmpfs carrying a per-USER quota. Point the worker at a real disk rather than trying to clean up beneath it. * chore(dbt): pin the EE revision carrying the agent graph endpoint * fix(dbt): bind the published graph to the job, break the completed-page poll loop Five from the thirteenth local review. The EE endpoint took `script_path` and `script_hash` from the payload and checked only that the supplied job carried one of the agent's tags, so an agent holding any matching-tag job could name another script and replace its graph. Both are read from the verified queue row now and the request carries only the job id. A raw preview has no version, so it no-ops rather than 422ing before dbt runs. `IngestedManifest`/`IngestedNode` take `#[serde(default)]`: they were serialize-only, and a field the serializer skips made the whole manifest unparseable on the receiving side. A completed run page fetched the graph forever — `load()` assigns `raw`, which recomputes `settled`, which re-entered the same effect. The final fetch is keyed to the job by a plain (non-reactive) variable, and `settled` is read untracked. The pin now names a revision that compiles: the previous one still called `authed.tags()`, a method that does not exist, because both that fix and the JSON response landed after it was committed. * fix(dbt): keep a run snapshot out of the script's deployed ownership Everything `persist_ingest` writes after the manifest is keyed by PATH — one row set per script, describing what is deployed there. A run snapshot was still reaching it, so a one-off `vars` override republished that invocation's relations as the script's ownership and the workspace graph stayed on the override's schemas and aliases: an ordinary run of a static descriptor never ingests again to correct it, so only a redeploy would. A snapshot now stops after recording its own rows. The row preview also selected a bare model name, which dbt resolves across every installed package while `show` takes a single node — a project model sharing its name with a package's was previewed wrongly or refused. It selects the package-qualified FQN. * fix(dbt): forget stale retry state when preparation itself fails `prepare_project` runs before every path that could clear it, and it fails for reasons unrelated to the saved run — a profile that stopped resolving, a provision cancelled, packages that will not install. The invocation still left nothing resumable, so the previous one must not stay authoritative: a repaired project would otherwise let `dbt retry` rebuild an older run's selection and write relations the latest invocation never reached. A retry is exempt, since it is trying to use that state and failing to prepare says nothing about it. Also corrects the runtime doc, which still described agent workers as unable to run dynamic descriptors or Windmill-resolved profiles. They publish their graph through the API now; what they do not get is live progress and a durable retry row, and the doc says so. * fix(dbt): spell the whole FQN for preview, bound retained retry generations The FQN selector added last commit was `<package>.<name>`, but a dbt FQN is the resource's path within its package and the matcher must consume the selector and end on equal lengths — so it matched nothing for a model under `models/marts/`, which is the layout most projects use and the one this repo's own complex fixture has. The middle segments come from `original_file_path`, whose first element is the resource root the FQN excludes. Without a path it falls back to the bare name: ambiguous across packages, but a selector dbt resolves rather than rejects. Tested on a nested model, which is the input that separates the three spellings. Superseded retry generations were removed only when a later run published one, and never inside the hour-long grace period — so a burst left a manifest and a results copy per run with nothing afterwards to collect them. At most four now sit in the grace window, oldest evicted first. * fix(dbt): scope preview state to the run, seed the project on a language switch Previews are keyed by `unique_id`, which is the same string for the same model in every run, and the run-change effect reset only the graph and progress. Opening a second run of one project therefore showed the previous run's rows immediately, and `runPreview` treated them as cached and refused to fetch. A generation counter also drops a preview that resolves after navigation, which the reset alone cannot catch. The dbt project was seeded only by the empty-script bootstrap, but dbt is in the ordinary language picker: reaching it by switching a draft produced a script with no `dbt_project.yml`, which the runtime refuses to deploy or run. Both entry points seed now, and neither touches modules that already exist. * chore(dbt): cache the agent graph endpoint's query for the EE offline build * fix(dbt): publish the graph a moved profile built A run snapshot stopped before everything `persist_ingest` keys by PATH, which is right for a one-off `vars` override and wrong for the other two reasons a run re-ingests. `graph_is_per_run` was one bool for all of them, and the profile drift check both sets it and reads back what the publisher recorded: a profile moved A->B was detected by every run forever, each paying a `dbt parse` for a snapshot nobody reads while the asset rows went on naming schema A. The reason is carried now (`GraphRefresh`), and it decides both writes. Drift is the version's own move, so it rewrites the VERSION's graph and republishes the ownership that ends the drift; a dynamic descriptor snapshots under its job id and still publishes; anything the CALLER scoped — an overridden `vars`, a narrowed `select` — snapshots and publishes nothing, so one invocation's subset can neither stand as what the script owns nor drop the models it left out from the version's graph. Where they meet the caller wins, and the next ordinary run settles the drift. A restore also rebuilt `run_results.json` by copying the generation directory a second time, so a burst of saves pruning it mid-restore left `dbt retry` with nothing to resume and a job that reported success. It is written from the bytes the restore already read; a manifest that went the same way falls back to the parse a database restore pays anyway, and a generation that vanished before either read falls back to the database's row for that same run instead of reporting there is nothing to retry. * fix(dbt): select a row preview by package, not by file path The preview built dbt's FQN by dropping one segment of `original_file_path`, which assumes the model root is `models/`. A project setting `model-paths: ["src/models"]` turned `src/models/marts/orders.sql` into `pkg.models.marts.orders`, and dbt's matcher — equal lengths, compared from the front — resolves that to nothing: the preview came back empty for every model in the project. It selects `<name>,package:<pkg>` instead. The comma is dbt's intersection operator, so this names the node by its own name and the package it belongs to, which is what the FQN was reaching for and needs no knowledge of the resource root. Verified on dbt-core 1.12, dbt-core 2.0.0-alpha.5 and fusion 2.0.0-preview.202, including a package shipping a model whose name the root project also uses. * fix(dbt): refuse a lockfile version that is not one, keep a named selector Two things a preview reaches that a deploy does not vouch for. A raw preview submits its own `lock`, so `engine_version` arrives from the caller and was interpolated straight into the engine cache path — `../..` in it made the download, extraction and rename land anywhere the worker can write, and provisioning runs on the host rather than inside the dbt jail. Both it and `adapter_version` (a pip requirement) are now accepted only as a plain version token. `effective_selector` also read any submitted `select`/`exclude` as an override of the descriptor's named selector. The generated run form posts a default back for every field the caller left untouched, and a selector descriptor's `select` default is `[]` — so pressing Test, saving a schedule or firing a webhook built the WHOLE project instead of `--selector nightly`. An override is now one that DIFFERS from the descriptor's own value; a run that wants the whole project despite the selector asks with `["*"]`. * fix(dbt): let a moved profile settle, from the runs that actually happen Two ways the drift check could never come to rest, both verified against a real run of a real project on a normal worker. `add_caller_args` read any submitted `select`/`exclude` as a caller's narrowing. The generated run form posts a default back for every field left untouched, so every run from the UI, a schedule, a webhook or a flow step carried them and was marked caller-scoped: with the profile moved A->B, each one stored its models under its own job id and left the workspace graph — and the root the check reads back — at A. Since no UI run omits the field, the "an ordinary run settles it" escape hatch was unreachable. Both this and `effective_selector` now ask one question, `selection_is_overridden`: DIFFERENT from the descriptor's, not merely submitted. The root was also recorded beside the path-keyed publication rather than beside the graph it describes, so a version that cannot claim the path — an older one run by hash, a deploy overtaken by a newer one — rewrote its graph at the moved root and recorded nothing. Its next run then compared against a root that was absent or two moves stale and skipped the refresh its own run page needed. It is written wherever the deployed row's graph is. Verified end to end: same UI-shaped arguments before and after, the moved profile now republishes (asset rows and version graph both move to the new schema), a second run detects nothing and re-parses nothing, and moving the profile back settles it again. `prune_dbt_run_graphs` also ran from runs alone, while a deploy writes a whole node set of its own, `raw_code` per model included: a project redeployed on every push by CI and run nightly kept one full graph per push until the next run, and one deployed but never run kept them for good. * fix(dbt): drop a self-dependent effect in the run graph `previewGen` was `$state` written by the effect that also reads it, three lines under a `finalLoadFor` that is a plain `let` for exactly that reason. Nothing reactive reads it — the only reads are inside `runPreview`, a plain async function — so it becomes a plain `let` too. * fix(dbt): pin a retry to the engine versions it resolved `run_identity` carried the engine KIND but not the version it resolved, nor the dbt-core 1.x adapter's. Redeploy an unchanged project after a release and it locks a newer dbt or adapter while the saved `run_results.json` still passes the check, so `dbt retry` feeds one version's artifacts to another — the exact reproducibility the lockfile exists to hold. Both resolved versions are in the identity now; a real failure and retry still resumes. Also drops three comments that outlived what they describe: two said `[]` clears a descriptor's selector, which `selection_is_overridden` reversed, and one pointed at an agent-worker guard that no longer exists — the agent path reaches the ingest deliberately and publishes through the API. * fix(dbt): discard a run graph the page has already navigated away from The component is reused across runs, so a slow `/jobs/dbt_graph` or progress response could land after the reset and put the previous run's models, statuses and failure state on the current run's page, where nothing would fetch again to correct it. Every response is now checked against the generation it was requested under — the counter the preview path already used, renamed for what it means. The graph poll also backs off. Neither of its stops is reachable for a whole class of runs — `dbt_snapshot_job` never matches a static descriptor, and `polled` stays empty for the engines that emit no node events — so an ordinary run walked to the cap, re-sending every model's SQL 40 times in two minutes. * fix(dbt): forget the previous run when the durable save fails, keep quoting `save_run_state` returns the database error when its upsert fails, which leaves run N-1's row and local generation in place: same project, same arguments, so a `dbt retry` matches them and resumes an older attempt's failed nodes against this checkout — the outcome the no-results branch twelve lines above calls `invalidate_run_state` to prevent, reached by another door. It now goes through the same call. Best effort, since the delete goes to the database that just refused a write, but the local pointer is what a retry landing back here reads. The run page also rejoined a relation's parts after `splitRelation` stripped their quotes, so the one name the button exists to paste — `"wh"."analytics.v2"."Order Items"` — was copied as something no client resolves. It copies `relation_name` verbatim. And a source on a finished run was called another project's: the check that guards against two projects claiming one relation asks whether this run executed the node, and a run executes no sources — they appear in no `run_results.json`. Nothing materializes a source, so that warning could never be true of one. Docs: the `vars`-override paragraph still said such a run does not refresh the graph, which the table above it contradicts — it refreshes under its job id and publishes nothing. * fix(dbt): keep the asset rows and the version's models describing one graph The workspace graph takes an asset's relations from the path-keyed `asset` rows and its models, SQL, tests and lineage from the version's `dbt_node`/`dbt_edge`. A dynamic descriptor published the former while storing the latter under its own job id, so a placeholder that moved an alias or a schema left the current graph with assets no model stands behind — nothing dbt contributes to them survives. Ownership is published exactly when the VERSION's graph was written now, which is the only state in which the two agree. Two cases are settled elsewhere by design: an override's relations are a one-off, and a dynamic descriptor at a moved profile keeps the deploy's ownership until a redeploy — its runs each show their own models and it re-parses regardless, so the undetected drift costs it nothing it was not already paying. An agent worker has no durable row, so its local `current` pointer is the whole of what a retry reads — and every local publication failure returned success with the PREVIOUS run's pointer still in place. Where a row exists that is harmless (`restore` takes a local generation only when the row names it), so the abandonment is scoped to the agent case. A failed `dbt show` also cleared the retry state: the preparation-failure exempts `retry` but not a read-only command, and the run page's row preview is exactly that, run as the principal the state is keyed by — so a preview that could not provision took the retry away from the run being looked at. Frontend: the run-change reset left `loading` and `failed` behind, so the gap before the next run's answer rendered "no models in the asset graph" — a claim about the descriptor — over a project that is fine. And three derivations argued from "the graph is the current deploy", which the pinned endpoint made untrue; each is still needed, for the version-graph rewrite and retention reasons now written down. * fix(cli): let --skip-scripts cover a script's module files The module shortcut in `elementsToMap` maps the file and `continue`s before every skip filter, and a module is deployed as part of its parent script — so `wmill sync push --skip-scripts` still pushed the script whenever one of its modules changed, and pull still overwrote them locally. Harmless while a module was a rare helper file; every file of a dbt project is one of these now. * docs(dbt): a dynamic descriptor's ownership stays the deploy's * fix(dbt): read the run out of a failure whose message has braces of its own `parseDbtRun` anchored on the FIRST `{` in the error message and parsed everything after it. The worker appends the structured result after the error text, and dbt's errors carry braces — a Jinja template, the compiled SQL, an adapter's own JSON — so the failures most worth reading were the ones whose summary and per-node outcomes the run page dropped. Every brace is tried now, bounded, and the first that parses as a run wins. Pins the EE revision that gives the agent publish endpoint the deleted-version guard the SQL path takes: deletion is soft, the foreign key still accepts graph rows, and the pinned graph query serves non-live versions, so an agent finishing during a delete put a deleted project's model SQL back on screen. The query is byte-identical to `persist_ingest`'s, so the offline cache already covers it — verified with a full-EE `SQLX_OFFLINE=true` check. * fix(dbt): seed a project when a modular draft switches to dbt `seedDbtProject` returned whenever the draft carried any module at all, so a modular script holding a `helper.ts` reached dbt with none of what dbt needs: the project view is read-only, and the worker refuses a bundle without `dbt_project.yml`, so that draft could neither run nor deploy. Keyed on the project file now, and the seed goes in under whatever is already there — the previous language's helpers are inert to dbt and the user's to remove. Also records this runtime's schema in `backend/summarized_schema.txt`: the `table` asset kind, the `dbt` script language, the five dbt tables and the `materialization_status` enum the progress table uses. * docs(dbt): move the pipeline-membership rationale out of the deploy path * fix(dbt): gate a pinned run's model SQL on the version it belongs to The `EXISTS` against `script` is the only thing standing between a share-link viewer and the project's source, and it matched the workspace and path alone. `extra_perms` is a grant on a ROW: archive a version that granted someone access, recreate the path with narrower permissions, and that stale grant satisfied the probe while the query returned the NEW version's `raw_code`. Both probes name the hash now. The regression test drives exactly that shape and fails without it, returning `select 2` to a caller granted only on the archived version. * fix(dbt): keep a delimiter an identifier escaped by doubling Every dialect these relations come from escapes its own delimiter by doubling it, and both split functions closed the quoted section on the first half and reopened on the second: `"schema"."a""b"` came out as `a.b`. The manifest keeps the real spelling, so the run wrote its per-model status and row counts under an asset path no graph node has — the node simply never moves, which is the failure mode this splitter exists to prevent. Fixed in the worker and in its frontend mirror, which have to agree, with a case per delimiter on both sides. * fix(dbt): key retry state by the caller, not only by the principal it runs as An `on_behalf_of` script executes every caller's job as its owner, so `permissioned_as` names one principal for all of them and the retry state — the durable row and the worker-local generation both — collapsed onto a single entry. After one caller's run failed, the next could submit `dbt_command: retry` and resume it: their arguments replayed against the warehouse, and handed back through `invocation_args`. Nothing else separated them, and on an agent worker the local directory is the whole boundary. `created_by` joins the key in both places. For an ordinary script it changes nothing — `permissioned_as` is already that caller — and a run that was itself superseded was never resumable anyway. Includes the offline cache for the four changed queries and the three the pinned-graph regression test added last commit, which had none: `prepare` without `--all-targets` does not compile test targets, so CI's `SQLX_OFFLINE=true ... --all-targets` would have failed on them. * fix(dbt): compare the schema too when reporting a relation that moved `relationDrift` compared the leaf name alone, and the move it exists to report — a profile repointed at another schema, which a later run then writes into the version's graph — leaves every model's name exactly where it was. So the one case that reliably produces a graph naming relations this run did not write was the one case the notice stayed silent for. The schema segment joins the comparison, qualified against qualified: an unqualified one means the target's own database, which the relation names anyway, so comparing that would report a move on every node. * fix(dbt): bound the retry state now that it is keyed per caller Keying by `created_by` fixed one caller resuming another's run and created a growth problem doing it: a shared `on_behalf_of` script kept one row and one worker directory for everyone who had ever run it, and the generation prune only bounds files INSIDE a directory. Three bounds, none of them new machinery. A run with nothing failed or skipped saves nothing — `dbt retry` builds from those nodes alone, so that state could only ever be refused — while still clearing what the previous run left, since its failures are no longer what last happened here. The rows expire on the same 30-day clock as a run snapshot, swept per path by the prune every dbt job already spawns. And the worker-local directories are swept there too, by the age of the pointer a save rewrites, because their digest names neither the script nor the caller. * docs(dbt): the retry state is worker-affine only on an agent worker * fix(auth): only the server may set a token label that names a user `create_token_internal` wrote `NewToken.label` verbatim, and the auth layer reads some labels as an IDENTITY: `username_override_from_label` maps `ephemeral-script-end-user-<name>` to exactly `<name>`, which then becomes `created_by` on every job that token pushes. The label is free-form request input, so any member could mint a token that speaks as somebody else — the shape `require_job_read_access` already works around when it refuses to trust `username_override` and falls back to an RLS probe, and the one that made dbt's retry-state key (`created_by`) forgeable for an `on_behalf_of` script. The labels are refused where request input enters: the member-facing `tokens/create`, and `impersonate`, which names its subject in `impersonate_email` and has no business renaming the caller too. The legitimate producers are unaffected — a job's own token comes from `create_token_for_owner` in the worker, and native triggers and app-embed tokens build their labels themselves rather than accepting one. `Ephemeral lsp token` stays allowed: its override is the fixed sentinel `lsp`, not a name the caller chose, and the editor mints exactly that label through this endpoint for its language server. The test pins the two lists together, so an arm added to `username_override_from_label` that lets a label choose a name fails until it is reserved too. * Revert "fix(auth): only the server may set a token label that names a user" This reverts commit efaa498d82. * fix(auth): only the server may set a token label that becomes a bare username * revert(dbt): key retry state by the execution principal again Reverts the per-caller key and the retention it needed. `created_by` cannot carry an isolation boundary: it is `display_username()`, which a token LABEL supplies, so two callers can share one value and — before the guard two commits back — one could name a third person. GHSA-8x8x-88qc-qp4r settled that class by refusing to trust the name for authorization, and keying on it here was the same mistake in a new place. It also cost a migration, a PK column, two sqlx cycles and a retention sweep to defend. Back to `(workspace, script_path, permissioned_as)`, which is derived from the authenticated username and cannot be chosen by a request. What that boundary is, and the one case it does not cover, is now written down where the retry is specified rather than left to be re-derived: anyone entitled to run the script as that principal may resume its last failure — the same capability as re-running that job, since running it requires the read access that already shows them the run and its arguments — except for a run pushed `invisible_to_owner`, whose arguments a retry still returns. Closing that means having a retry NAME the job it resumes and authorizing it as a job read, which is a change to the run argument, not to the key. * fix(dbt): give a caller's own selection a graph, and load a finished run once A run that overrides `select`/`exclude` was marked caller-scoped but not per-run, so it ingested nothing and its page fell back to the deployed graph. That is only right when the override NARROWS the descriptor's selection — `["*"]`, or any model outside it, builds relations the deployed graph never had, and those are exactly the ones whose progress, SQL and lineage had nothing to draw. It ingests its own graph now, still caller-scoped, so the subset stays out of what the script owns. `relationDrift` also read a schema whose own name contains a period as a move: a segment holding one is ambiguous — an overridden database, or a schema really called `a.b` — so either spelling now counts as unmoved. And a finished run fetched the whole graph twice on mount, every model's SQL included: the reset effect and the finished-run effect both fired in the same tick. The reset only loads while the run is in flight; the other owns the finished case, because a snapshot can land after the run ends. * fix(dbt): classify a restored retry by its resolved arguments `add_caller_args` was handed `raw_args` on the retry path — the arguments as SUBMITTED, where a `select` spelled `$res:` is still a string. `arg_list` then refuses it as "must be a list of strings" and the retry dies before parsing, for a reference that resolves to the very list the failed run built with. The resolved map decides it now, matching the selection resolver and the build; `raw_args` stays what is persisted and published, so no resolved secret outlives the job. Verified against the shape it breaks on: a `select` from a resource, failed, then resumed. Two docs that outlived their code: `dbt_script_hash` is described as a fallback for a job naming no deployed script rather than as the pinning mechanism, since a script job's version comes from the job row and the query value is ignored (spec plus the generated client, which carries the same sentence); and `GraphRefresh`'s fields no longer claim a caller's selection only ever narrows, which is the premise the previous commit disproved. * fix(dbt): a hidden run keeps no retry state The state is keyed by the execution principal, which every caller of an `on_behalf_of` script shares, and a retry publishes the arguments it restored — so for a run the other callers cannot read, that retry was the one way to see them. The equivalence the key rests on ("resuming it is the same capability as re-running it") holds only while the run IS readable, and exactly one run is not: one pushed `invisible_to_owner`. Those now save nothing, and clear whatever the previous run left, since this invocation happened. A hidden run therefore cannot be resumed by anyone, its author included — the cheaper half of the trade, and the reason having a retry NAME its source job is the design that would give it back. Verified: a visible failure still saves and resumes; a hidden one leaves no row, and the retry after it refuses without returning the hidden `vars`. Also collapses `GraphRefresh::caller_scoped`, which stopped distinguishing anything once a selection override became per-run: both writers set both flags, so `snapshot_job` and `publishes_ownership` are now one field and its negation — which is what lets the agent payload carry a single `per_run` bit, recorded there. `is_reserved_token_label` says why `ephemeral-` is reserved (a client-chosen system label is a token its owner cannot list or revoke) rather than restating a username rule its second prefix does not follow. And the module-cache import comment states the invariant once, without the shape of the cache that preceded it. * fix(dbt): a pre-build failure leaves the saved run alone Three exits cleared the retry state before `dbt build` ever ran: a preparation failure, a failed `dbt parse`, a failed ingest. None of them touches a relation, so the warehouse is exactly what the previous run left and its failures are still the accurate description of it — clearing there just costs a resumable failure, and a resume that no longer fits is refused by `run_identity` and the arguments digest regardless. The reachable one is a cancellation during provisioning. Only an interrupted BUILD invalidates, which the save at the end of the job already decides. Verified: a failure saves state, a run whose selection matches no node fails in the ingest and leaves it, and the retry after that still resumes the original failure. Agent-published graphs also had no sweep — `Connection::Http` snapshots every run and spawns none — so the EE endpoint prunes too (pinned at f58bf06), and `prune_dbt_run_graphs` now names every writer rather than only the runs. Drops `ephemeral-webhook-` from the reserved token labels: it yields the label verbatim, not a bare username, so the check now matches the rule its doc and its test state, and the reason given for it was wrong about what `is_user_token` costs an owner. And the result contract lists `invocation_args` — the field most needing it, being another invocation's arguments on a retry. * fix(assets): decode a doubled delimiter when canonicalizing a table key `split_relation` decodes it on the worker side, so the canonicalizer had to as well: a relation whose identifier escapes its own delimiter — `"sales""east"` — was filed by the ingest under `sales"east` and by a hand-written `table://` annotation under `sales""east`. Two nodes for one table, no edge, which is the exact split this key exists to prevent (decision 11). Fixed for both the name and each half of a database-qualified schema segment, with a case per dialect. `invalidate_run_state`'s contract also still promised the pre-build behaviour the previous commit removed; it now names the cases that do invalidate — an interrupted build, and a run hidden from the script's owners. * fix(dbt): reclaim package trees no project asks for any more The cache key covers the whole project digest — a `local:` dependency's content is in no manifest, so nothing narrower is safe — which means every edit of a project that declares packages publishes another full dependency tree, and nothing ever removed one. A worker that lives through a hundred deploys held a hundred trees until an operator cleared the entire cache by hand, and the disk that fills fails every job on that worker, not only dbt's. Swept by last USE, not by publication: a hit dates the tree, so a project unchanged for months is not evicted from under the jobs still running it. The marker is a sibling rather than a file inside the tree, which the restore copies into the project. Staging directories go after a day — one belongs to a single job and is removed when it ends, so an older one is from a worker that died mid-publish. Verified by planting a 30-day-old tree and a stale staging dir: one run reclaimed both and left a fresh tree alone. Narrowing the key to the declared `local:` paths would fix the churn as well, and is deliberately not done here: getting it wrong runs a project against another revision's packages, which is worse than the disk it saves. * docs(api): declare the dbt half of the asset-graph response `AssetGraph` is the response of both `/assets/graph` and the new `/jobs/dbt_graph/{id}`, and the spec described neither `assets[].dbt`, `runnables[].dbt`, `dbt_edges` nor `dbt_snapshot_job` — so every client generated from it saw a graph with no dbt metadata, no `ref()` lineage and no snapshot marker, which is why the run page reaches the endpoint with a raw `fetch` and a hand-written cast. `frontend/src/lib/gen` is gitignored, so the spec is the only tracked description of this surface. Declared, and the client regenerated from it now carries all four (verified: the regen is otherwise a byte-for-byte no-op). * fix(dbt): stop the package sweep from racing the restore it protects Three faults in the sweep the previous commit added. The `.last_used` marker was written AFTER the copy, and the tree it matters for is the one at the retention edge — where the first use in a fortnight is also when the sweep fires. So the source looked stale for the length of the restore and a concurrent job's sweep could remove it mid-copy, failing a run that should merely have refetched. Marked before the copy, and a restore that loses the race anyway is treated as a cache MISS: `dbt deps` resolves the tree again, costing a fetch rather than the run. The sweep also sat inside `if let Connection::Sql`, though it is a walk of the worker's own disk that needs no database — so an agent worker, which has none, published a tree per project edit and reclaimed nothing. That is the state the doc claimed was fixed, and the same argument the graph sweep makes two lines above: retention that depends on the connection is not retention. And the canonicalizer's two halves disagreed after `5890436`. `unquote_identifier` requires the quote at both ends, so a lone `"` in an already-decoded name survives; the schema walk treated one as opening a quote and dropped it, filing the ingest's `sa"les` under `sales` while an annotation's `"sa""les"` decoded to `sa"les` — the split this canonicalization exists to prevent, in the function I had just touched. The halves share one rule now, and the test drives the decoded spelling against the quoted one rather than asserting only the annotation's. * fix(cli): track a dbt project's parent descriptor for every authored file `buildTracker` decides whose top hash `wmill-lock.yaml` refreshes, and it reached the module branch only for files matching a Windmill script extension. A dbt project is mostly files that are not: `dbt_project.yml`, `packages.yml`, schema YAML, seed CSVs. Editing any of them left the descriptor untracked and its module-inclusive hash stale, so the lock disagreed with the bundle that was pushed. Module paths are now handled ahead of that gate. The parent was also derived by searching the RAW path for `__dbt/`, which finds nothing on Windows, where the folder is spelled `__dbt\` — so even a model edit was skipped there. It goes through `getScriptBasePathFromModulePath`, which normalizes separators, and which the sibling helpers already used for this exact reason. The regression test drives all three shapes. With the old gate reinstated it fails on the non-script files and on the backslash path, and passes only for `.sql`. * fix(dbt): re-resolve unlocked dependencies, and reclaim retry state nobody writes A project with no checked-in `package-lock.yml` asked dbt to RESOLVE its ranges and mutable git revisions, and dbt does that on every run. A cache hit skipped `dbt deps` entirely and every hit refreshed the marker, so the first resolution was pinned for as long as the project stayed in use — a version range that moved was never picked up. An unlocked tree is now a miss once it is a day old; a locked project keeps its tree, since the lock is in the key and pinning is what it asked for. Retry state: `invalidate_run_state` removed the pointer and left the generations, and the whole state root was swept by nothing after `a236972` — so a script that stops running, or a principal who stops running it, kept its last generations (a `manifest.json` each) for good. Forgetting the state now prunes its generations, and a 30-day sweep of the state root runs beside the package sweep, for the reason that one already gives: retention that runs only for the script being run is not retention for the ones that are not. This restores one half of what `a236972` reverted — the local sweep, not the per-caller key or the row retention — because it never depended on that key. The graph orphan sweep also committed its marker delete separately from the two deletes it gates, so an error or a restart in the gap left graph rows whose marker was gone — and since the sweep only runs when a marker went, every later call skipped it and those rows were unreachable for good. One transaction now. `parseDbtRun` scans from the LAST brace: the payload is appended, so backwards finds it immediately where forwards parsed the whole message once per brace in the error text. And `reject_reserved_label` moved into `create_token_internal`, the one path every caller-supplied label reaches, so the invariant sits where a new route would break it. * fix: undo two of my own regressions, and agree with the backend everywhere `2e34dd48` hoisted the module check above the extension gate, which is right, but did not bring the entry-point rule with it: a folder-layout script's METADATA is `<base>__mod/script.yaml`, an entry-point path, and pushing it as a content file makes the metadata pass ask for the language of `.yaml` and abort the whole command. Reached by editing the summary of ANY modular script — pre-existing, nothing to do with dbt. Metadata resolves to its content file now, with a test. `d3716a09`'s unlocked-dependency refresh is reverted. It measured staleness against the last-USE marker, which every hit rewrites, so an actively used project never reached the threshold — and when it did fire, the re-publish `rename` cannot land on a populated directory, so the freshly resolved tree was discarded and the stale one re-stamped: a network resolve thrown away per idle day. Doing it properly needs a publication timestamp and a publish that can replace a tree; the limitation is recorded where the cache is keyed instead of half-implemented. `parseDbtRun` no longer counts braces in either direction. The payload is appended pretty-printed, so its `{` is the only one at column zero — forwards blew the cap on an error full of braces, backwards on one `{` per node, which a few hundred nodes reaches. Test drives a 400-node failure. And `parsePipelineAnnotations` was the third copy of the quote rule, still splitting a doubled delimiter: the live canvas keyed `"sales""east"` as `saleseast` where the deploy keys `sales"east`, so an annotation pointed at a node the deployed graph does not have. All three agree now, including on a lone delimiter in an already-decoded name. * chore(dbt): leave cache retention and the migration's comment out of this PR Two deliberate subtractions, so what ships is the set that has been verified rather than the set that was written. The package-tree and state-directory sweeps are gone (recoverable on `dbt-cache-retention-followup`). They delete directories on a worker, they were the newest code here, and one of them already needed a second pass for racing an active restore — while what they buy is disk hygiene, not correctness: today an operator's `cache_clear` reclaims these caches, exactly as it does for every other language. Both limitations they addressed are now recorded where the cache is keyed. `invalidate_run_state` still prunes the generations it orphans, since that reuses the existing pruner and its grace window rather than sweeping a root by age. And the migration is back to its pre-PR bytes. The only change left in it was a corrected comment, which every database that already applied this migration would have paid for with a checksum mismatch at startup — the explanation lives in `prepare_project` and in the design doc, which is where it is read. * fix(dbt): pin the resolved package tree to the deployed version A cache hit skipped `dbt deps`, so an unlocked range or mutable git revision stayed on whatever the first worker resolved, and a retry could feed one resolution's run_results.json to another. The deploy now records the digest of the generated package-lock.yml, the package cache is keyed by it, and it joins the run identity; a worker that resolves anything else is refused rather than run. Also carries the agent-wire round trip test for an ingested manifest, and the EE pin for the agent publish endpoint. * docs(dbt): state the dependency contract the deploy pins The design doc still described the package cache as keyed by the project digest alone, and carried an open question about refreshing unlocked dependencies that the deploy-time pin answers: resolution happens once, at deploy, and every run of that version installs it or is refused. Records what that costs and buys — committing package-lock.yml makes deploys cache-hit, deploying again is what picks up a newer range — and that these worker-local caches are reclaimed by cache_clear, as every other language's are. * fix(dbt): four findings from the review round - An interrupted retry republished the results it had only restored. A retry starts with the previous attempt's run_results.json in place; cancelled before dbt rewrites it, the save dated those failures to this job, so the next retry rebuilt nodes this one had already redone. Verified by A/B: without the check the row survives, carrying the cancelled retry's id. - The deploy refused a committed package-lock.yml that dbt itself updates, which it does whenever the sha1_hash it recorded for packages.yml no longer matches. Only a run has a resolution to be held to; the deploy establishes one. - A second graph load for the SAME run could land out of order, leaving a finished run showing the deployed fallback for good. - Directory nodes in the project tree carried no path, so two of one name at the same depth shared a collapse key and folded together. * fix(dbt): name every adapter, and stop guessing which project owns a model The invalid-adapter message listed four of the eleven accepted spellings. And a relation may have several script producers, none of which the provenance record identifies — prefixing the first one names a __dbt folder that does not exist, so an ambiguous relation now shows the path inside the project alone. * refactor(dbt): name the graph-snapshot column for when it is written `published_relation_root` described a design persist_ingest does not use: the root is recorded by every ingest that is not a run's own snapshot, including one that publishes no ownership — deliberately, since a version that cannot claim the path would otherwise record nothing and compare against a stale root forever. The column comment said the opposite and the name followed it. Safe to edit the migration in place because this PR introduces it: no database outside a checkout of this branch has ever applied it. One that has needs UPDATE _sqlx_migrations SET checksum = decode('<sha384 of the file>','hex') WHERE version = 20260725084314; alongside the column rename, or a fresh database. * style(dbt): bring comment blocks within the four-line guidance AGENTS.md asks for each invariant at the place someone would break it, in at most four lines. The new dbt files carried 60 inline blocks past that, several of them three rationales deep at one site. Nothing durable is dropped: what covered several constraints at once is split to the lines it constrains, and eight comments that had drifted above the wrong test — six stacked over one profile test, two over the wrong executor test — are reattached to the tests they describe. * docs(dbt): carry the snapshot-column rename into the summarized schema The rename reached the migration, both queries, the sqlx cache and the design doc, but not the compact schema summary — which is the file agents read instead of the migrations, so it was the one copy that could mislead silently. * docs(dbt): bound the retry-state and package-pin residuals precisely Two claims in the design doc were true but not precise enough to act on. Retry state: the equivalence between resuming a failure and re-running the job holds because folder read grants job read, which is also what grants execution. It does NOT hold for a u/<owner> script shared through extra_perms, where no folder policy applies and a grantee cannot read even their own on-behalf run. The package pin: the refusal is per worker. A ranged dependency with no committed lock reproduces its resolution only from a cache hit, so it keeps running where the tree is warm and fails on the first cold worker. * fix(dbt): refuse a retry of a run its caller cannot read Retry state is keyed by execution principal, so every caller of an on_behalf_of script shares one saved run. Under a folder that matches job visibility exactly, but a u/<owner> script shared through extra_perms has no folder policy: a grantee can read neither the run nor their own, while a retry published its arguments. The restore now applies require_job_read_access's rule — you can always read a job you launched, otherwise the row must be visible under your own RLS. Deliberately NOT job_perms, which carries the identity the job runs AS: for an on_behalf_of script that is the owner, and probing with it authorizes everyone. Verified with two members on one shared principal: bob is refused alice's run on the u/ path and her marker never reaches his result, alice resumes her own, and bob still resumes alice's run of the same script under a folder. * fix(dbt): close the retry check's own gaps The check landed with three holes and four rough edges, all found by review: - A pruned source run was allowed. dbt_run_state outlives job retention, so that handed the last failure's arguments to whoever asked next. It now fails closed, and says so rather than claiming the run was someone else's. - An agent worker skipped the check entirely: it reaches no database. The saved generation now records who launched it, and an agent authorizes the half it can prove — the launcher may resume. A generation written before this field is not resumable there. - The row was authorized on one read and restored on another, so a run completing in between was restored unauthorized. restore_from_db now takes the job it was authorized against. Also: restore_run_state's doc comment had drifted onto the new helper, the not-a-member comment described the saved run rather than the caller, and the refusal message carried a run of spaces from its line continuation. * fix(dbt): keep the descriptor in --json sync, and fail closed on a stateless row A dbt script's content is `<name>.dbt.yaml`, and `elementsToMap` drops every .yaml when metadata is JSON — so a --json workspace tracked the metadata, the lock and the whole project bundle but not the descriptor: a descriptor-only edit pushed nothing and a fresh pull wrote a script with no source. Pinned by a test that fails without the exemption. And the retry check read job_id flattened, which merged "no row" with "a row naming no job" and skipped authorization for the second. Unflattened, the row that cannot be authorized is refused. Also graph_digest: serde rather than {:?} for edges, and delimited parts. * docs(dbt): state that retry authorization is by identity, not token scope The section claimed the read-access equivalence was enforced. It is, for identity — but the worker never sees the submitting token, and neither v2_job nor job_perms records a scope, so a token denied jobs:read can still resume its own principal's last failure. What it gets is the arguments as submitted, so a reference is re-resolved under whoever retries rather than disclosed. Also names the cases the check refuses outright, which were spread across three commit messages and nowhere a reader would look. * chore(dbt): repin EE after rebasing the agent-graph branch onto EE main * fix(dbt): say why a test-only run has no models, instead of blaming the profile A selection of tests alone builds nothing, and a test is an assertion rather than a relation, so the ingest keeps nodes with no asset to hang on and the graph comes back empty. The run is correct and its results render — but the empty state named the one cause it is not, a project with no warehouse identity, and sent the reader to their profile. The graph itself is unchanged: retaining a selected test's attached model would have a test-only script claim a read on every model it asserts against, which is an asset-graph semantics change and wants its own review. * fix(dbt): authorize a retry by RLS alone, and eight review findings Retry authorization drops the created_by grant that mirrored require_job_read_access's "you launched it". That name is a display name derived from a token label, so a worker cannot tell a launcher from a collision — the objection Codex raised on four heads. Visibility under the caller's own RLS is the whole rule now. An on_behalf_of script under u/<owner> shared by extra_perms is resumable by the owner alone; under a folder every caller keeps the resume. Also, and each verified against the code first: - The local generation is revalidated after the file work, so a newer run publishing state mid-restore no longer lets the superseded one resume. - Both dbt zip lookups in sync normalize the OS separator, as the resource lookup beside them already did: on Windows a pulled dbt project was laid out as __mod, the one layout dbt cannot run from. - A resource storing port as a string no longer silently connects to the adapter default; a value that is not a port is refused. - An oversized but readable project file fails the deploy instead of shipping an incomplete project that compiles and fails at run time. - cache_clear does NOT reach the dbt caches: it clears cache/ while these live under cache_nomount/, as bun's do. The doc said the opposite, and that claim was the justification for dropping the retention sweeps. - A dbt unit test counts as a test for the empty-state message, as it already does for the worker's test-phase detection. - Per-node results keep the catalog segment when rows disagree on it. - The project panel copies through the app's clipboard helper, .dbt.yaml resolves back to dbt in EXTENSION_TO_LANGUAGE, and two test blocks clean up their temp directories. A comment describing a race against a sweep this PR does not ship is gone. * fix(cli): keep the oversized-file check to a bounded read The refusal statted the file and then read it whole to tell text from binary, which is the cost the two comments above it and isBundledModuleFile exist to avoid: a multi-gigabyte seed would be loaded just to be refused. Same 8 KB head read as that predicate. * revert(dbt): accept the retry residual instead of gating it Resuming grants no capability a caller lacks: they may already run the script as that principal, and a plain run builds a superset of what a retry rebuilds. The one thing a retry adds is information -- the result echoes the resumed run's submitted arguments, for the row preview -- and in almost every shape the caller could already read that run: a folder grants job read alongside execution, and an ordinary script's runs are keyed under the caller's own principal. It takes a user-path script AND extra_perms sharing AND on_behalf_of for the two to diverge. Gating it needed an identity the worker does not have. created_by is display_username(), which a token label supplies: trusting it authorizes a collision, and resolving it as a username denied every labelled token -- a CI token is `label-<name>`, no workspace member, so its own retry was refused. That regression cost more than the exposure. Kept, because none of it is about the caller: - a cancelled retry no longer republishes the results it only restored, - the restore is pinned to the row it chose rather than re-reading it, - a newer run publishing mid-restore no longer lets the superseded generation resume. The three sqlx entries the gate needed are gone with it. * fix(dbt): select unit tests, and say why the state key is the boundary `dbt ls` enumerated five resource types and omitted `unit_test`, which dbt treats as its own type rather than a flavour of `test`. A descriptor selecting `test_type:unit` or a unit test by name therefore resolved to the empty set, which the deploy refuses outright with "matched no dbt nodes". Verified both ways on a fresh path: the deploy fails without this and succeeds with it. All three engines list `unit_test` among the accepted values. The restore's state lookup now carries the reason it keys on the principal and not the caller. That decision was in the design doc, the commit messages and a PR thread — everywhere except the line someone would change to "fix" it, which is where AGENTS.md asks for it and where I twice went wrong myself. Also: the `GraphRefresh` doc claimed a dynamic descriptor publishes its graph as the script's ownership, while `per_run_models` snapshots it under the job id and `publishes_ownership()` returns false — only a moved profile republishes. And `fn n` in dbt_profiles.rs had no callers left after `port_of` replaced it. * feat(dbt): offer the resume on a failed run, where the choice is relevant "Run again" prefills the arguments the run just used, so the obvious action after a failure rebuilds the whole project while the cheap resume stays invisible unless the reader knows dbt_command has a retry value. A finished run with failed or skipped nodes now says how many, and links to its own run form with the command already switched. A link rather than a submission: the caller still presses Run, so nothing about permissions or arguments changes. Deliberately not automatic. A resume is not a re-run — models are usually rebuilt because upstream data moved, not because they failed — so a schedule that resumed after a failure would leave every model that succeeded carrying yesterday's data while reporting success. * feat(dbt): put the command first, and offer the resume where the rebuild is Three things made rebuilding the whole project the path of least resistance after a failure, when resuming its failed and skipped nodes is what dbt offers: - `dbt_command` was LAST in the generated signature, under `limit`. The schema's `order` drives the run form, so the argument that decides what the run does sat below the ones that only narrow it. It leads now, and the signature test asserts the order rather than the set, with the reason it is pinned. - "Run again" prefills the arguments of the run it came from, so for a failed run it reproduces the rebuild. It now carries `dbt_retry_hint`, and the form shows what resuming would do instead -- without choosing it, so the caller decides. - Its dropdown offers "dbt retry with same args" above the plain re-run, for a failed dbt job only: a run that succeeded has no saved failure to resume. Verified in the browser: both dropdown labels render unclipped, the alert appears only on that path and disappears once the command is switched, and the schema of a redeployed script lists dbt_command first. * feat(dbt): describe the run arguments, and hide the ones a command ignores The form offered six fields at once with no indication that most of them apply to one command each. `retry` reuses the arguments of the run it resumes, so every override is ignored; `limit` belongs to `show`; `full_refresh` to `build`. Each argument now carries what it is for, and a `showExpr` for when it applies, which SchemaForm honours by hiding the field AND dropping its value from the payload. Selecting `retry` leaves the command alone on the form. Not modelled as a `oneOf`, which is the more precise shape: Windmill renders that as a variant selector whose value is a nested object keyed by a discriminator, so the arguments would stop being flat -- and the worker reads them by name, as do schedules, webhooks, the CLI, saved inputs and the retry state's own copy of them. * fix(dbt): a retry may name the run it means to resume The retry actions I added an hour ago appear on any failed run, but the saved failure is keyed by script and principal rather than by job — so from an older run's page they resumed whatever failed most recently, under a label promising "same args". Both now pass `dbt_retry_job`, and a retry naming a run the state no longer holds is refused with the id it does hold. Verified: with failures A then B saved, a retry naming A is refused and names B in the message, while a retry naming B resumes. Also from the same review: the `select` help advertised `state:modified`, which needs a comparison manifest this runtime supplies no `--state` for, and the openflow note still described a dbt script as a descriptor naming a git repo rather than the module bundle this ships. * fix(dbt): make both retry actions actually name their run `dbt_retry_job` is not a form field, so the banner's link to the run form dropped it and the retry resumed whatever failed last — the bug the argument exists to prevent, reintroduced by the affordance meant to use it. The banner submits the run itself now, as the "Run again" dropdown item already did. And an agent worker never applied the check at all: its `latest_job` is always None, so the local generation was accepted unconditionally. Both reviewers found this independently. The decision moved into `chosen_generation`, which the agent path shares, with the refusal naming the run the worker does hold. Pinned by a test that fails without the check, on the connection kind where it was missing rather than on the one that already worked. * fix(dbt): let an unchanged push be a no-op, and stop advertising a retry the form cannot aim Two of a dbt script's fields are DERIVED by the server after the no-op check runs: the lock, which only a dependency job can produce, and the schema, which comes from the descriptor and which no client can derive (windmill-parser-wasm has no dbt arm). The check compared what arrived instead of what would be stored, so every unchanged `wmill sync push` created another version and another dependency job -- the sync churn skip_if_noop exists to prevent. Both are now compared as stored, with the parent required to hold a lock so a deploy whose dependency job failed can still be retried by pushing again. Verified by A/B on a faithful payload: without this the same unchanged push creates a version, with it the existing hash comes back and the count holds. The run form's retry hint is gone. `dbt_retry_job` is not a form field, so a retry started there resumes the last failure of the script rather than the run the message pointed at -- the two buttons name their run, that path could not. Better to not offer it than to offer it wrong. Also reunites a comment with the derivation it describes, 40 lines below where an earlier edit of mine left it. * docs(dbt): an unchanged push no longer re-resolves dependencies The section told the reader that a byte-identical deploy re-pins a ranged dependency, which was true only because no-op detection was broken for dbt. Now that an unchanged push is skipped, moving a pinned resolution takes an actual change. * feat(dbt): offer the resume only on the run it would actually reach * fix(dbt): a refusal names both the run asked for and the one held * docs(dbt): say that show previews one node when several are selected * feat(dbt): a retry names the run it resumes, and the form can fill it in * refactor(dbt): make the run's command a oneOf carrying its own overrides * fix(dbt): refuse a command block that names no command, and keep state off retired paths * fix(assets): let copilot and the assets filter see warehouse tables * fix(dbt): drop the unused db handle from the retry-principal lookup * fix(dbt): stop a preview poll when the run page moves on * fix(dbt): refuse an escaping packages-install-path, re-arm the graph poll on navigation * docs(dbt): concurrent runs of one script are the script's to serialize * fix(dbt): bound what the log tailer holds in the worker process * fix(dbt): a stale prefill answer must not aim another script's retry * fix(dbt): a rename leaves the old path archived, so state must not be rewritten there * fix(dbt): keep a retry's routing inputs, and stop an app-embed token probing resumability * docs(assets): state the authorization the graph helper expects of its callers * fix(dbt): merge the retry into the fetched arguments, not the too-big placeholder * fix(dbt): the command block's label decides the command, not map order * fix(cli): an oversized dbt project file must not read as generated output * fix(dbt): the prefill names a run only when the caller may read it * fix(cli): refuse an oversized dbt file before anything reads its body * fix(dbt): fold table paths as the deploy does, and preview with fetched args * fix(dbt): stream an engine archive to disk instead of holding it in the worker * refactor(assets): the dbt asset kind is dbt://, keyed on the relation * chore: regenerate the auto-generated prompts for the dbt asset kind * fix(assets): rename the kind at the callers that request it, and refuse an unknown one * feat(dbt): show the project's models under the run form on the script page * fix(dbt): the rename missed the dbt-edge membership keys, so the DAG lost every edge * fix(dbt): a preview must run the dbt writer, with the form's arguments * feat(dbt): the models graph takes the bottom of the script page, as a flow's does * fix(dbt): an unknown outcome is not a pass, and a preview keys on its arguments * feat(dbt): a warehouse is configured on the workspace, named like the lake * feat(dbt): asset identity keys on the warehouse name, resolved for agents too * feat(dbt): warehouses are configured in workspace settings * feat(dbt): the descriptor lives in the project and is optional * docs(dbt): the warehouse is a workspace setting and the descriptor is optional * fix(dbt): the warehouse route names its capture, and the editor stores the map * test(dbt): pin the warehouse setting round-trip and the job-scoped route * fix(dbt): a project-owned profile must authorize the warehouse it names * fix(dbt): the settings tab imports TextInput from where it lives * fix(dbt): a warehouse name is validated wherever one enters, and an absent descriptor is not a diff * fix(dbt): the settings inputs pass their placeholder the way TextInput takes it * fix(dbt): pushing a project that has no descriptor is not an error * chore(dbt): keep the module suffix private to its module * fix(dbt): warehouses survive a fork or rename, and an empty descriptor is never a file * fix(dbt): a workspace rename carries its dbt graph with it * fix(dbt): a rename takes the run state with it, not only the graph * chore(dbt): drop the query-cache entries the settings edits orphaned * docs(dbt): state the three rules that keep an absent descriptor absent * fix(dbt): an unreadable descriptor is an error, and an emptied one is a deletion * feat(dbt): the warehouse is unpermissioned, like the workspace bucket * feat(dbt): an agent worker's run reports its per-model state too * docs(dbt): how an agent worker reports what it ran * feat(dbt): a project-owned profile reports its database, so its models share nodes * style(dbt): rustfmt the files this branch touched * fix(dbt): drop the job id write_profiles no longer reads a resource with * fix(dbt): a preview reads the graph's edges and sends the model, not the cache key * fix(dbt): a deleted producer explains itself instead of a bare 404 * fix(dbt): one warehouse resolution path, interpolated against the job * fix(dbt): a project with no descriptor pulls and opens in dev mode * feat(dbt): one file tree, editable, and Test builds the model you have open * fix(dbt): a preview asks the writer's own graph, and lfs keeps its omission * fix(dbt): metadata stays beside the project, and only a model narrows a build * fix(dbt): a descriptor-less project previews, and dev reloads the whole bundle * fix(dbt): forks carry the graph, and a vanished project stops the push * fix(dbt): no-auth resolves warehouses, and a preview runs the version it read * fix(dbt): a retry recognizes its own run when the profile carries a job token * fix(dbt): the project marker is not deletable and the descriptor path is reserved * fix(dbt): a templated adapter type is refused, and a removed project archives * perf(dbt): the manifest lands in batches, and .py models are creatable * fix(dbt): only a 404 excuses a failed archive, and edges are covered * fix(dbt): a python model narrows the build, and a failed removal is not silence * fix(dbt): a settings name may be any word, and the reserved path is stated once * fix(dbt): an absent descriptor needs its project, and the form matches the run * fix(dbt): a bundle is dbt by language, and both job routes agree who may call * docs(dbt): every identity doc names the warehouse, as the code does * perf(dbt): an agent posts its run's progress once, and show cannot touch a seed * fix(dbt): bound what a warehouse may be named, and say who may ask * fix(dbt): a run's graph withholds what the project's author wrote, and dbt_project.yml is rendered before it is read * feat(dbt): withhold dbt from the language picker until it has its own editor * fix(dbt): refuse a path claimed by both a dbt project and an ordinary script * test(dbt): the bundle assertion is a set, not an order * fix(dbt): a project's generated dirs are re-read when its config changes * test(dbt): assert the synthesized descriptor without assuming a separator * fix(dbt): both push paths refuse a shared path, and every writer sweeps its progress rows * fix(dbt): preview only what dbt show can select, and a retry keeps its command block * fix(dbt): an identifier carrying a path separator gets no asset key * fix(dbt): no engine ships in an image, and show may name only one node --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-08-01 11:58:05 +00:00
Ruben Fiszel	7a70d6aa3b	refactor: derive the azure trigger address from its principal (#10439) ... * refactor: derive the azure trigger address from its principal Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 564ad8932e1488dfc4b2694d9b4e50c580d1b8ed This commit updates the EE repository reference after PR #706 was merged in windmill-ee-private. Previous ee-repo-ref: 74655906a7936c6e9e7c984f6b7af111f121404b New ee-repo-ref: 564ad8932e1488dfc4b2694d9b4e50c580d1b8ed Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>	2026-08-01 10:41:37 +02:00
Ruben Fiszel	3716a71fd7	fix: credit the token owner instead of the token label in the audit trail (#10423) ... * fix: credit the token owner instead of the token label in the audit trail Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: address review findings on token-owner audit attribution Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: carry token-label provenance explicitly instead of inferring it Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: point ee-repo-ref at the companion branch Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: trust only non-forgeable token labels to name the acting entity Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: reject reserved system-token labels at token creation Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: narrow the token-label guard to server-minted namespaces Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: add the provenance field to the remaining ApiAuthed literals Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: stop trusting the email- label, which no mint produces Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-31 11:21:14 +02:00
Ruben Fiszel	f9d5da11b7	feat: allow changing an account email in the superadmin settings (#10355) ... * feat: allow changing an account email in the superadmin settings * fix: cover slack_email and usage rows, and scope job rewrites to the queue * fix: compare the destination email case-insensitively * fix: only warn about the consequences once the email is edited * docs: warn that changing an account email is a last resort * fix: repoint app policies and raw-email permissioned_as, reject self-change * fix: repoint folder default rules and guard the varchar(55) job column	2026-07-27 14:54:23 +02:00
Ruben Fiszel	68debab877	feat(triggers): add AMQP (RabbitMQ) trigger via lapin (#10230) ... * feat(triggers): add AMQP (RabbitMQ) trigger using the lapin library Fixes WIN-2214 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(triggers): defer AMQP cross-workspace deploy pending utils-internal publish Revert the amqp_trigger additions to the shared windmill-utils-internal TriggerDeployKind and the frontend cross-workspace deploy adapter: the frontend installs the published npm package, which lacks the new kind until a release is cut. AMQP create/edit/delete/list/sync/capture are unaffected (they use local types); only cross-workspace deploy/merge of AMQP triggers waits on the package bump. Also document the at-most-once ack in the consumer loop. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(triggers): address AMQP review — at-least-once ack, workspace cascade, contracts - ack AMQP deliveries only after successful dispatch; nack+requeue on failure - add ON DELETE CASCADE workspace FK so amqp_trigger rows are cleaned on workspace deletion (and the listener stops) - fix the /amqp_triggers/test OpenAPI body and add amqp_trigger to WorkspaceDiffRow.kind - register AMQP in the generated workspace trigger tool (create_trigger) - drop banned $bindable defaults on optional props in the config section - add build_uri unit tests (encoding, ports, vhost) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(triggers): stop AMQP poison-message loop and reconnect on transient drops Chaos testing against a live RabbitMQ broker showed the previous nack(requeue) + immediate re-poll spun a tight redelivery loop (~1000 critical-error reports/sec) on a poison message, and any connection blip permanently disabled the trigger (lapin has no built-in reconnect). - on dispatch failure: nack+requeue then stop consuming; the listener framework re-lists the trigger after its ping goes stale (~15s), backing redelivery off to that cadence instead of a tight loop (verified: rate dropped from ~1000/s to ~1 per ~26s, message preserved) - on connection/stream error: stop and let the framework reconnect instead of disabling; persistent failures are still disabled via get_consumer (verified: a forced connection close now auto-reconnects and resumes) - finish the AI create-trigger action wiring for AMQP: add amqp to CreatedResourceTriggerKind, the action-card registry, and the drawer registry so the result card renders and its "Open" action works Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(triggers): complete AMQP frontend registries and defer merge rows - add amqp to capturableTriggerTypes (so AmqpCapture mounts), the Runs jobTriggerKinds filter, and CLOUD_DISABLED_TRIGGER_TYPES - wire AMQP into global AI chat mode: TRIGGER_KINDS, the request union, writeTriggerSchema, triggerServices, and the draft adapter - stop emitting actionable AMQP fork-comparison rows (revert amqp_trigger from TRIGGER_OR_SCHEDULE_TABLES) since cross-workspace deploy is deferred until windmill-utils-internal is published — avoids a deploy that fails with "Unknown kind: amqp_trigger" - use design-system TextInput instead of raw <input> in the config section Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(triggers): complete AMQP session/draft registries and constrain prefetch - add amqp to the session-deploy, draft-compare, preview-router, and copilot workspace-item registries so AMQP drafts/deploys/nav/path resolution work - include amqp_count in the MoveDrawer attached-trigger rename warning - replace the raw prefetch <input> with a design-system TextInput bounded to an integer 1-65535 (backend u16) and block save on invalid values Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(triggers): make AMQP disconnect/reconnect consistent with the Kafka trigger lapin, like rdkafka, has no transparent reconnect, so the AMQP listener now mirrors the Kafka trigger's explicit reconnect loop instead of relying on the framework re-list (which disabled the trigger once get_consumer failed on a sustained outage): - get_consumer returns cheaply; consume owns a (re)connect loop that retries with a 30s backoff, reports a critical error every 10 failed attempts, and reports a recovered critical error once it reconnects — never disabling the trigger on a connectivity failure - a consumer/stream error breaks out to reconnect rather than disabling - dispatch failure still nacks+requeues (at-least-once) with a short backoff to avoid a tight poison-message loop, keeping the connection alive Verified against a live RabbitMQ broker: killing the broker keeps the trigger enabled and retrying (attempt N), and restarting it auto-reconnects (logs "reconnected after N attempts") and resumes dispatch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(triggers): complete AMQP capture registries and constrain prefetch contract - add the 'amqp' case to triggerKindToTriggerType so opening the AMQP editor from a capture button no longer throws "Unknown TriggerKind: amqp" - register AmqpIcon in CaptureTable's icon map and add an AMQP entry to the script/flow CaptureButton menu - bound the OpenAPI prefetch_count to an integer 1-65535 (matches the Rust u16) and regenerate clients/prompts - require a non-empty exchange name when the exchange binding is enabled - build_uri: fall back to "/" on a blank vhost and bracket IPv6 hosts (+ tests) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(triggers): wire AMQP into pipeline graph, git-sync, and preprocessor types - asset_graph: discover attached amqp_trigger rows and emit an AMQP TriggerEdge so AMQP triggers render (and can be opened/deleted) on the data-pipeline canvas - frontend pipeline graph: add amqp to NativeTriggerKind, the add-trigger menu, node presentation, event-trigger set, annotation keywords, and the editor/service registrations - git-sync: add the amqp_trigger include pattern (+ test) so an AMQP git-sync deployment stages only its .amqp_trigger.* file, not an unrelated same-path object - preprocessor starters: add the AMQP event to the generated TS/Python/PHP trigger event types (kind/payload/exchange/routing_key/queue_name/redelivered/ delivery_tag) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(triggers): finish AMQP pipeline/parser wiring, prefetch validation, source lists - fix a stray edit that corrupted the pre-existing MqttTriggerEditor import ($lib/... path) in PipelineTriggerEditors.svelte - reject prefetch_count = 0 server-side in validate_config (RabbitMQ treats 0 as unlimited) and defensively skip basic_qos(0) in build_consumer (covers the capture path that bypasses CRUD validation) - recognize `// on amqp` in the canonical parser (TriggerSpec::Amqp) and add amqp to the CLI non-autorun/event-trigger sets so a pipeline cascade never runs an AMQP-only node as a manual root without an event - add amqp to the preprocessor intro lists and both pipeline AI instructions Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(triggers): reject zero AMQP prefetch in all paths and finish guidance lists - extract a shared validate_amqp_options used by both CRUD validate_config and build_consumer, so capture configs (which bypass CRUD validation) also reject prefetch 0 instead of silently connecting with an unlimited buffer (+ unit tests for 0/1/65535/None) - add AMQP to the main script-writing preprocessor-sources prompt and the CLI triggers-skill guidance list Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(triggers): de-duplicate AMQP prefetch comment and fix GET response text - keep the zero-prefetch rationale only on the shared validate_amqp_options doc; drop the redundant call-site comments - correct the getAmqpTrigger OpenAPI 200 description ("deleted" -> "retrieved") Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to aaa6cb89b05b76139252c64f057e53b94d12ac60 This commit updates the EE repository reference after PR #680 was merged in windmill-ee-private. Previous ee-repo-ref: 5da5fd65aca9594b2611837a52e4677b544b0380 New ee-repo-ref: aaa6cb89b05b76139252c64f057e53b94d12ac60 Automated by sync-ee-ref workflow. * chore(migrations): consolidate the four AMQP migrations into one The table and the three enum ADD VALUE statements (trigger_kind, job_trigger_kind, draft_kind) are one atomic feature. ALTER TYPE ... ADD VALUE runs inside the migration transaction on PG >= 14 (Windmill's minimum) since the amqp_trigger table doesn't reference those enum types, so they can share a single migration instead of four. Verified applying cleanly in a single transaction on a fresh DB. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>	2026-07-21 15:10:29 +00:00
Ruben Fiszel	97f4477069	feat(forks): let a fork's creator manage developers on it without being an admin (#10166) ... * feat(forks): let a fork's creator manage developers on it without being an admin Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(forks): bind the fork-creator grant to the member's parent username and lock the delete Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 15:13:36 +02:00
Ruben Fiszel	91e1b087a2	feat(auth): add runtime NO_AUTH mode for authentication bypass (#9962) ... * feat(auth): add runtime NO_AUTH mode for authentication bypass Adds a runtime `NO_AUTH` env flag that makes every request resolve as the `admin@windmill.dev` superadmin with no login required, so self-hosted deployments can front Windmill with their own authenticating gateway without building a dedicated `oss` (compile-time `no_auth`) binary. - `NO_AUTH` is honored in any build but is force-disabled when `CLOUD_HOSTED` is set, so the managed cloud always enforces real auth. - The existing compile-time `no_auth` feature keeps its always-on behavior (`cfg!(feature = "no_auth") || *NO_AUTH`), so `oss` builds are unchanged. - `Tokened` now yields a synthetic token in no-auth mode so handlers that require it (e.g. global_whoami, called by the frontend on load) resolve. - A loud startup banner warns when the mode is on; `HIDE_NO_AUTH_BANNER` silences it once the operator has deliberately deployed behind a gateway. Fixes WIN-2131 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(auth): dismissable NO_AUTH warning banner via global setting Replaces the HIDE_NO_AUTH_BANNER env flag with a UI warning banner that can be permanently dismissed for all users from within the running instance (not exposed in instance settings). - New `no_auth_banner_dismissed` global setting, only ever written by dismissing the banner itself. - `GET /api/settings/no_auth_banner` returns whether to show the banner (true only when NO_AUTH is active and it hasn't been dismissed). - NoAuthBanner.svelte renders a top-of-app warning in NO_AUTH mode; its dismiss button opens a confirmation modal, then writes the global setting via the existing setGlobal endpoint so it stays hidden for everyone. - The server still logs the startup NO_AUTH warning unconditionally. Fixes WIN-2131 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth): resolve NO_AUTH in AuthCache so all_runnables works Codex/Pi review flagged that `/api/users/all_runnables` still failed in NO_AUTH mode: `get_all_runnables` extracts `Tokened` and re-validates the request token per workspace via `AuthCache::get_authed`, which rejected the fabricated `"no_auth"` token (no matching DB row) with a 400. Short-circuit `AuthCache::get_opt_job_authed` (the resolver behind `get_authed`) to the admin superadmin in no-auth mode, so any direct cache caller resolves without a real token. Single-source the mode check and the synthetic identity via `is_no_auth()` / `no_auth_admin_authed()` and reuse them across the extractor, resolver, and login paths. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * revert(auth): drop the NO_AUTH dismissable UI banner The in-app banner added a GET /api/settings/no_auth_banner request to every instance load for little benefit. The startup log warning already surfaces that auth is bypassed to operators, so drop the banner, its endpoint, and the no_auth_banner_dismissed global setting entirely. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 17:02:51 +00:00
Ruben Fiszel	76a9523009	feat: use derived username instead of email for non-member superadmins (#9857) ... * feat: use derived username instead of email for non-member superadmins Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: address review - drop redundant username cache, guard whoami membership by email Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor: use explicit non_member boolean instead of role string for superadmin banner Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: resolve email from password table for non-member superadmin permissioned_as Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: resolve non-member superadmin drafts via shared username->email resolver Adds resolve_username_to_email (usr, then super_admin password fallback for both derived-username and email modes) and uses it in get_email_from_permissioned_as and the drafts get/list endpoints, so a non-member superadmin's drafts resolve and no email leaks into the drafts payload. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: superadmin-not-in-workspace schedule uses derived username as permissioned_as Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: resolve non-member superadmin identity in draft owner-circles, username_to_email, and home filter Applies the password-fallback username resolution to the script/flow/app/draft owner-circle subqueries and the username_to_email endpoint (was an admins-workspace 'username == email' hack), and switches the home items-list user-folder filter to the non_member flag instead of the now-broken username-contains-@ heuristic. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: backfill non-member superadmin favorites from email to derived username Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: propagate DB errors in username resolution instead of leaking email (CI review) Addresses cubic-dev-ai P2: get_instance_username_or_fallback_to_email now returns Result and only falls back to the email for a genuine 'no derived username'; a query error propagates so callers fail closed rather than leaking the raw email as the acting username. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: clarify non-member superadmin popover (username used + admin permissions) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: keep username_to_email endpoint member-only to not disclose non-member superadmin email (CI review) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: forbid disabling automate_username_creation once usernames assigned (CI review) Makes the setting effectively one-way once instance-wide usernames exist, so the global-uniqueness invariant that keeps stored u/<username> identities (schedules/triggers/drafts/superadmin ownership) unambiguous can never be dropped back to workspace-local uniqueness. Re-saving false on an already-disabled instance stays a no-op. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-01 14:54:07 +00:00
hugocasa	83f3d7f910	feat(licensing): enforce offline license seat cap (#9845) ... * [ee] feat(licensing): enforce offline license seat cap Companion to windmill-ee-private. Aligns the offline-license seat count with the billing model and adds real-time enforcement when usage exceeds the cap. OSS side carries the ee_oss stubs, the reactivation cap-check call site, the regenerated SQLx cache, and the EE ref bump. - Exclude instance-disabled users (password.disabled) and service accounts from the seat count. Deactivating a user now frees a seat. - Service accounts no longer consume seats (no check at creation). - Hard-block reactivation when it would exceed the cap. - Invalidate the license (halting jobs) when seat usage exceeds the cap, mirroring CU-cap enforcement; recovers when usage drops back under or a higher-cap key is loaded. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * [ee] fix(licensing): bump EE ref for reactivation seat-check fixes Points to the EE companion commit that fixes reactivation double-counting and preserves the original seat alert tag. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * [ee] fix(licensing): reactivation seat delta includes pending invites Bumps the EE ref and drops the now-orphaned usr-only cache entry; the reactivation check reuses the existing usr ∪ workspace_invite query. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * [ee] test(licensing): bump EE ref for offline seat-cap tests Adds #[sqlx::test] coverage for the offline seat counting and cap-check logic; EE-only (runtime queries, no cache change). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore: update ee-repo-ref to f814c3f75308c1ef1e4526d8d0eeb360ce16abe4 This commit updates the EE repository reference after PR #637 was merged in windmill-ee-private. Previous ee-repo-ref: b2622e3afc2fe1fe3e2ec978ca46cf9decf91b82 New ee-repo-ref: f814c3f75308c1ef1e4526d8d0eeb360ce16abe4 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev>	2026-06-30 23:52:12 +02:00
Ruben Fiszel	0dbd9c1231	perf: eliminate dual-connection DB pool contention across worker, queue, and api (#9798) ... * perf: eliminate dual-connection DB pool contention across worker, queue, and api Reuse the held transaction (or move pool reads before begin()) instead of checking out a second pool connection while a tx is open, extending the fix from #9789/#7861. Targets the per-worker pool (max 5) hot paths plus several server-pool API handlers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: pass owned pool to get_email_from_permissioned_as in http trigger handler The generified signature takes impl PgExecutor; the http trigger handler passed &db where db is already &DB, yielding &&Pool which does not impl PgExecutor (only surfaced under the full feature set in CI). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: keep RLS-exposed reads on the non-RLS pool and isolate flow-eval reads in a savepoint Addresses review of the dual-connection sweep: - worker_flow: wrap the stop_after_all_iters_if reads in a SAVEPOINT. The caller swallows the error and keeps using tx, so a DB read failure must not leave the outer transaction aborted (it would fail the later commit). Matches the previous pool-read semantics. - Revert reads that were moved onto an RLS (user_db) transaction back to the non-RLS pool, since RLS row-visibility/role context can change results: push_scheduled_job (email/tag/settings lookups; reachable with a user_db tx from api-schedule/api-flows), push_inner native-retry dedicated_worker routing (RLS isolation variants), resources.rs app-namespace folder auto-create (non-admins must not be blocked), and the script archive/delete UPDATEs. Non-RLS db.begin() reuse and move-before-begin are kept. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: failpoint proving the stop_after_all_iters_if savepoint isolates an aborted read Adds a worker-crate failpoints feature and a data-driven hook: when the stop_after_all_iters_if expr is the magic sentinel, the in-evaluation read runs SELECT 1/0 to abort its (savepoint) transaction. The test asserts the flow still completes (iteration marked failed) — which only holds if the savepoint keeps the outer status-update transaction committable. Without the savepoint the abort would poison the outer tx and the job would never complete. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-25 21:33:17 +00:00
hugocasa	043c2c05b7	fix: forbid superadmin job tokens from global user and token management (#9715) ... * fix: forbid superadmin job tokens from global user and token management Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: extend superadmin job token guard to offboard and export routes Apply forbid_superadmin_job_token to offboard_global_user and export_global_users, the remaining global user-management routes that were gated only by require_super_admin. Offboarding can delete a user along with their tokens, password, invites and instance-group membership, and export returns every user's password_hash, so both must be unreachable by a superadmin job token. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-24 00:38:27 +02:00
hugocasa	e8e0701a36	feat(api): add endpoint to update token label (#9474) ... * feat(api): add endpoint to update token label Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(api): prevent renaming the session token label Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(api): restrict token-label edits to user tokens, not just session Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(frontend): edit token label in the edit modal instead of inline Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(api): reject relabeling tokens to reserved system-token names Centralize the is_user_token classifier in windmill-common and reuse it to reject labels colliding with system-token namespaces (ephemeral*, debugger-token, mcp-oauth-*), not just session. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(api): match ephemeral label case-insensitively and cap label length Align the canonical is_user_token, the SQL guard and the frontend mirror on a case-insensitive `ephemeral` match (so a token can't be relabeled to a casing the backend allows but the UI hides), reject labels over the VARCHAR(1000) column limit with a 400, and add unit tests for is_user_token. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-08 17:33:31 +00:00
Ruben Fiszel	2ddf93de96	fix(auth): enforce monotonic privilege on user token lifecycle endpoints (#9371)	2026-05-30 11:45:42 +00:00
Ruben Fiszel	b125eca762	feat(service-accounts): allow choosing role at creation time (#9307) ... * [ee] feat(service-accounts): allow choosing role at creation time Previously, service accounts were hardcoded to operator and could not be used as the CLI sync user since they had no write access. They also only counted as 0.5 seat each. This change: - Extends `NewServiceAccount` to accept optional `is_admin` / `operator` (defaults to `operator=true` for backward compatibility). - Exposes a role picker in `AddUser.svelte` when creating a service account (Operator / Developer / Admin). - Lets admins update a service account's role from the user list (it used to be locked to "Operator" with a tooltip). - Updates the OpenAPI spec + regenerates the frontend client. A developer/admin service account counts as 1 seat under the existing seat-cap logic (operators stay at 0.5). Companion PR on windmill-ee-private updates the `INSERT INTO usr` to honour the chosen role. Fixes WIN-1985 * [ee] feat(service-accounts): wm_deployers opt-in for Dev role When creating a service account with role=Developer, surface a toggle "Add to wm_deployers" (recommended). Members of wm_deployers can deploy on behalf of other users — the typical setup when the service account is used as the CLI sync / CI deploy identity. - `NewServiceAccount` gains an optional `add_to_deployers` flag. - Frontend defaults the toggle to on but only shows it under Developer (admins have it implicitly; operators can't deploy). - Tooltip links to docs.windmill.dev "Run on behalf of". Companion EE PR updates the handler to INSERT into usr_to_group for wm_deployers when the flag is set. Refs WIN-1985 * chore: update ee-repo-ref to 974ed42067d9f63acb42332b671b8c01ffd4b625 This commit updates the EE repository reference after PR #589 was merged in windmill-ee-private. Previous ee-repo-ref: f7dbc3cc2ba21c396f4828881e3b9d9ab6f50c69 New ee-repo-ref: 974ed42067d9f63acb42332b671b8c01ffd4b625 Automated by sync-ee-ref workflow. * [ee] fix(service-accounts): unhardcode role in superadmin user list Two review issues from the merged #9307 / #589: 1. P1 — The global Users tab in #superadmin-settings still pinned every service account to "Operator". Now it shows the actual role (Admin / Operator / Developer), derived from the SA's usr row. - `list_users_as_super_admin`: replaced `true as operator_only` with the real `operator` value, and added `is_workspace_admin` from the row (NULL for password users since their admin status is per-workspace). - `global_whoami`: when the email belongs to a service account, look up its real `operator` / `is_admin` instead of pinning to operator. - `SuperadminSettingsInner.svelte`: drop the hardcoded "Operator" badge; render Admin / Operator / Developer using the new fields, matching the workspace-level view. 2. P2 — Regenerate the bundled `openapi-deref.{yaml,json}` so the `createServiceAccount` body (now exposing `is_admin`, `operator`, `add_to_deployers`) and the new `GlobalUserInfo.is_workspace_admin` field show up at runtime in `/api/openapi.{yaml,json}`. Bumps `ee-repo-ref.txt` to the EE follow-up that adds the offline seat-cap check on `create_service_account`. Refs WIN-1985 * chore: update ee-repo-ref to b7a6068c1f3dc845e012959268b2426f0de4d697 This commit updates the EE repository reference after PR #590 was merged in windmill-ee-private. Previous ee-repo-ref: 0b1307c21d1bfd6fb43a03c2ba39d2a8bf8e6470 New ee-repo-ref: b7a6068c1f3dc845e012959268b2426f0de4d697 Automated by sync-ee-ref workflow. --------- Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>	2026-05-25 16:18:38 +00:00
Ruben Fiszel	e5286f4607	feat: include service accounts in instance settings users list (#9157) ... * feat: include service accounts in instance settings users list Service accounts (workspace-scoped, no password row) now appear in the superadmin users list with a Bot icon, workspace badge, and a link to manage them in the workspace settings. Role is locked to Operator. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: update sqlx offline cache Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: use composite key for users each block Service accounts can share emails across workspaces, so key by email + workspace_id to avoid Svelte each_key_duplicate. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-14 06:46:48 +00:00
Ruben Fiszel	d666e8431c	feat: read-only flag on API tokens (#9144) ... * feat: read-only flag on API tokens, orthogonal to scopes Add a per-token `read_only` boolean set at creation time. When true, the token can only call HTTP methods classified as Read (GET/HEAD/OPTIONS). Mutating methods and job-run actions are rejected with 403, regardless of which scopes are attached. Surfaced as a prominent toggle in the standard token-creation flow and a discreet `2xs` toggle in MCP mode (where users often want write access, so we don't bias them toward enabling it). MCP enforcement: read-only tokens hide all script/flow/hub tools from `list_tools` and only see endpoint tools whose method is GET, and the runner rejects `call_tool` on anything mutating. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: review fixes for read-only token flag - Exempt /api/mcp/* and /mcp/* paths from the read-only middleware check. MCP transport runs over POST (streamable HTTP / SSE), so otherwise the middleware would 403 every MCP request before the runner could enforce read-only at the tool-call level. - Tighten is_endpoint_read_only to GET only, matching the read_only_hint that create_endpoint_annotations actually emits. - Add unit test for check_read_only_for_route covering GET/HEAD/OPTIONS, mutating methods, and run paths. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: bump ee-repo-ref to read-only-trigger-toggle Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(frontend): make read-only toggle discreet in both modes Match the MCP-mode treatment in standard mode: text-tertiary, 2xs, shared "Read-only" label. The tooltip switches per mode so the explanation still fits the context. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(frontend): gate read-only toggle behind Limit token permissions The read-only toggle now only shows when the user has limited the token's scopes (standard mode) or in MCP mode (which always picks an MCP scope). Turning the limit off also resets read-only so it doesn't silently stick. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(frontend): hide incompatible MCP tools when read-only is on When the read-only toggle is on in MCP mode: - Endpoint badges and the custom-mode endpoint MultiSelect filter to GET. - Already-selected non-GET endpoints are pruned from the scope. - The scripts/flows preview is replaced with a note explaining they're hidden (the runner already rejects script/flow runs for read-only). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(frontend): place read-only toggle at top of limited scope area The previous gate required at least one scope to be picked before the read-only toggle appeared, which made it look missing while the user was still building their scope list. Move the toggle inside ScopesPicker: - Standard mode: sits directly under the "Limit token permissions" toggle whenever Limit is on, before the scope selector. - MCP mode: sits at the top of the MCP scope block. readOnly is now $bindable on ScopesPicker so CreateToken still owns the value. The auto-reset on un-limit moves into ScopesPicker too. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(frontend): nest read-only toggle inside the scope list card Place the read-only toggle at the top of the scope list (between the Selected Scopes summary and the bordered domain list) via a new optional topSlot snippet on ScopeSelector. Keeps ScopeSelector decoupled from read-only specifics; ScopesPicker fills the slot. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 9bc8160be50b3e57a60daf4e1b71c389a6e02b8a This commit updates the EE repository reference after PR #571 was merged in windmill-ee-private. Previous ee-repo-ref: f53d26e6685dfd60bfa67686fbd7358169cfd130 New ee-repo-ref: 9bc8160be50b3e57a60daf4e1b71c389a6e02b8a Automated by sync-ee-ref workflow. * fix: address CI review for read-only token flag - P1 (Codex): narrow the MCP middleware exemption from "any /api/mcp/*" to just the streamable HTTP transport endpoints (/api/mcp/gateway, /api/mcp/w/{ws}/{mcp,sse,list_tools}). Without this, a read-only token could POST /api/mcp/gateway/oauth/server/approve and mint a follow-on non-read-only MCP token via the OAuth code/token exchange. - P2 (Claude/cubic): fix test comment/assertion mismatch — the run-path assertion now exercises GET (which is what the RUN_PATH_ACTIONS elevation comment describes) in addition to POST. Add a regression assertion for /api/mcp/gateway/oauth/server/approve. - P2 (cubic): short-circuit script/flow/hub-script/resource fetches in MCP list_tools when read_only is on — they would only be discarded below, so skipping the DB and resource fan-out is pure win. - P2 (cubic): when scopes are pre-supplied via the CreateToken prop, the ScopesPicker isn't rendered, which previously hid the read-only toggle entirely. Render it next to the pre-supplied scopes display. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>	2026-05-13 15:26:21 +00:00
hugocasa	e74f06cb56	fix: handle singlestepflow zombies and stop filtering them from runs page (#9055) ... * fix: handle singlestepflow zombies and stop filtering them from runs page * fix: support singlestepflow in batch_rerun_jobs Previous PR added singlestepflow to list_selected_job_groups so the BatchReRun pane shows them, but batch_rerun_jobs_inner still joined on kind = 'script' / 'flow' with j.runnable_id (which is NULL for SingleStepFlow), so the rows were silently filtered out — user sees the option, click Re-run, gets zero successes. Mirror the norm_kind CTE projection from list_selected_job_groups inside batch_rerun_jobs_inner: pull the wrapped runnable type and pinned script hash from raw_flow.modules[id='a'], cast back to JOB_KIND so the existing handler dispatch works unchanged. Path-based schema fallback so input_transforms still resolve at rerun time. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: project singlestepflow in batch-rerun schema lookups Codex review pointed out two follow-on regressions from the previous fix: (1) list_selected_job_groups returned schemas with script_hash=null and schema=null for singlestepflow rows because the inner schemas subquery still joined runnable metadata via j.runnable_id (NULL for SingleStepFlow). The BatchReRun pane consumes every selected.schemas entry through mergeSchemasForBatchReruns / buildExtraLibForBatchReruns, both of which assume real schema objects. (2) When use_latest_version=true, batch_rerun_handle_job re-fetched latest_schema from v2_job filtering jb.kind='script' or 'flow' — neither matched singlestepflow, so schema came back NULL and every input_transforms entry silently no-op'd. Both queries now project singlestepflow rows via raw_flow.modules[id='a'] — norm_kind for dispatch and effective_hash for the schemas join, plus a path-based latest-schema fallback so flow-wrapped SSF (no version pinning) and any SSF whose pinned hash has been deleted still resolve. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test: add batch_rerun integration tests, fix SSF hash hex parsing Adds 11 integration tests against /jobs/run/batch_rerun_jobs and /jobs/list_selected_job_groups (both endpoints had zero CI coverage). Tests cover the full 4-kind × 3-mode matrix: regular Script and Flow (baseline regression for the SQL refactor), script-wrapped and flow- wrapped SingleStepFlow (regression for the bugs this PR fixes), and a mixed-kind batch. Writing the tests caught a real bug in the previous commit: ScriptHash serializes as a 16-char hex string in raw_flow.modules[a].value.hash (per the custom Serialize impl in windmill-types/scripts.rs), not as an integer. The earlier `(m->'value'->>'hash')::bigint` cast worked on the hand-inserted SQL fixture I'd used for live testing (which embedded the hash as a raw integer) but failed in production where all SSF jobs are pushed via JobPayload::SingleStepFlow's serialized form. Replaced with `('x' || lpad(hex, 16, '0'))::bit(64)::bigint` — preserves the twos-complement bit pattern so both positive and negative i64 hashes round-trip correctly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Update SQLx metadata --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>	2026-05-07 08:00:38 +00:00
Ruben Fiszel	1174d7d77f	refactor: replace SELECT * with explicit column lists (#9010) ... * refactor: replace SELECT * with explicit column lists Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore: update sqlx offline query cache * chore: update sqlx offline query cache * chore: update sqlx offline query cache with EE support * chore: update sqlx offline query cache, no deletions * chore: update sqlx offline query cache after rebase * fix: correct column names in explicit script query lists - concurrency_limit → concurrent_limit (matches DB column name) - runnable_settings → runnable_settings_handle (matches DB column name) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: add missing delete_after_secs column to script queries Also add integration test covering all explicit-column export queries. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: add workspace export integration test covering all explicit-column queries Covers tarball_workspace (folder, script, resource, resource_type, variable, schedule, usr, group_) and the mcp_oauth_client SELECT query from windmill-mcp. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: add tarball export integration test covering all explicit-column queries Single test creates one of each entity type and exercises every runtime-checked explicit-column query in tarball_workspace. Uses archive_type=tar to avoid zip feature-gate in CI. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs: fix stale verification step and CI contradiction in update-sqlx skill - Regenerate current_files.txt after EE cache restoration so step 4 reports accurate diff - Scope "Never use SQLX_OFFLINE=true" to local prepare (CI legitimately uses it) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs: remove Co-Authored-By from commit skill template * refactor: extract SCRIPT_COLUMNS const to single source of truth Replaces 5 duplicated 44-column lists with a shared const in windmill-types. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>	2026-05-04 08:39:45 +00:00
Ruben Fiszel	392888d113	docs: add SAFETY comments to all dynamic SQL call sites (#9009) ... * docs: add SAFETY comments to all dynamic SQL call sites Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs: address review feedback on SAFETY comments - Fix missed comment for obo_triggers loop in offboarding.rs - Fix variable name in comment (table -> table_name) in offboarding.rs - Fix api-settings comment to reference inline VALID_NAME regex, not validate_dbname() - Add SAFETY comments to batch_execute calls in api-settings - Fix db.rs comment: PG_SCHEMA is env var, not compile-time constant - Add doc comments on RunnableSettingsTraitInternal constants * docs: remove misleading SAFETY comment on static SQL --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>	2026-05-03 07:14:14 +00:00
hugocasa	e9e72fbbf8	feat: edit scopes on existing API tokens (#8967) ... * feat: edit scopes on existing API tokens Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: address PR review feedback on token scope edit - add SECURITY DEFINER to notify_token_scopes_change so trigger fires under windmill_user/admin roles (cubic P1) - drop banned $bindable(default) on optional props (CLAUDE.md): make ScopesPicker.value and EditTokenScopesModal.open required - detect MCP only when *every* scope starts with mcp: so mixed/null-scope tokens fall back to standard picker without dropping non-mcp scopes - audit log scope payload via serde_json instead of Rust {:?} Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-29 19:49:56 +00:00
hugocasa	d6c642b170	feat: add Azure Event Grid triggers (#8888) ... * feat: add Azure Event Grid triggers (EE) Introduces a new enterprise trigger kind `azure` that supports three modes via a single unified trigger type: - basic_push: Azure Event Grid basic — custom topics, system topics (Storage, Resource Manager, Key Vault, etc.), domains (push only) - namespace_push: Event Grid Namespace topics (CloudEvents over HTTP push) - namespace_pull: Event Grid Namespace topics (HTTP pull with lock-token ack/reject for dead-lettering) Auth uses a Service Principal resource (tenant_id, client_id, client_secret, subscription_id). Subscriptions are created in CloudEvents 1.0 schema so the push webhook handler and the pull listener share one payload parser. Backend - New crate `windmill-trigger-azure` (OSS stubs + EE impl symlinked from windmill-ee-private) - Migration `azure_trigger` table with CHECK constraints enforcing mode/columns coherence - `TriggerKind::Azure`, `JobTriggerKind::Azure`, `DeployedObject::AzureTrigger` variants - Push route `/api/azure/w/{workspace}/*path` handles classic Event Grid SubscriptionValidation handshake and CloudEvents 1.0 abuse-protection OPTIONS handshake - Optional inbound JWT validation (audience check only for v1) - Feature flag `azure_trigger` propagated through windmill-api, windmill-store (resource helper), and added to ee_core Frontend - `triggers/azure/` editor with mode toggle (basic/namespace-push/ namespace-pull) and per-mode config (topic ARM id / namespace + topic name / subscription / filters / push auth / pull options) - Registered in icon map, display names, save functions, badge, wrapper, editor, add-trigger menu OpenAPI - `AzureTrigger`, `AzureTriggerData`, `AzureMode`, `AzureSubscriptionMode`, `AzureDeliveryConfig`, `TestAzureConnection` schemas; `/azure_triggers/*` endpoints; client regenerated Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to eaa7c3a9cb37a9ccc93f10a2535d929365acd2d8 This commit updates the EE repository reference after PR #541 was merged in windmill-ee-private. Previous ee-repo-ref: 9689014e8c12c36c1059fd8fa5758d550b8b8bc9 New ee-repo-ref: eaa7c3a9cb37a9ccc93f10a2535d929365acd2d8 Automated by sync-ee-ref workflow. * feat(azure-trigger): secret-auth push, ARM discovery, capture isolation, CLI + parity Frontend: - Split mode selector into Namespace/Basic + Pull/Push - ARM resource dropdowns (namespaces, Basic topics, namespace topics) populated from the service principal; cascade with stale-selection reset on SP / edition change - Remove stale authenticate toggle + audience input (server-managed push_auth_config has replaced them) - Azure listing page: "Create from template" button; "Also delete Azure subscription" toggle in the delete modal; simplified trigger label falling back to path - AzureCapture.svelte: "Test subscription name" with -wm-capture suffix - CompareWorkspaces.svelte: wire Azure for fork/compare - Drop Trigger-deployed/event-loss warning (capture subscription is isolated with -wm-capture) Backend: - Shared-secret push auth (see EE crate for detail) - JSONB push_auth_config column (renamed from delivery_config), #[serde(skip)] so clients/CLI/exports never see it - Drop redundant enabled column; mode supersedes - Azure capture infra: AzureTriggerConfig + set_azure_trigger_config + azure_payload route + TriggerKind::Azure arm; PT15M queue TTL on capture subscriptions so they bound storage after tab close - Granular ACLs, users offboarding, trash, git-sync deployed-object: all include azure_trigger CLI: - Add azure to TRIGGER_TYPES, pushObj dispatch, getTypeStrFromPath, trigger commands (get/update/create/list/template), sync delete switch + regex; e2e test for `trigger new --kind azure` - system_prompts: SCHEMA_MAPPINGS + schema_names include AzureTrigger; auto-generated/* regenerated Skill: - .claude/skills/adding-a-trigger/ checklist covering every file that needs editing when wiring a new trigger type (learned from this PR) ee-repo-ref bumped to b0e490cbf3724b7b64c6a5b010e3bdf24acd873c. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(azure-trigger): ci — ShareModal Kind + regenerated system_prompts - frontend/src/lib/components/ShareModal.svelte: add 'azure_trigger' to the Kind type so the listing page's "Permissions" action compiles (ts2345 — caught by npm_check on CI, missed by fast-check locally). - system_prompts/auto-generated/: regenerate to drop the stale delivery_config / AzureDeliveryConfig fields from the Azure schema (check-freshness on CI). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(azure-trigger): use workspace constant_time_eq crate Drop hand-rolled constant-time compare in favour of the workspace constant_time_eq crate (same one used by http_trigger_auth). ee-repo-ref bumped to 9659382d47286e7f7f66d01b6f5dd8d4ed34848b. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(azure-trigger): pass placeholder + disabled via inputProps `TextInput`'s `placeholder` and `disabled` go through its `inputProps` prop — CI's `npm run check` caught the stale top-level passing that `npm run check:fast` missed. Align with the DefaultEmailConfigSection pattern. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(azure-trigger): correct LATEST_GIT_SYNC_SCRIPT_PATH version to 28213 The hub deploy of the azure-aware sync-script is version 28213, not 28214. Backend was pinning a non-existent hub script, which broke the git_sync_e2e suite (every deploy's sync step 404'd). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(azure-trigger): add azure_triggers to token scope selector + skill - windmill-api/src/token.rs: `build_trigger_scope_domains` was missing `("azure_triggers", "Azure Event Grid")`, so the CreateToken UI's scope selector didn't surface azure_triggers:read/write. Backend already had `ScopeDomain::AzureTriggers` wired (scopes.rs), this just exposes it. - .claude/skills/adding-a-trigger/SKILL.md: capture both scope-related files under the hardcoded-arrays section so future triggers don't miss the UI surface. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs(adding-a-trigger-skill): clarify token.rs scope effect Not a regression — nothing was working before. Skipping TRIGGER_DOMAINS just means the scope works via API/CLI but has no UI checkbox. * docs(adding-a-trigger-skill): trim token.rs bullet * fix(azure-trigger): regen openapi-deref + swap textarea for TextInput - Run build_openapi.sh to regenerate openapi-deref.{yaml,json} with the 12 azure_triggers paths + schemas. These files are served by the runtime (include_str! in windmill-api/src/lib.rs) to external SDK consumers; without this regen the new endpoints wouldn't be advertised. - Replace the raw <textarea> for event type filters with the design-system TextInput in textarea mode (frontend/CLAUDE.md bans raw HTML elements). Addresses cubic + claude PR review items. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>	2026-04-23 16:30:18 +00:00
Ruben Fiszel	0cfa131254	feat: add disable_password_login global setting (#8873) ... Adds an instance-level toggle that hides the email/password form on the login page and rejects password login, password reset request, and password reset endpoints server-side. Useful for OAuth/SAML-only deployments. - New `disable_password_login` global setting + lazy_static AtomicBool - `load_disable_password_login` loader wired into monitor initial_load and notify_global_setting_change listener - Unauthenticated `GET /auth/is_password_login_disabled` endpoint so the login page can hide the password form when enabled - Toggle in Instance Settings → Auth/OAuth/SAML - Login.svelte hides the password form and the "Log in without third-party" toggle when the setting is on Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-17 18:12:30 +00:00
Ruben Fiszel	5b3913052e	refactor: convert read-hot globals to AtomicBool/I64 and ArcSwap (#8815) ... * refactor: extract load helpers from reload_setting family Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: convert atomic primitive globals to AtomicBool/AtomicI64 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: convert CRITICAL_*/HUB_API_SECRET/INSTANCE_EVENTS_WEBHOOK/JWT_SECRET to ArcSwap Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: pin ee-repo-ref to arcswap-refactor EE branch commit * refactor: convert BASE_URL/HUB_BASE_URL/MIN_VERSION/LICENSE_KEY*/LICENSE_KEY_ID to ArcSwap Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: convert worker hot-path globals to ArcSwap (WORKER_CONFIG et al) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: pin ee-repo-ref to combined arcswap-urls+worker EE commit * chore: update ee-repo-ref to d8be8f88cb8898c8f6b27421989d53528223815d This commit updates the EE repository reference after PR #532 was merged in windmill-ee-private. Previous ee-repo-ref: c375aaaac9ec0fc0480993627d0defc8054c31a4 New ee-repo-ref: d8be8f88cb8898c8f6b27421989d53528223815d Automated by sync-ee-ref workflow. * fix: cleanup unused imports + fix 2 missed WORKER_CONFIG readers Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to ce0f8fbbbde09c4a858312d2d8716d224e99042c This commit updates the EE repository reference after PR #534 was merged in windmill-ee-private. Previous ee-repo-ref: 450b601b5aba0ca0b2045f4b5071aa8701b4bfb7 New ee-repo-ref: ce0f8fbbbde09c4a858312d2d8716d224e99042c Automated by sync-ee-ref workflow. * fix: secret_backend_integration test — BASE_URL.write().await → .store() Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: convert APP_WORKSPACED_ROUTE to AtomicBool for symmetry with HTTP_ROUTE_WORKSPACED_ROUTE Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to e587df8 (post-#535 merge) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>	2026-04-14 00:04:10 +00:00
hugocasa	435b25e6a4	feat: add user offboarding flow with object reassignment (#8647) ... * feat: add user offboarding flow with object reassignment Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: require new_operator for permissioned_as when reassigning to folder Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: update on_behalf_of_email on scripts/flows during offboarding Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: extract offboarding to separate module and add integration tests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: delete tokens, add operator preview counts, remove token reassignment UI Tokens are now always deleted during offboarding. Preview now shows scripts/flows/apps with on_behalf_of and schedules/triggers with permissioned_as referencing the departing user (even outside their path). Token reassignment UI removed since webhooks break on path changes anyway. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: rich preview with path lists, warnings, and downloadable report Preview now returns full path lists (not just counts) for owned objects and objects executing on behalf of the user. Adds warnings for: - HTTP triggers (webhook URLs will change) - Email triggers (addresses will change) - Broken $var:/$res: references in resources/variables Frontend provides "Export list" button to download affected content. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test: add coverage for dynamic queries (triggers, extra_perms, operator schedules) Adds HTTP trigger, extra_perms reference, and shared schedule to test fixture. Tests verify that non-macro sqlx queries (trigger reassignment, extra_perms cleanup, operator schedule update) work correctly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: remove broken_references, add full dynamic query test coverage Remove broken_references field from preview (user's resources/variables are already in the owned paths list). Add shared HTTP trigger fixture to test all dynamic query paths: trigger operator preview (line 232), trigger permissioned_as update for non-user-path (line 951), and extra_perms cleanup on trigger tables (line 983). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: add referencing field to preview for content/value path references Preview now includes a 'referencing' section listing scripts (by content), flows (by value JSON), apps (by policy/extra_perms), and resources (by value) that contain references to u/{username}/ paths. These references may break after reassignment. Shown in export list and as a warning in the UI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: rename objects to items in UI, detect on_behalf_of items in hasItems Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: replace remaining objects with items in UI text Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: rename operator to on_behalf_of, separate owned vs on-behalf UI sections - Rename new_operator to new_on_behalf_of_user in API and frontend - Rename op_ prefixed variables to obo_ in backend - UI now shows separate sections for owned items and items running on behalf, with the operator selector shown only when needed - canSubmit logic updated: operator needed for folder targets OR when on-behalf items exist Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: CSV export, side-by-side layout, always accept new_on_behalf_of_user - Export affected items as CSV instead of text - Owned items and on-behalf items shown side by side in summary boxes - new_on_behalf_of_user always accepted (defaults to target user for user targets, required for folder targets) - On_behalf_of selector always visible, auto-defaults when user target is selected Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: proper pluralization and bottom-aligned counts in summary boxes Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: stack info boxes vertically, referencing box as warning style at top Info boxes (owned, on-behalf, referencing) now one per row instead of side-by-side. Referencing box uses warning colors. Webhook/email trigger alerts shown below boxes. Proper pluralization in global modal too. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: CSV exports only referencing items, export button inside warning box Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: use ToggleButtonGroup for user/folder, add reassign toggle on remove - User/Folder selection now uses ToggleButtonGroup component - When removing a user, a "Reassign items before removing" toggle lets the admin skip reassignment and just delete directly - In reassign-only mode, the toggle is not shown (always reassigns) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: show token details with labels and scopes in preview Preview now returns token label, scopes, and expiration instead of just a count. Frontend shows a dedicated token box listing each token with its scopes. Test updated to verify token label in preview response. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: extract shared offboarding components, per-type trigger links, hash deep linking - Extract OffboardItemsBox, OffboardReassignControls, OffboardWorkspaceSection, and offboarding-utils.ts as shared components used by both workspace and global modals - Change triggers in OffboardAffectedPaths from Vec<String> to HashMap<String, Vec<String>> so frontend knows which trigger page to link to - Add hash-based deep linking to all 9 trigger pages and schedules page - Preserve URL hash in updateQueryFilters across all trigger pages - Only open editor drawer if the item is found in the list - Reassign toggle at top with warning alert when disabled (both modals) - Referencing items box uses yellow warning variant with expandable path links - Cleaner labels: "Move u/{username}/* items to", "Update triggers/runnables permissions to" Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: rename on_behalf_of section label to match flow advanced settings Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: regenerate sqlx query cache Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review issues for offboarding - Add 9 trigger tables to check_path_conflicts for user-friendly conflict messages - Fix submit button no-op when user has only on-behalf items (show target selector, fix canSubmit) - Only delete workspace user when reassignment entry exists (prevent orphaned objects) - Add $azure_kv: prefix to vault secret query (match rename_user pattern) - Use Svelte 5 onSelected callback instead of deprecated on:selected - Make ScriptBuilder section label conditional on canPreserve - Fix CSV export to include trigger paths via flattenPaths utility - Fix test_offboard_reassign_only to remove conflicts and assert on response - Parallelize workspace config fetches in global modal with Promise.all - Delete tokens when deleting workspace user - Return structured JSON from global offboard endpoint Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * sqlx * fix: address second round of PR review issues - Accumulate per-workspace OffboardSummary in global offboard instead of returning zeros - Delete workspace user unconditionally when delete_user=true (prevent orphaned usr rows) - Filter archived/deleted scripts in check_path_conflicts to match preview - Reset form state when workspace offboard modal reopens - Move hashHandled=true inside trigger-found guard on all 10 deep-link pages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test: improve offboarding integration tests - Add second workspace to fixture for multi-workspace global offboard testing - Add test_global_offboard_execution: verifies items reassigned across 2 workspaces, user deleted from both, and password row deleted from instance - Add test_offboard_invalid_target: verifies 400 for nonexistent user, nonexistent folder, and invalid target format - Fix test_offboard_to_user: use single DELETE, add explicit new_on_behalf_of_user - Fix test_global_offboard_preview: assert 2 workspaces instead of 1 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address third round of PR review issues - Fix ScriptBuilder tooltip to match conditional section label wording - Clear stale conflicts in global modal on reopen - Fix test_offboard_to_folder to assert on specific moved path, not pre-existing data - Allow deleting user with zero items (show Offboard button, skip reassignment) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add global token deletion warning in instance-level offboard modal Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * update sqlx * fix: add raw_app path and dependency_map path reassignment to offboarding Audit found these tables with user-scoped paths were not being updated: - raw_app: mirrors app paths, needs path reassignment - dependency_map: importer_path and imported_path reference user paths Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: move user cleanup to delete_workspace_user_internal, fix review issues - Move extra_perms, folder owners, drafts, favorites, inputs, captures cleanup into delete_workspace_user_internal so any user deletion gets proper cleanup (not just offboard path) - Fix flow INSERT missing labels and lock_error_logs columns (data loss) - Fix validate_target returning 404 instead of 400 for nonexistent targets - Fix canSubmit blocking delete when user has no items to reassign - Fix token preview query filtering out tokens without scopes - Fix token warning messages: workspace-level mentions webhooks/HTTP triggers, instance-level mentions API calls using credentials - Fix "Schedules and triggers" -> "Triggers and runnables" wording - Show token section at instance level only when tokens exist - Show Offboard button at instance level when user has no items but deleteUser=true Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-09 17:31:36 +00:00
Ruben Fiszel	c86846ac19	rate limit token creation on CLOUD_HOSTED (10/min per user) (#8664) ... Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-02 01:52:02 +00:00
Ruben Fiszel	754b88a52c	fix: harden login rate limiting with CLOUD_HOSTED gating and memory eviction (#8602) ... * fix: harden login rate limiting with CLOUD_HOSTED gating, memory eviction, and race fix Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: replace global DashMap with atomics and move extract_client_ip inside conditional Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 13:52:13 +00:00
Ruben Fiszel	06bbe7b94b	fix: add per-IP and per-account brute force protection on login endpoint (#8601) ... Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-29 13:16:11 +00:00
Ruben Fiszel	3959fe8297	feat: add workspace-level service accounts (#8560) ... * feat: add workspace-level service accounts (EE) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * sqlx * sqlx * chore: update ee-repo-ref Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 19:23:03 +00:00
Ruben Fiszel	0389d9601c	chore: upgrade axum 0.7 to 0.8 (#8539) ... * chore: upgrade axum 0.7 to 0.8 and related dependencies Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test: add route reachability tests for ~80 previously untested endpoints Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: switch feature-gated trigger handlers from axum::async_trait to async_trait crate Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: update new trash routes to axum 0.8 path syntax Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to latest EE commit Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test: upgrade route tests to assert 2xx responses with proper data setup Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test: restore npm_proxy and ai_routes tests using local echo servers Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: gate workspace fork test behind enterprise feature flag Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test: add ~40 more endpoint tests (jobs authed, health, favorites, ACLs, reachability) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address review findings from axum 0.8 upgrade - Use cookie value_trimmed() instead of value() for cookie 0.18 compat - Update comments still referencing old :workspace_id syntax Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 61ae055ea31481f1899953e9d5f65566b8c707b1 This commit updates the EE repository reference after PR #486 was merged in windmill-ee-private. Previous ee-repo-ref: 0059d175a6fdddf52998b183bf91059b224704ac New ee-repo-ref: 61ae055ea31481f1899953e9d5f65566b8c707b1 Automated by sync-ee-ref workflow. * test: add test for new get_imports endpoint Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: remove unused import in raw_apps test Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>	2026-03-27 09:55:04 +00:00
hugocasa	0bd756839c	feat: SCIM user deprovisioning (active:false) + instance-level user disable (#8484) ... * [ee] feat: handle active:false in SCIM user PATCH/PUT for deprovisioning Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref for SCIM active:false deprovision fix Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * nit sqlx * [ee] feat: add password.disabled column for SCIM user deactivation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * [ee] feat: enforce password.disabled in auth checks Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * [ee] refactor: use scim_deactivated_user table instead of password.disabled Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * [ee] fix: apply SCIM filters to deactivated users, add name column Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add down migration for scim_deactivated_user Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: rename migration to avoid timestamp conflict, update sqlx cache Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * [ee] refactor: use password.disabled for SCIM deactivation, block login for disabled users Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * [ee] feat: show disabled toggle in superadmin user list, add disabled field to API Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: add confirmation modal when disabling instance user Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: improve disable user confirmation text Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: revert toggle state when disable confirmation is cancelled Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: properly revert toggle on disable cancel using reset key Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: move disable/enable to dropdown menu, add disabled badge on email Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: rename 'Show active users only' to 'Recently active only' to avoid confusion with disabled state Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: remove accidentally committed gen files Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use .catch() for enable user error handling in dropdown action Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: delete tokens on user removal, improve confirmation modal texts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update sqlx cache for non-enterprise code paths Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: restore sqlx cache files deleted by incorrect prepare run Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add missing sqlx cache for non-enterprise git sync query Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to a1274aa11a83f608eacc32c0d449ca3527d98c15 This commit updates the EE repository reference after PR #473 was merged in windmill-ee-private. Previous ee-repo-ref: 30f8c53b101b9e25107e793cdc038b0e07061739 New ee-repo-ref: a1274aa11a83f608eacc32c0d449ca3527d98c15 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>	2026-03-25 17:10:20 +00:00
Ruben Fiszel	4c8edd5e94	fix: restrict logout redirect to whitelisted domains (#8524) ... Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>	2026-03-25 14:51:13 +00:00
centdix	f2f178eb31	chore: remove dead users_oss module (#8458)	2026-03-19 17:21:07 +00:00
Alexander Petric	18b3528ba4	feat: instance groups instance-level role support (#8404) ... * [ee] feat: instance groups instance-level role support Add ability to assign instance-level roles (superadmin/devops) to instance groups. Group members automatically receive the role with proper precedence: manual elevated roles always win, superadmin > devops. - Migration: add instance_role to instance_group, role_source to password - Role propagation on all mutation paths (add/remove/update/delete/import) - SCIM sync integration (companion PR: windmill-ee-private#463) - Frontend: role toggle in group editor, role column in tables, role source indicator in superadmin settings Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: update ee-repo-ref to 278a3887f759f9d1146554baa0765518d5bc70f2 This commit updates the EE repository reference after PR #463 was merged in windmill-ee-private. Previous ee-repo-ref: b407fe4604153d09ff223e11d43c2df83a1de5d0 New ee-repo-ref: 278a3887f759f9d1146554baa0765518d5bc70f2 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev>	2026-03-17 01:19:46 +00:00
Ruben Fiszel	f2be625348	feat: store hashed tokens instead of plaintext (#8217) ... * feat: store hashed tokens in the token table instead of plaintext Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: address review issues in token hash migration - Update all base.sql fixtures to include token_hash/token_prefix columns - Keep plaintext token for webhook tokens (needed for URL reconstruction) - Restore get_token_by_prefix to query DB for webhook tokens - Fix down migration to delete NULL-token rows before restoring NOT NULL - Update parser fixture standalone schema - Update EE dedicated_worker_ee.rs to use token_hash/token_prefix Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: restore sqlx offline cache (only add new query files) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: keep writing plaintext token column for backward compat Write to token column alongside token_hash until MIN_VERSION_SUPPORTS_TOKEN_HASH (1.649.0) is reached. This ensures older workers can still authenticate during rolling upgrades. Remove the separate UPDATE in new_webhook_token since create_token_internal now writes plaintext directly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: branch on MIN_VERSION to write plaintext token or null Check MIN_VERSION_SUPPORTS_TOKEN_HASH at runtime: write plaintext to token column while old workers exist, switch to NULL once all workers are >= 1.649.0. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: set MIN_VERSION_SUPPORTS_TOKEN_HASH to 1.650.0 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: use token_hash for email lookup and expiry notifications Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: rotate webhook tokens instead of recovering plaintext from DB Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: use token_hash for native trigger token lookups and deletes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * sqlx * refactor: drop webhook_token_prefix from native_trigger table Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: backward compat for token rotation and make webhook_token_hash NOT NULL Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: prevent panic on short superadmin secret token prefix Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: prevent panic on short superadmin secret token prefix Replace all `token[0..TOKEN_PREFIX_LEN]` slicing with `token.get(..TOKEN_PREFIX_LEN).unwrap_or(token)` to prevent panics when a token shorter than 10 chars is provided (e.g. malformed Authorization header, short superadmin secret). Co-authored-by: hugocasa <hugocasa@users.noreply.github.com> * fix: prevent panic on short token prefix slicing Replace all `token[0..TOKEN_PREFIX_LEN]` with safe `token.get(..TOKEN_PREFIX_LEN).unwrap_or(token)` to prevent panics on malformed tokens shorter than 10 characters. Co-authored-by: hugocasa <hugocasa@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Revert "fix: prevent panic on short superadmin secret token prefix" This reverts commit 37ec2e5ad5. * revert: remove unnecessary defensive token prefix slicing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: add token_hash to end_user_email test fixture Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: add integration tests for token hash migration Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: correct token_hash test assertions for cache and version Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore: add plaintext column removal reminder to test fixtures Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: log count of orphaned triggers deleted during migration Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: preserve orphaned triggers with error instead of deleting Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: rename token_expiry_notification.token to token_hash and copy owner/expiration in rotate Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: hash existing plaintext values before renaming token_expiry_notification column Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: remove unnecessary length check in token_expiry_notification migration Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * update dates and version * updat ee ref + sqlx * improve mcp migration * fix: atomic token rotation with rollback on trigger update failure rotate_webhook_token now atomically inserts the new token and deletes the old one in a single transaction, preventing token leaks. Returns new_token_hash so callers can clean up the new token if their subsequent trigger update fails (which involves external HTTP calls and cannot be in the same DB transaction). - Handler: wraps post-rotation work; deletes new token on failure - Google renewal: deletes new token if service_config update fails - Tests updated to match new atomic semantics Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * higher min version * fix: defer old token deletion to avoid breaking triggers on update failure rotate_webhook_token now keeps the old token alive and returns old_token_hash. Callers delete it only after the trigger row has been successfully updated. If the external service call or DB update fails, the trigger keeps working with the old token. Worst case: if the best-effort delete fails, the old token leaks as an extra DB row — harmless compared to breaking the trigger. Also update summarized_schema.txt for renamed columns. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 2d0823a471014e2bc2d898c63518323946b7474f This commit updates the EE repository reference after PR #437 was merged in windmill-ee-private. Previous ee-repo-ref: 7aef8b06cb6f54c2bc89dd57b70947deed72553c New ee-repo-ref: 2d0823a471014e2bc2d898c63518323946b7474f Automated by sync-ee-ref workflow. * fix: prevent panic on short tokens by using safe prefix extraction Add safe_token_prefix() helper that uses .get(..TOKEN_PREFIX_LEN).unwrap_or(token) instead of direct slice indexing, preventing panics when tokens are shorter than 10 characters (e.g., short superadmin secrets or malformed Bearer tokens). Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: HugoCasa <hugo@casademont.ch> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: hugocasa <hugocasa@users.noreply.github.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>	2026-03-17 01:15:38 +00:00
Ruben Fiszel	2aef01d18c	feat: partition audit log table by day with configurable retention (#8292) ... * feat: partition audit log table by day with configurable retention Introduce daily range partitioning for audit logs to replace expensive DELETE-based retention with instant DROP TABLE per partition. - Create `audit_partitioned` table alongside existing `audit` table - New inserts go to `audit_partitioned`, reads UNION ALL both tables - Monitor creates future partitions and drops expired ones - Add `audit_log_retention_days` instance setting (default 365 days) - Old `audit` table empties naturally via existing DELETE cleanup Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: add audit log retention setting to Core instance settings UI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: bump audit partitioning migration timestamp to avoid collision Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: update ee-repo-ref.txt for audit partitioning Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: add RLS/grants to audit_partitioned, run partition mgmt hourly, CE default 14d - Add grants for windmill_user/windmill_admin and all 5 RLS policies - Move manage_audit_partitions to hourly via should_run(120) - Default retention: 14 days CE, 365 days EE - Download JSON button is now icon-only Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: address code review — quote SQL identifiers, add workspace index, deduplicate retention logic - Quote partition names in dynamic SQL for defense in depth - Add idx_audit_partitioned_workspace(workspace_id, timestamp DESC) index - Extract audit_log_retention_days() helper to deduplicate retention logic Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: update ee-repo-ref for audit insert error handling Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: update ee-repo-ref to cef4dfc45e6d6344c5d8d107bd2b4d1bf9bbdd64 This commit updates the EE repository reference after PR #450 was merged in windmill-ee-private. Previous ee-repo-ref: f09284bb257d461bcbe3c50fe31eb6f1e7eafee5 New ee-repo-ref: cef4dfc45e6d6344c5d8d107bd2b4d1bf9bbdd64 Automated by sync-ee-ref workflow. * fix: create audit partitions on startup in initial_load Ensures partitions exist before any requests arrive, closing the gap between server start and the first hourly monitor run. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>	2026-03-11 00:10:29 +00:00
hugocasa	e56ccd200b	feat: token expiration notifications (#8190) ... * feat: add token expiration notifications via email, critical alerts, and webhooks - Monitor loop checks for tokens expiring within 7 days and sends email notifications to token owners. Tracks notification state via new `expiry_notified` column on the token table to avoid duplicates. - When tokens expire and are deleted, owners are also notified. - Critical alerts (in-app UI) are gated behind a new instance setting `critical_alerts_on_token_expiry` (off by default); emails are always sent regardless of the setting. - Add TokenExpiringSoon and TokenExpired webhook message variants for workspace webhook integrations. - Frontend: show expiration badges and a warning banner on the tokens table for tokens expiring within 30 days. - Exclude session and ephemeral tokens from all notifications. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: use separate token_expiry_notification table for dedup - Replace `expiry_notified` column on token table with a dedicated `token_expiry_notification` table (token, expiration) - Insert notification row on token creation via shared `register_token_expiry_notification()` helper - Delete notification row atomically when sending the notification - Clean up orphaned rows in `delete_expired_items()` - No FK constraint to avoid cascade overhead on token deletions - Add index on expiration column for efficient range queries Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: calendar-based expiration badge and move notification cleanup - Fix daysUntilExpiration to compare calendar dates instead of time diff - Move notification row cleanup from delete_expired_items to check_expiring_tokens to keep it off the hot path - Use simple expiration <= now() index scan instead of NOT EXISTS join Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 05:22:46 +00:00
Ruben Fiszel	82e5f6de48	feat: add Kubernetes operator and instance settings YAML editor (#7836) ... * Add windmill-operator crate for Kubernetes CRD-based instance config Introduces a new `windmill-operator` crate that enables declarative management of Windmill instance configuration via a Kubernetes `WindmillInstance` CRD. The operator watches CRD resources and performs full declarative sync of global_settings and worker configs to the database, supporting GitOps workflows for instance-level configuration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Add tests for windmill-operator CRD and db_sync - 9 unit tests for CRD serialization, deserialization, metadata, and status field behavior - 15 integration tests for db_sync using #[sqlx::test] with full declarative sync coverage: upsert, delete, protected keys, idempotency, worker config prefix handling, and end-to-end sync Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Replace untyped BTreeMap CRD fields with typed structs for schema validation GlobalSettings, SmtpSettings, IndexerSettings, and WorkerGroupConfig now have explicit typed fields with serde(flatten) catch-all for forward compatibility. The generated CRD YAML includes a full OpenAPI v3 schema that Kubernetes validates on kubectl apply. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Type opaque serde_json::Value CRD fields with real structs Replace most remaining serde_json::Value fields in WindmillInstance CRD with properly typed structs derived from the codebase: - oauths: BTreeMap<String, OAuthClient> - otel: OtelSettings - otel_tracing_proxy: OtelTracingProxySettings with ScriptLang enum - critical_error_channels: Vec<CriticalErrorChannel> (untagged enum) - critical_alerts_on_db_oversize: DbOversizeAlert - ducklake_settings: DucklakeSettings with nested catalog/storage types - custom_instance_pg_databases: CustomInstancePgDatabases - autoscaling (worker config): AutoscalingConfig with integration struct - custom_tags, default_tags_workspaces: Vec<String> - default_tags_per_workspace: bool Still opaque (serde_json::Value): object_store_cache_config (kube-core can't generate schemas for internally-tagged enums), secret_backend (EE-private), slack, teams (no clear struct definitions). Regenerated CRD YAML with full OpenAPI schema (352→703 lines). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Unify instance config types and add bulk GET/PUT API Move all typed settings (GlobalSettings, WorkerGroupConfig, etc.) from windmill-operator/crd.rs into windmill-common/instance_config.rs so both the API server and operator share a single source of truth. Add diff/apply logic (Merge mode for UI, Replace mode for operator) and InstanceConfig::from_db(). Add GET/PUT /settings/instance_config endpoints so the frontend loads all settings in 1 call instead of 42, and saves with a single bulk PUT. The backend handles the diff internally, running pre-write hooks for changed keys. Refactor windmill-operator/db_sync.rs to use the shared diff+apply functions and slim crd.rs down to the CRD wrapper with re-exports. Includes 32 unit tests and 30 integration tests covering serialization, diff logic, DB roundtrips, protected settings, and edge cases. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: add Form/YAML toggle to instance settings UI Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: show Form/YAML toggle regardless of hideTabs prop Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: replace toggle button group with simple YAML toggle Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: mask sensitive fields in YAML view with show/hide toggle Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: hide internal settings and mask sensitive fields in YAML view Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: hide jwt_secret and min_keep_alive_version from API and config exports Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * all * feat: add secretKeyRef support for sensitive fields in operator CRD Allow sensitive fields (license_key, hub_api_secret, scim_token, smtp_password, OAuthClient.secret, custom PG user_pwd) to reference Kubernetes Secrets via the standard secretKeyRef pattern instead of inlining values as plaintext YAML. The reconciler resolves all refs by reading K8s Secrets before syncing to the database. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * all * all * all * fix: merge main and update dev environment docs Resolve merge conflicts from origin/main, fix duplicate UV_INDEX_STRATEGY_SETTING import, and add Playwright MCP testing instructions to CLAUDE.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * all * fix: init tracing for CLI subcommands and deduplicate setting side-effects Initialize tracing subscriber before early-return CLI paths (sync-config, operator) so tracing calls are not silently dropped. Refactor set_global_setting_internal to call run_setting_pre_write_hook instead of duplicating the side-effect logic. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: add `wmill instance get-config` CLI command Dumps the current instance config (global settings + worker configs) as YAML. Supports --output-file to write to a file instead of stdout. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * all --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-14 22:42:01 +00:00
Ruben Fiszel	c580572252	refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850) ... * refactor: extract windmill-api-scripts and windmill-api-users subcrates Split the monolithic windmill-api crate by extracting scripts.rs, flows.rs, users.rs, and users_oss.rs into dedicated subcrates. This reduces incremental rebuild times when editing these modules. Changes: - Create windmill-api-scripts crate (scripts.rs + flows.rs, ~4.3K lines) - Create windmill-api-users crate (users.rs + users_oss.rs, ~2.4K lines) - Move clear_schedule to windmill-queue (shared by scripts, flows, workspaces) - Move username utilities (VALID_USERNAME, INVALID_USERNAME_CHARS, generate_instance_wide_unique_username) to windmill-common/src/usernames.rs - Move COOKIE_DOMAIN, IS_SECURE, WithStarredInfoQuery, BulkDeleteRequest, WebhookShared to windmill-common for cross-crate access - Original files in windmill-api become thin stubs with pub use re-exports - EE-dependent route handlers remain in windmill-api (create_user, rename_user, set_password, reset_password, etc.) - Feature forwarding for enterprise, private, parquet, no_auth Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: extract windmill-api-workspaces subcrate (Step 3) Move workspaces.rs, workspaces_extra.rs, workspaces_oss.rs, and workspaces_ee.rs into a new windmill-api-workspaces crate (~7K lines). Routes that depend on windmill-api internals (AI copilot, teams, tarball export, critical alerts, stripe) remain in the windmill-api stub. The subcrate handles all other workspace management routes. Also moved send_email_if_possible to windmill-common/email_oss.rs to make it available across subcrates without circular deps. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * all * refactor: extract windmill-api-groups subcrate (groups.rs + folders.rs) Extract groups.rs (1,093 lines) and folders.rs (833 lines) into a new windmill-api-groups subcrate. Both modules had clean dependencies on already-extracted crates (windmill-api-auth, windmill-common, windmill-api-workspaces). Also removes unused re-exports of get_instance_username_or_create_pending and INVALID_USERNAME_CHARS from windmill-api/src/utils.rs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: add granular_acls.rs and folder_history.rs to windmill-api-groups Extract granular_acls.rs (395 lines) and folder_history.rs (68 lines) into the windmill-api-groups subcrate. Both modules only depend on already-extracted crates and belong to the same access-control domain as groups and folders. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: remove unused imports and dead code from subcrate extraction - Remove unused BASE_URL import from lib.rs - Remove workspaces_extra.rs and workspaces_oss.rs re-export stubs (no consumers in windmill-api) - Remove dead send_email_if_possible OSS stub (callers moved to windmill-api-users) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * all * chore: bust CI cargo cache for subcrate split Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: re-export BASE_URL for EE files that use crate::BASE_URL Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: forward no_auth feature to windmill-api-users, remove dead code - Add "windmill-api-users/no_auth" to windmill-api's no_auth feature so the login bypass in users.rs:1600 activates correctly - Remove dead send_email_if_possible from windmill-api-users/users_oss.rs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: re-enable cargo cache for backend tests Cache was disabled to bust stale entries from before subcrate split. Now that a clean build has run, re-enable for faster CI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: install mold+clang in CI workflows The .cargo/config.toml uses mold linker for x86_64-linux. Build scripts require linking even during cargo check. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: increase cargo test timeout to 30 min Exit code 143 (SIGTERM) means the 20-min timeout was hit during compilation without cache. Bump to 30 min as safety net. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: limit cargo build jobs to 4 to prevent OOM in CI Exit code 143 (SIGTERM) after 8 min = OOM kill during compilation. 8 parallel LLVM codegen jobs exhaust memory on ubicloud-standard-8. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-08 12:12:03 +00:00