/* * Author: Ruben Fiszel * Copyright: Windmill Labs, Inc 2022 * This file and its contents are licensed under the AGPLv3 License. * Please see the included NOTICE for copyright information and * LICENSE-AGPL for a copy of the license. */ use sql_builder::prelude::*; use windmill_audit::{audit_log, ActionKind}; use windmill_parser::MainArgSignature; use crate::{ db::{UserDB, DB}, schedule::clear_schedule, users::{maybe_refresh_folders, require_owner_of_path, AuthCache, Authed}, webhook_util::{WebhookMessage, WebhookShared}, HTTP_CLIENT, }; use axum::{ extract::{Extension, Path, Query}, routing::{get, post}, Json, Router, }; use hyper::StatusCode; use serde::Serialize; use serde_json::json; use sql_builder::SqlBuilder; use sqlx::{FromRow, Postgres, Transaction}; use std::{ collections::hash_map::DefaultHasher, hash::{Hash, Hasher}, sync::Arc, }; use windmill_common::{ error::{Error, JsonResult, Result}, schedule::Schedule, scripts::{ to_i64, HubScript, ListScriptQuery, ListableScript, NewScript, Script, ScriptHash, ScriptKind, ScriptLang, }, users::username_to_permissioned_as, utils::{ list_elems_from_hub, not_found_if_none, paginate, require_admin, Pagination, StripPath, }, }; use windmill_queue::{self, schedule::push_scheduled_job}; const MAX_HASH_HISTORY_LENGTH_STORED: usize = 20; pub fn global_service() -> Router { Router::new() .route( "/python/tojsonschema", post(parse_python_code_to_jsonschema), ) .route("/deno/tojsonschema", post(parse_deno_code_to_jsonschema)) .route("/go/tojsonschema", post(parse_go_code_to_jsonschema)) .route("/bash/tojsonschema", post(parse_bash_code_to_jsonschema)) .route("/hub/list", get(list_hub_scripts)) .route("/hub/get/*path", get(get_hub_script_by_path)) .route("/hub/get_full/*path", get(get_full_hub_script_by_path)) } pub fn global_unauthed_service() -> Router { Router::new().route( "/tokened_raw/:workspace/:token/*path", get(get_tokened_raw_script_by_path), ) } pub fn workspaced_service() -> Router { Router::new() .route("/list", get(list_scripts)) .route("/create", post(create_script)) .route("/archive/p/*path", post(archive_script_by_path)) .route("/get/p/*path", get(get_script_by_path)) .route("/raw/p/*path", get(raw_script_by_path)) .route("/exists/p/*path", get(exists_script_by_path)) .route("/archive/h/:hash", post(archive_script_by_hash)) .route("/delete/h/:hash", post(delete_script_by_hash)) .route("/delete/p/*path", post(delete_script_by_path)) .route("/get/h/:hash", get(get_script_by_hash)) .route("/raw/h/:hash", get(raw_script_by_hash)) .route("/deployment_status/h/:hash", get(get_deployment_status)) .route("/list_paths", get(list_paths)) } async fn list_scripts( authed: Authed, Extension(user_db): Extension, Path(w_id): Path, Query(pagination): Query, Query(lq): Query, ) -> JsonResult> { let (per_page, offset) = paginate(pagination); let mut sqlb = SqlBuilder::select_from("script as o") .fields(&[ "o.workspace_id", "hash", "o.path", "array_remove(array[parent_hashes[1]], NULL) as parent_hashes", "summary", "description", "created_by", "created_at", "archived", "deleted", "is_template", "extra_perms", "CASE WHEN lock_error_logs IS NOT NULL THEN 'error' ELSE null END as lock_error_logs", "language", "kind", "favorite.path IS NOT NULL as starred", ]) .left() .join("favorite") .on( "favorite.favorite_kind = 'script' AND favorite.workspace_id = o.workspace_id AND favorite.path = o.path AND favorite.usr = ?" .bind(&authed.username), ) .order_desc("favorite.path IS NOT NULL") .order_by("created_at", lq.order_desc.unwrap_or(true)) .and_where("o.workspace_id = ?".bind(&w_id)) .offset(offset) .limit(per_page) .clone(); if lq.show_archived.unwrap_or(false) { sqlb.and_where_eq( "created_at", "(select max(created_at) from script where o.path = path AND workspace_id = ?)" .bind(&w_id), ); sqlb.and_where_eq("archived", true); } else { sqlb.and_where_eq("archived", false); } if let Some(ps) = &lq.path_start { sqlb.and_where_like_left("path", "?".bind(ps)); } if let Some(p) = &lq.path_exact { sqlb.and_where_eq("path", "?".bind(p)); } if let Some(cb) = &lq.created_by { sqlb.and_where_eq("created_by", "?".bind(cb)); } if let Some(ph) = &lq.first_parent_hash { sqlb.and_where_eq("parent_hashes[1]", &ph.0); } if let Some(ph) = &lq.last_parent_hash { sqlb.and_where_eq("parent_hashes[array_upper(parent_hashes, 1)]", &ph.0); } if let Some(ph) = &lq.parent_hash { sqlb.and_where_eq("any(parent_hashes)", &ph.0); } if let Some(it) = &lq.is_template { sqlb.and_where_eq("is_template", it); } if let Some(k) = &lq.kind { sqlb.and_where_eq("kind", "?".bind(&k.to_lowercase())); } if lq.starred_only.unwrap_or(false) { sqlb.and_where_is_not_null("favorite.path"); } let sql = sqlb.sql().map_err(|e| Error::InternalErr(e.to_string()))?; let mut tx = user_db.begin(&authed).await?; let rows = sqlx::query_as::<_, ListableScript>(&sql) .fetch_all(&mut tx) .await?; tx.commit().await?; Ok(Json(rows)) } async fn list_hub_scripts(Authed { email, .. }: Authed) -> JsonResult { let asks = list_elems_from_hub( &HTTP_CLIENT, "https://hub.windmill.dev/searchData?approved=true", &email, ) .await?; Ok(Json(asks)) } fn hash_script(ns: &NewScript) -> i64 { let mut dh = DefaultHasher::new(); ns.hash(&mut dh); dh.finish() as i64 } async fn create_script( authed: Authed, Extension(user_db): Extension, Extension(webhook): Extension, Extension(db): Extension, Path(w_id): Path, Json(ns): Json, ) -> Result<(StatusCode, String)> { let hash = ScriptHash(hash_script(&ns)); let authed = maybe_refresh_folders(&ns.path, &w_id, authed, &db).await; let mut tx = user_db.begin(&authed).await?; if sqlx::query_scalar!( "SELECT 1 FROM script WHERE hash = $1 AND workspace_id = $2", hash.0, &w_id ) .fetch_optional(&mut tx) .await? .is_some() { return Err(Error::BadRequest( "A script with same hash (hence same path, description, summary, content) already \ exists!" .to_owned(), )); }; let clashing_script = sqlx::query_as::<_, Script>( "SELECT * FROM script WHERE path = $1 AND archived = false AND workspace_id = $2", ) .bind(&ns.path) .bind(&w_id) .fetch_optional(&mut tx) .await?; struct ParentInfo { p_hashes: Vec, perms: serde_json::Value, p_path: String, } let parent_hashes_and_perms: Option = match (&ns.parent_hash, clashing_script) { (None, None) => Ok(None), (None, Some(s)) => Err(Error::BadRequest(format!( "Path conflict for {} with non-archived hash {}", &ns.path, &s.hash ))), (Some(p_hash), o) => { if sqlx::query_scalar!( "SELECT 1 FROM script WHERE hash = $1 AND workspace_id = $2", p_hash.0, &w_id ) .fetch_optional(&mut tx) .await? .is_none() { return Err(Error::BadRequest( "The parent hash does not seem to exist".to_owned(), )); }; let clashing_hash_o = sqlx::query_scalar!( "SELECT hash FROM script WHERE parent_hashes[1] = $1 AND workspace_id = $2", p_hash.0, &w_id ) .fetch_optional(&mut tx) .await?; if let Some(clashing_hash) = clashing_hash_o { return Err(Error::BadRequest(format!( "A script with hash {} with same parent_hash has been found. However, the \ lineage must be linear: no 2 scripts can have the same parent", ScriptHash(clashing_hash) ))); }; let ps = get_script_by_hash_internal(&mut tx, &w_id, p_hash).await?; if ps.path != ns.path { if !authed.is_admin { require_owner_of_path(&w_id, &authed.username, &authed.groups, &ps.path, &db) .await?; } } let ph = { let v = ps.parent_hashes.map(|x| x.0).unwrap_or_default(); let mut v: Vec = v .into_iter() .take(MAX_HASH_HISTORY_LENGTH_STORED - 1) .collect(); v.insert(0, p_hash.0); v }; let r: Result> = match o { Some(clashing_script) if clashing_script.path == ns.path && clashing_script.hash.0 != p_hash.0 => { Err(Error::BadRequest(format!( "Path conflict for {} with non-archived hash {}", &ns.path, &clashing_script.hash ))) } Some(_) | None => Ok(Some(ParentInfo { p_hashes: ph, perms: ps.extra_perms, p_path: ps.path, })), }; sqlx::query!( "UPDATE script SET archived = true WHERE hash = $1 AND workspace_id = $2", p_hash.0, &w_id ) .execute(&mut tx) .await?; r } }?; let p_hashes = parent_hashes_and_perms.as_ref().map(|v| &v.p_hashes[..]); let extra_perms = parent_hashes_and_perms .as_ref() .map(|v| v.perms.clone()) .unwrap_or(json!({})); let lock = if ns.language == ScriptLang::Bash || ns.language == ScriptLang::Deno { Some(String::new()) } else { ns.lock .as_ref() .map(|x| x.join("\n")) .and_then(|e| if e.is_empty() { None } else { Some(e) }) }; let needs_lock_gen = lock.is_none(); //::text::json is to ensure we use serde_json with preserve order sqlx::query!( "INSERT INTO script (workspace_id, hash, path, parent_hashes, summary, description, \ content, created_by, schema, is_template, extra_perms, lock, language, kind) \ VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::text::json, $10, $11, $12, $13, $14)", &w_id, &hash.0, ns.path, p_hashes, ns.summary, ns.description, &ns.content, &authed.username, ns.schema.and_then(|x| serde_json::to_string(&x.0).ok()), ns.is_template.unwrap_or(false), extra_perms, lock, ns.language: ScriptLang, ns.kind.unwrap_or(ScriptKind::Script): ScriptKind, ) .execute(&mut tx) .await?; if let Some(p_path) = parent_hashes_and_perms.as_ref().map(|x| x.p_path.clone()) { let schedulables = sqlx::query_as!( Schedule, "UPDATE schedule SET script_path = $1 WHERE script_path = $2 AND workspace_id = $3 AND is_flow IS false RETURNING *", ns.path, p_path, w_id, ) .fetch_all(&mut tx) .await?; for schedule in schedulables { clear_schedule(&mut tx, &schedule.path, false).await?; if schedule.enabled { tx = push_scheduled_job(tx, schedule).await?; } } } let mut tx = if needs_lock_gen { let dependencies = match ns.language { ScriptLang::Python3 => { windmill_parser_py::parse_python_imports(&ns.content)?.join("\n") } _ => ns.content, }; let (_, tx) = windmill_queue::push( tx, &w_id, windmill_queue::JobPayload::Dependencies { hash, dependencies, language: ns.language }, serde_json::Map::new(), &authed.username, &authed.email, username_to_permissioned_as(&authed.username), None, None, None, None, false, false, None, true, ) .await?; tx } else { tx }; if p_hashes.is_some() && !p_hashes.unwrap().is_empty() { audit_log( &mut tx, &authed.username, "scripts.update", ActionKind::Update, &w_id, Some(&ns.path), Some([("hash", hash.to_string().as_str())].into()), ) .await?; webhook.send_message( w_id.clone(), WebhookMessage::UpdateScript { workspace: w_id, path: ns.path.clone(), hash: hash.to_string(), }, ); } else { audit_log( &mut tx, &authed.username, "scripts.create", ActionKind::Create, &w_id, Some(&ns.path), Some( [ ("workspace", w_id.as_str()), ("hash", hash.to_string().as_str()), ] .into(), ), ) .await?; webhook.send_message( w_id.clone(), WebhookMessage::CreateScript { workspace: w_id, path: ns.path.clone(), hash: hash.to_string(), }, ); } tx.commit().await?; Ok((StatusCode::CREATED, format!("{}", hash))) } pub async fn get_hub_script_by_path(authed: Authed, Path(path): Path) -> Result { windmill_common::scripts::get_hub_script_by_path(&authed.email, path, &HTTP_CLIENT).await } pub async fn get_full_hub_script_by_path( Authed { email, .. }: Authed, Path(path): Path, ) -> JsonResult { Ok(Json( windmill_common::scripts::get_full_hub_script_by_path(&email, path, &HTTP_CLIENT).await?, )) } async fn get_script_by_path( authed: Authed, Extension(user_db): Extension, Path((w_id, path)): Path<(String, StripPath)>, ) -> JsonResult