3 people d493eff237 feat: job_token_scopes OIDC claim (#11551) ...

* feat: refuse unscoped tokens of restricted jobs, add OIDC scopes claim

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: keep restricted job_perms rows by a stamp that survives retention

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* chore: log refused unscoped job tokens at warn

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: key the unrestricted cache by token, keep restricted rows on bulk delete

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: clear a sweep stamp raced onto a queued job

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: stamp restricted job_perms rows under a row lock

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* test: give the memo test's job token scopes

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* refactor: keep only the OIDC claim, drop the server-side refusal

A relying party can already tell a restricted job from the claim, which is
absent when the presented token carries no scopes. The auth-layer refusal,
its lookup cache and the job_perms retention it needed are removed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 065c2c64c3904d5c0b2766b424210d34f9e54d2d

This commit updates the EE repository reference after PR #845 was merged in windmill-ee-private.

Previous ee-repo-ref: ea5354477cdf281598a816a5e16ad1f476d42afb

New ee-repo-ref: 065c2c64c3904d5c0b2766b424210d34f9e54d2d

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

2026-10-06 15:32:12 +02:00

..

agent-worker-e2e.md

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

ai-agent-evals.md

feat: AI agent evals: datasets, scored runs and comparison (#10633)

2026-08-24 11:08:56 +02:00

ai-session-backups.md

feat: delete a browser's copy of an AI session past its workspace retention (#11156)

2026-09-16 09:57:43 +02:00

app-mode-ai-chat-review.md

docs: remove stale planning notes (#9342)

2026-05-27 07:19:51 +00:00

app-policy-email-removal.md

refactor: make the app policy's principal the authority for its identity (#10440)

2026-09-12 09:10:15 +02:00

auth-surface.md

feat: job_token_scopes OIDC claim (#11551)

2026-10-06 15:32:12 +02:00

dbt-runtime.md

feat: make snowflake_oauth work as a dbt warehouse on every engine (#11095)

2026-09-12 00:00:17 +02:00

docker-security.md

chore: retire the standalone lsp and multiplayer images from examples, drop lsp/Dockerfile (#11341)

2026-09-25 17:13:06 +02:00

docker-v2-runtime.md

fix: return result.json and stdout results from sandboxed containers (#10460)

2026-08-03 12:35:12 +02:00

duckdb-isolation.md

feat: bound how much disk a single duckdb job can spill (#10645)

2026-08-12 01:55:45 +02:00

ducklake-materialization.md

feat: let // materialize declare a dbt:// warehouse-relation write (#10978)

2026-09-07 17:38:07 +02:00

enterprise.md

feat(pipeline): write-audit-publish for materialization data tests (#9911)

2026-07-04 17:19:49 +02:00

external-instance-datatables.md

feat: external instance cluster for data tables and Ducklake catalogs (#11197)

2026-09-29 14:45:47 +02:00

feature-telemetry.md

feat: add an AI decision flow step (TypeSafe's Jev, Cloudflare's Clef) (#11474)

2026-10-05 14:23:34 +00:00

fork-triggers.md

fix(forks): keep trigger/schedule operational state owned by the parent - WIN-2019 (#9476)

2026-06-08 16:18:12 +00:00

frontend-import-cycles.md

chore: re-land vite 8.2.0 with the chunk cycle that broke it (#10472)

2026-08-03 18:09:06 +02:00

git-repo-viewer-hub-script.md

fix: show symlinked files in the git repo viewer (#11081)

2026-09-11 09:25:24 +02:00

git-sync-github-app-permissions.md

feat: automatic git-to-windmill sync (polling, webhooks, in-app PRs + checks) (#9552)

2026-07-16 15:55:44 +02:00

git-sync-gitlab-setup.md

feat: bring gitlab repositories to parity for git sync (#10938)

2026-09-08 11:54:43 +02:00

git-sync-pull-design.md

fix(git-sync): run auto-pull as the admin who enabled it (#11121)

2026-09-15 10:34:57 +02:00

npm-proxy-storage.md

feat(npm-proxy): keep package files on disk and in the object store (#10638)

2026-08-11 16:40:53 +00:00

operator-builder-rights.md

feat: let operators compose flows when the workspace grants the right (#11228)

2026-09-30 18:09:14 +02:00

operator-write-rights.md

feat: let operators compose flows when the workspace grants the right (#11228)

2026-09-30 18:09:14 +02:00

pipeline-env-isolation.md

feat(pipelines): fork data environments for ducklake materialization (dev data) (#9915)

2026-07-05 09:58:06 +02:00

pipeline-local-dev.md

fix(parsers): keep s3 asset path suffix verbatim to preserve storage distinction (#10241)

2026-07-21 16:25:06 +00:00

pipeline-metrics-layer.md

feat(pipelines): catalog declared measures and dimensions (#10190)

2026-07-21 07:34:44 +02:00

pipelines-vs-dbt.md

fix(pipelines): dedup guard for keyed merge + deploy-time SCD2 validation (#9936)

2026-07-05 22:24:41 +02:00

reusable-ai-agents.md

feat(ai-agent): add compaction memory that summarizes older context (#10928)

2026-09-29 19:01:53 +02:00

validation.md

fix: patch sqlx so a cancelled BEGIN cannot poison a pooled connection (#10823)

2026-08-24 22:29:44 +02:00

wac-sdk-e2e.md

feat: retry a workflow-as-code task from its task options (#11013)

2026-09-08 11:37:56 +02:00