mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-19 00:02:03 +00:00
fb82748296
* fix: make on_behalf_of control permissions for scripts and flows Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: inherit the recorded on-behalf-of identity when a preserving deploy omits it Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: keep an omitted permissioned_as from re-versioning an unchanged script Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: derive the on-behalf-of principal from the email and reject mismatched pairs Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: stop workspace deploys from carrying a source-workspace principal Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: correct the onBehalfOfPermissionedAs param doc Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test: pin that workspace deploys never carry a source-workspace principal Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: correct the omitted-principal contract and refresh generated prompts Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: keep external-superadmin principals on email-only redeploys Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: scope the recorded principal to its workspace and prefer real accounts Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: carry the recorded principal correctly through drafts and set-permissioned-as Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: sweep draft identity pairs on email change and offboarding Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: leave group identities alone when sweeping a user's email Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: treat only g/ without an email as a group, and match the offboard preview Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: stop the group guard from skipping rows with no recorded principal Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: state the group guard once instead of restating it Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor: make the permissioned_as the only stored on-behalf-of identity Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * perf: skip resolving the on-behalf-of address for sync clients that discard it Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: address the local review of the identity refactor Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: resolve the on-behalf-of identity coherently across clones, offboarding and no-op deploys * test: pin that a fork keeps only the on-behalf-of identities that resolve in it * fix: decide a principal prefix-first everywhere and canonicalize bare addresses * fix: prefix a slash-containing address so a reader cannot take it for a group * fix: read an address as a username before the group- convention * fix: rewrite the canonical principal when an account's address moves * fix: keep the address form of a principal to accounts without a usr row * fix: reject an identity a job row cannot carry and read it uncached at dispatch * fix: count characters against the job identity width and cap the backfill * refactor: name the script/flow principal on_behalf_of, as apps do * docs: state the caller-must-authorize contract on the identity resolvers * fix: keep writing on_behalf_of_email until every worker reads the principal * fix: err high on the compatibility version and document the last resolver * fix: keep the compatibility address current through identity mutations * fix: carry the compatibility address with the principal on every copy path * chore: re-pin the EE ref to the companion branch merged with EE main * fix: key the dbt retry lookup on the stored principal * fix: keep a mixed-version address recoverable through a fork * fix: read a round-tripped address uncached so a redeploy is not rejected * fix: refuse an email change that would make a principal unenqueueable * chore: update ee-repo-ref to ac3d7d015296f041ae44ab6bc4953485f44d36e4 This commit updates the EE repository reference after PR #704 was merged in windmill-ee-private. Previous ee-repo-ref: 219b0b03905a1a0028054b3a4985724e77d09036 New ee-repo-ref: ac3d7d015296f041ae44ab6bc4953485f44d36e4 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
85 lines
4.1 KiB
SQL
85 lines
4.1 KiB
SQL
-- Fixture for schedule push tests
|
|
-- Sets up scripts, flows, users, and schedules needed to test push_scheduled_job
|
|
|
|
-- Password entries for auth resolution
|
|
INSERT INTO password (email, password_hash, login_type, super_admin, verified, name)
|
|
VALUES
|
|
('test@windmill.dev', 'dummy_hash', 'password', false, true, 'Test User'),
|
|
('obo@windmill.dev', 'dummy_hash', 'password', false, true, 'OBO User')
|
|
ON CONFLICT (email) DO NOTHING;
|
|
|
|
-- OBO user in workspace
|
|
INSERT INTO usr (workspace_id, email, username, is_admin, role)
|
|
VALUES ('test-workspace', 'obo@windmill.dev', 'obo-user', false, 'Developer')
|
|
ON CONFLICT (workspace_id, username) DO NOTHING;
|
|
|
|
-- A simple script
|
|
INSERT INTO script (workspace_id, created_by, content, schema, summary, description, path, hash, language, lock, kind)
|
|
VALUES (
|
|
'test-workspace', 'test-user',
|
|
'export async function main() { return "ok"; }',
|
|
'{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
|
|
'Test script', '', 'f/system/test_script', 100001, 'deno', '', 'script'
|
|
);
|
|
|
|
-- A script with an on-behalf-of identity
|
|
INSERT INTO script (workspace_id, created_by, content, schema, summary, description, path, hash, language, lock, kind, on_behalf_of)
|
|
VALUES (
|
|
'test-workspace', 'test-user',
|
|
'export async function main() { return "obo"; }',
|
|
'{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
|
|
'OBO script', '', 'f/system/obo_script', 100002, 'deno', '', 'script', 'u/obo-user'
|
|
);
|
|
|
|
-- A script with a tag
|
|
INSERT INTO script (workspace_id, created_by, content, schema, summary, description, path, hash, language, lock, kind, tag)
|
|
VALUES (
|
|
'test-workspace', 'test-user',
|
|
'export async function main() { return "tagged"; }',
|
|
'{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
|
|
'Tagged script', '', 'f/system/tagged_script', 100003, 'deno', '', 'script', 'custom-tag'
|
|
);
|
|
|
|
-- A script with timeout
|
|
INSERT INTO script (workspace_id, created_by, content, schema, summary, description, path, hash, language, lock, kind, timeout)
|
|
VALUES (
|
|
'test-workspace', 'test-user',
|
|
'export async function main() { return "timeout"; }',
|
|
'{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
|
|
'Timeout script', '', 'f/system/timeout_script', 100004, 'deno', '', 'script', 300
|
|
);
|
|
|
|
-- A flow
|
|
INSERT INTO flow (workspace_id, summary, description, path, versions, schema, value, edited_by)
|
|
VALUES (
|
|
'test-workspace', 'Test flow', '', 'f/system/test_flow', '{200001}',
|
|
'{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
|
|
'{"modules": [{"id": "a", "value": {"path": "f/system/test_script", "type": "script", "input_transforms": {}}}]}',
|
|
'test-user'
|
|
);
|
|
|
|
INSERT INTO flow_version (id, workspace_id, path, schema, value, created_by)
|
|
VALUES (
|
|
200001, 'test-workspace', 'f/system/test_flow',
|
|
'{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
|
|
'{"modules": [{"id": "a", "value": {"path": "f/system/test_script", "type": "script", "input_transforms": {}}}]}',
|
|
'test-user'
|
|
);
|
|
|
|
-- A flow with an on-behalf-of identity
|
|
INSERT INTO flow (workspace_id, summary, description, path, versions, schema, value, edited_by, on_behalf_of)
|
|
VALUES (
|
|
'test-workspace', 'OBO flow', '', 'f/system/obo_flow', '{200002}',
|
|
'{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
|
|
'{"modules": [{"id": "a", "value": {"path": "f/system/test_script", "type": "script", "input_transforms": {}}}]}',
|
|
'test-user', 'u/obo-user'
|
|
);
|
|
|
|
INSERT INTO flow_version (id, workspace_id, path, schema, value, created_by)
|
|
VALUES (
|
|
200002, 'test-workspace', 'f/system/obo_flow',
|
|
'{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{},"required":[],"type":"object"}',
|
|
'{"modules": [{"id": "a", "value": {"path": "f/system/test_script", "type": "script", "input_transforms": {}}}]}',
|
|
'test-user'
|
|
);
|