mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-20 08:01:35 +00:00
Ruben Fiszel
fbdf81ba5f
* fix: authenticate slack callback payload with per-workspace hmac Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: regression tests for unauthenticated slack callback decryption Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: verify slack submission signature before resume + close workspace oracle Addresses review: verify private_metadata HMAC before handle_resume_action so a tampered/unsigned submission is rejected up front, and map get_workspace_key failure to the generic 401 so the status code is not a workspace-existence oracle. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: domain-separate slack payload hmac from resume-secret hmac Both MAC families key Hmac<Sha256> on the same per-workspace key; resume secrets are distributed to approvers in resume URLs, so add a fixed domain tag (slack_payload_v1) to the slack payload MAC to make the two non-interchangeable by construction rather than by byte-layout coincidence. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
50 lines
1.7 KiB
TOML
50 lines
1.7 KiB
TOML
[package]
|
|
name = "windmill-api-integration-tests"
|
|
version.workspace = true
|
|
authors.workspace = true
|
|
edition.workspace = true
|
|
|
|
[lib]
|
|
name = "windmill_api_integration_tests"
|
|
path = "src/lib.rs"
|
|
|
|
[features]
|
|
default = []
|
|
private = ["windmill-test-utils/private", "dep:aws-config", "dep:aws-credential-types", "dep:aws-sdk-sqs", "windmill-git-sync/private", "windmill-queue/private"]
|
|
enterprise = ["windmill-test-utils/enterprise", "dep:base64", "windmill-git-sync/enterprise"]
|
|
deno_core = ["windmill-test-utils/deno_core"]
|
|
mcp = ["windmill-test-utils/mcp", "dep:rmcp"]
|
|
run_inline = ["dep:windmill-worker", "windmill-test-utils/run_inline", "windmill-test-utils/duckdb"]
|
|
postgres_trigger = ["windmill-test-utils/postgres_trigger"]
|
|
|
|
[dependencies]
|
|
windmill-test-utils.workspace = true
|
|
windmill-api-client.workspace = true
|
|
windmill-common = { workspace = true, default-features = false }
|
|
windmill-native-triggers = { workspace = true, features = ["native_trigger"] }
|
|
windmill-api-auth.workspace = true
|
|
windmill-git-sync.workspace = true
|
|
windmill-queue.workspace = true
|
|
windmill-worker = { workspace = true, optional = true }
|
|
sqlx.workspace = true
|
|
serde_json.workspace = true
|
|
serde.workspace = true
|
|
reqwest.workspace = true
|
|
tokio.workspace = true
|
|
anyhow.workspace = true
|
|
uuid.workspace = true
|
|
futures.workspace = true
|
|
rand.workspace = true
|
|
hmac.workspace = true
|
|
sha2.workspace = true
|
|
hex.workspace = true
|
|
rumqttc.workspace = true
|
|
rdkafka.workspace = true
|
|
async-nats.workspace = true
|
|
aws-config = { workspace = true, optional = true }
|
|
aws-credential-types = { workspace = true, optional = true }
|
|
aws-sdk-sqs = { workspace = true, optional = true }
|
|
base64 = { workspace = true, optional = true }
|
|
axum.workspace = true
|
|
rmcp = { workspace = true, optional = true }
|