Files
windmill/system_prompts/auto-generated/schemas/http_trigger.schema.yaml
hugocasaandClaude Opus 5 d8d7332eb6 feat: add per-route CORS origin allowlist for HTTP triggers (#10833)
* feat: add per-route CORS origin allowlist for HTTP triggers

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: fail closed on cold router cache and invalid origin input

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: resolve CORS route from the decoded path like the request handler

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: add instance-wide default allowed origins for HTTP routes

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: let non-superadmins read the default allowed origins setting

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: badge the advanced section when a route's origins are restricted

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: state inherited origins on the control and use one hint row

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: trim the origins tooltip and relabel the toggle when a default exists

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: keep the origins format hint visible until an entry is wrong

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: state the at-least-one requirement in the origins hint

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: import the origins validator in the trigger-http tests

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: make an empty allowlist deny rather than fall back to the default

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: address review nits on origin validation and the CORS editor

* fix: derive the origins error from the stored list and tighten host validation

* fix: parse real IPv6 hosts and refuse a newly emptied allowlist

* refactor: make origin validation advisory except for null and non-ascii

* feat: let an empty allowlist be saved as deny every origin

* docs: document the empty allowlist as deny every origin

* fix: bound allowlists, reject commas, and decide cors after the handler

* chore: revert unrelated rustfmt churn in windmill-common tests

* chore: revert unrelated rustfmt churn in windmill-common

* chore: drop the route types the cors restructure replaced

* fix: take the stricter cors decision from before and after the handler

* fix: strip runnable cors headers when the routers are unavailable

* docs: document the allowlist bounds in the openapi schema

* fix: let an unavailable cors read defer to one that resolved

* refactor: carry the resolved cors policy from the handler to the middleware

* docs: describe why an unavailable read fails closed on the paths that reach it

* fix: validate the default origins on the declarative settings path

* test: keep the webhook doc comment with the test it describes

* fix: warn on impossible schemes and ports, and validate the instance setting

* feat: treat an empty allowlist as unset at both levels

* perf: decode the cors path only when the fallback needs it

* docs: document the empty allowlist as unset in the api schema

* docs: describe an empty allowlist as unset in the frontend comments

* docs: say what a null allowlist resolves to, not what it meant before the default existed

* docs: state what the validator refuses and why methods stay broad

* feat: exempt static asset routes from the origin allowlist

* fix: hide the origin control for every static target, not just websites

* fix: exempt only static websites, not single-file static assets

* fix: warn on an unclosed ipv6 host in the origins advisory

* fix: require assets present, not just the static website flag

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-09-14 11:36:01 +02:00

167 lines
5.1 KiB
YAML

type: object
properties:
script_path:
type: string
description: Path to the script or flow to execute when triggered
is_flow:
type: boolean
description: True if script_path points to a flow, false if it points to a script
labels:
type: array
items:
type: string
draft_only:
type: boolean
description: 'True when this row is a per-user draft with no deployed
trigger at the same path. Set by list endpoints when
`include_draft_only=true` synthesizes the row from the
draft. Frontend renders a "Draft" badge.
'
is_draft:
type: boolean
description: 'True when the authed user has a per-user draft at this path
(over a deployed row or a synthesized draft-only row).
Frontend appends a `*` to the displayed name.
'
route_path:
type: string
description: The URL route path that will trigger this endpoint (e.g., 'api/myendpoint').
Must NOT start with a /.
static_asset_config:
type: object
properties:
s3:
type: string
description: S3 bucket path for static assets
storage:
type: string
description: Storage path for static assets
filename:
type: string
description: Filename for the static asset
description: Configuration for serving static assets (s3 bucket, storage path,
filename)
http_method:
type: string
enum:
- get
- post
- put
- delete
- patch
authentication_resource_path:
type: string
description: Path to the resource containing authentication configuration (for
api_key, basic_http, custom_script, signature methods)
summary:
type: string
description: Short summary describing the purpose of this trigger
description:
type: string
description: Detailed description of what this trigger does
request_type:
type: string
enum:
- sync
- async
- sync_sse
authentication_method:
type: string
enum:
- none
- windmill
- api_key
- basic_http
- custom_script
- signature
is_static_website:
type: boolean
description: If true, serves static files from S3/storage instead of running a
script
workspaced_route:
type: boolean
description: If true, the route includes the workspace ID in the path
wrap_body:
type: boolean
description: If true, wraps the request body in a 'body' parameter
raw_string:
type: boolean
description: If true, passes the request body as a raw string instead of parsing
as JSON
allowed_origins:
type: array
items:
type: string
description: 'Origins allowed to call this route cross-origin, matched against
the request''s Origin header (ignoring case) and echoed back on a match. When
set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin
the runnable returns via wm_headers. Use [''*''] to opt out of any restriction,
including the http_route_default_allowed_origins instance setting. An empty
list is not a configuration and resolves exactly as null does. When null, the
instance setting applies, or Access-Control-Allow-Origin: * if it is unset.
Ignored on a static website, which has no authentication of its own and so hands
out public files: restricting which browsers may read them protects nothing
while breaking cross-origin webfonts and fetches. A single-file static asset
is not exempt, since it can carry an authentication_method.'
error_handler_path:
type: string
description: Path to a script to run when the triggered job fails. A bare path,
without the script/ or flow/ prefix a schedule error handler takes; it cannot
be a flow.
error_handler_args:
type: object
description: The arguments to pass to the script or flow
retry:
type: object
properties:
constant:
type: object
description: Retry with constant delay between attempts
properties:
attempts:
type: integer
description: Number of retry attempts
seconds:
type: integer
description: Seconds to wait between retries
exponential:
type: object
description: Retry with exponential backoff (delay doubles each time)
properties:
attempts:
type: integer
description: Number of retry attempts
multiplier:
type: integer
description: Multiplier for exponential backoff
seconds:
type: integer
minimum: 1
description: Initial delay in seconds
random_factor:
type: integer
minimum: 0
maximum: 100
description: Random jitter percentage (0-100) to avoid thundering herd
retry_if:
$ref: '#/components/schemas/RetryIf'
description: Retry configuration for failed module executions
required:
- script_path
- is_flow
- route_path
- request_type
- authentication_method
- http_method
- is_static_website
- workspaced_route
- wrap_body
- raw_string