mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-18 16:02:10 +00:00
Guilhem Lemouel
f9e2370478
`CompareWorkspaces.svelte` deploys folders through the shared `deployItem`, whose folder branch built both the create and the update body from `owners`, `extra_perms` and `summary` alone. Two consequences, both of which #10354 had already fixed on the one path it touched: `default_permissioned_as` and `labels` never crossed. A copied folder applies no create-time identity rules, so an item deployed into it carrying no `on_behalf_of` of its own runs as whoever deployed it rather than as the principal the source folder would have chosen. `u/<username>` principals crossed verbatim, and a username is per-(workspace, email). The same username in the target can be a different account, which then receives folder ownership or ACL access and can be selected by an identity rule. Principals are now resolved source username -> email -> target username, since email is the only identifier stable across workspaces; groups match by name, read from `listGroups` (the workspace's own `group_` rows) rather than `listGroupNames`, which unions in instance groups that folder rule resolution does not accept. The two kinds of unresolvable principal are separated because they fail differently: an owner or ACL entry is dropped and reported, which can only narrow the folder and leaves the creator owning it; an identity rule refuses the copy, because dropping it runs items as the deployer and carrying it creates a folder the server then rejects every deploy into. The fix lands twice on purpose. The shared package is the real home and fixes `wmill workspace merge`, but the frontend consumes the published `windmill-utils-internal`, so the compare page needs the mirror in `utils_workspace_deploy.ts` until that version ships and the dependency is bumped — the same arrangement #10354 used for `makeProvider`. `perPage` was documented as "default 30, max 100" while `paginate()` uses 1000/10000; that wrong comment is what made the merged PR read groups a page at a time and miss them. Corrected, and the two generated artifacts derived from the spec regenerated. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise