3 people 05bcc361af stop billing service accounts twice after a session refresh (#11408) ...

* fix: stop billing service accounts twice after a session refresh

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: refuse refresh for expired, swept or impersonation tokens

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 5a2b6b8527250bd12cf856d8a667a9ef3106ec60

This commit updates the EE repository reference after PR #835 was merged in windmill-ee-private.

Previous ee-repo-ref: 8cc94ec6aeb603b6f6ebbe1fa95b32fbec074b74

New ee-repo-ref: 5a2b6b8527250bd12cf856d8a667a9ef3106ec60

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

2026-09-29 19:23:15 +02:00

..

fixtures

feat: put a data table's connection under Postgres roles (#11020)

2026-09-18 13:56:41 +02:00

ai_routes.rs

fix(ai): enforce RLS and scope check on user-supplied X-Resource-Path (#9276)

2026-05-21 15:21:27 +00:00

apps.rs

feat: make createApp and updateApp the full-code app tools over MCP (#10510)

2026-08-04 18:20:48 +02:00

assets.rs

fix: show runtime-detected assets in a run's Assets tab (#10738)

2026-08-18 10:26:20 +02:00

audit.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

capture_unauthed.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

ci_tests.rs

feat: WM_TESTED_RUNNABLE env var + wildcards in test: annotation (#8926)

2026-04-24 12:52:25 +00:00

concurrency_groups.rs

authorize GET /concurrency_groups/{job_id}/key per job (#10665)

2026-08-12 21:05:02 +02:00

configs.rs

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

datatable_acl.rs

feat: add an ACL editor for data table roles (#11063)

2026-09-19 23:23:50 +02:00

datatable_roles.rs

feat: external instance cluster for data tables and Ducklake catalogs (#11197)

2026-09-29 14:45:47 +02:00

dbt_materialize_target.rs

feat: let // materialize declare a dbt:// warehouse-relation write (#10978)

2026-09-07 17:38:07 +02:00

drafts.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

favorites.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

flows.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

folder_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

folders.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

fork_background.rs

fix: bound a resumed session fork's wait, keep its intent while in flight (#11413)

2026-09-29 16:49:25 +02:00

fork_clone_on_behalf_of.rs

feat: drafts follow their item through a move; behind means base ≠ head (#10577)

2026-09-18 20:54:23 +02:00

fork_member_grant.rs

feat(forks): let a fork's creator manage developers on it without being an admin (#10166)

2026-07-17 15:13:36 +02:00

fork_members.rs

feat: add a workspace toggle that adds its admins and developers to new forks (#11215)

2026-09-18 15:15:35 +02:00

fork_secret_replication_azure.rs

fix: replicate all secrets on fork when external backend is configured (#10060)

2026-07-12 10:19:20 +02:00

granular_acls.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

group_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

groups.rs

fix: skip instance group members that are not email addresses (#11128)

2026-09-15 09:45:10 +02:00

health.rs

test nits

2026-03-27 12:28:54 +00:00

inputs.rs

fix: show scheduled singlestepflow runs in flow history sidebar (#10312)

2026-07-24 18:12:09 +02:00

job_metrics.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

jobs_authed.rs

report the EE gate instead of a 500 on restart flow at step (#10846)

2026-08-26 00:31:21 +02:00

jobs_unauthed.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

login_link.rs

Revert "feat(auth): 2 h login links and a click-to-sign-in page for emailed ones (#11203)" (#11267)

2026-09-21 16:54:28 +00:00

max_token_expiration.rs

feat: cap user token expiration with an instance setting (#11159)

2026-09-18 14:37:39 +02:00

mcp_preprocessor_headers.rs

test: keep the mcp preprocessor header test off the dependency job (#10989)

2026-09-05 11:10:41 +02:00

mcp_protocol_versions.rs

feat(mcp): serve the 2026-07-28 spec alongside the legacy protocol (#10535)

2026-08-05 13:52:09 +02:00

mcp_token_query_param.rs

feat: add an instance setting to refuse a token in MCP URLs (#11162)

2026-09-18 15:24:00 +02:00

native_triggers.rs

fix: apply token path scopes to the native trigger list (#11281)

2026-09-22 08:14:41 +00:00

nested_dev_workspace.rs

feat: offer more dev workspace environment labels (#10570)

2026-08-06 18:32:19 +00:00

npm_proxy.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

offboarding.rs

refactor: make the app policy's principal the authority for its identity (#10440)

2026-09-12 09:10:15 +02:00

operator_manage_rights.rs

feat: let a workspace withdraw operator schedule and trigger writes (#11226)

2026-09-25 17:34:58 +00:00

permissions.rs

feat: store hashed tokens instead of plaintext (#8217)

2026-03-17 01:15:38 +00:00

protection_rules.rs

fix: let a draft-only schedule, trigger or resource be deleted (#11010)

2026-09-07 18:55:40 +02:00

raw_apps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

remote_deploy.rs

feat: deploy from the UI to a workspace on another instance (#11245)

2026-09-22 01:40:53 +02:00

resources.rs

fix: hold interpolated references and captures to the token path scopes (#11391)

2026-09-28 18:34:55 +02:00

run_inline.rs

feat: mcp oauth gateway (#8443)

2026-03-20 16:12:59 +00:00

schedules.rs

fix: let a draft-only schedule, trigger or resource be deleted (#11010)

2026-09-07 18:55:40 +02:00

scripts.rs

fix: record supplied script lock hashes so importers can skip relocking (#10915)

2026-09-02 19:20:49 +02:00

sensitive_log_masking.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

service_logs.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

settings.rs

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

slack_approvals_unauthed.rs

fix: authenticate slack callback payload with per-workspace hmac (#9461)

2026-06-06 08:02:20 +00:00

token_expiry_warning.rs

feat: cap user token expiration with an instance setting (#11159)

2026-09-18 14:37:39 +02:00

token_hash.rs

fix: keep native triggers attached when a runnable is renamed (#10432)

2026-07-31 23:44:25 +02:00

token_label_idor.rs

fix: skip expiry notifications for app embed and SDK tokens (#11169)

2026-09-16 17:28:53 +02:00

trash.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

trigger_e2e.rs

fix: advance postgres replication slot lsn via periodic standby status updates (#9227)

2026-05-19 05:44:13 +00:00

triggers.rs

feat: support application default credentials for gcp pub/sub triggers (#10778)

2026-08-21 10:41:14 +02:00

users.rs

stop billing service accounts twice after a session refresh (#11408)

2026-09-29 19:23:15 +02:00

variables.rs

fix(security): scope variable and resource value caches by caller identity (#9427)

2026-06-03 10:31:45 +00:00

workspace_comparison.rs

feat(fork): merge a fork deletion on evidence, not on the counters (#10484)

2026-08-04 00:50:27 +02:00

workspace_dependencies_git_sync.rs

fix(git-sync): run auto-pull as the admin who enabled it (#11121)

2026-09-15 10:34:57 +02:00

workspace_dependencies.rs

fix: scope workspace dependencies create to the path workspace (#11385)

2026-09-28 18:15:10 +02:00

workspace_deps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

workspace_encryption_key_git_sync.rs

fix: re-encrypt git sync secrets on workspace key rotation (#11218)

2026-09-18 15:21:07 +02:00

workspaces.rs

feat: let a workspace withdraw operator schedule and trigger writes (#11226)

2026-09-25 17:34:58 +00:00