mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-07 00:01:49 +00:00
Ruben FiszelandClaude Opus 4.8
0937fb66ca
The auth cache keys on the bearer token, and verify_for_workspace decoded a token of any length (its header for the JWKS kid, then the body) before rejecting it, so an oversized token could be decoded unauthenticated and, if it verified, cached at full size. Refuse a token longer than MAX_GUEST_JWT_LEN (8 KiB) at the top of verify_for_workspace, before the key lookup or any signature work. Also correct the MAX_JWKS_URL_LEN doc: the bound holds because the save path validates the URL through fetch_jwks, not because cached_jwks checks it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise