mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-05 00:03:08 +00:00
hugocasaandClaude Opus 4.8
12649031f2
The token-authority cap (require_super_admin/is_super_admin/require_devops_role deny job tokens) is the actual fix, so: - validate_on_behalf_of is now sync and sentinel-only. Dropped the belong-to check (superadmin on_behalf_of_email must match on_behalf_of): it false-rejected legitimate deploys (a superadmin who is not a member of the deploying workspace with automate_username_creation off resolves to `…@unknown.windmill.dev`; pre-existing inconsistent apps failed on redeploy) and the cap already closes the escalation at execution. - Removed forbid_superadmin_job_token from the 9 routes that call require_super_admin first (now redundant with the cap). Kept it on the self-service routes with no require_super_admin: create_token, set_password, create_user. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise