hugocasaandClaude Opus 4.8 19eaf3e2cf fix: cap job token authority at workspace admin ...

A job token ($WM_TOKEN) derives its identity from an app/flow/schedule
on_behalf_of, which a wm_deployers member controls. Ensure such a token can
never act above workspace admin, regardless of the identity it runs as.

- ApiAuthed gains token_is_job (set from the JWT job_id claim).
- require_super_admin / is_super_admin / require_devops_role now take &ApiAuthed
  and deny job tokens for superadmin/devops-gated endpoints (one choke point
  instead of a per-route denylist); require_super_admin_email kept for
  internal, non-request callers.
- Inline is_super_admin_email(authed.email) capability gates migrated to the
  cap-aware is_super_admin(db, &authed).
- Defense in depth: validate_on_behalf_of rejects reserved internal identities
  and mismatched-superadmin emails when persisting an app/flow/script/schedule/
  trigger on_behalf_of; app execution refuses reserved-identity policies.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-14 16:40:10 +02:00

..

fixtures

fix(security): scope variable and resource value caches by caller identity (#9427)

2026-06-03 10:31:45 +00:00

ai_routes.rs

fix(ai): enforce RLS and scope check on user-supplied X-Resource-Path (#9276)

2026-05-21 15:21:27 +00:00

apps.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

audit.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

capture_unauthed.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

ci_tests.rs

feat: WM_TESTED_RUNNABLE env var + wildcards in test: annotation (#8926)

2026-04-24 12:52:25 +00:00

concurrency_groups.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

configs.rs

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

drafts.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

favorites.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

flows.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

folder_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

folders.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

fork_secret_replication_azure.rs

fix: replicate all secrets on fork when external backend is configured (#10060)

2026-07-12 10:19:20 +02:00

granular_acls.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

group_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

groups.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

health.rs

test nits

2026-03-27 12:28:54 +00:00

inputs.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

job_metrics.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

jobs_authed.rs

test nits

2026-03-27 12:28:54 +00:00

jobs_unauthed.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

native_triggers.rs

fix: cap job token authority at workspace admin

2026-07-14 16:40:10 +02:00

npm_proxy.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

offboarding.rs

feat: add user offboarding flow with object reassignment (#8647)

2026-04-09 17:31:36 +00:00

permissions.rs

feat: store hashed tokens instead of plaintext (#8217)

2026-03-17 01:15:38 +00:00

protection_rules.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

raw_apps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

resources.rs

fix(security): scope variable and resource value caches by caller identity (#9427)

2026-06-03 10:31:45 +00:00

run_inline.rs

feat: mcp oauth gateway (#8443)

2026-03-20 16:12:59 +00:00

schedules.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

scripts.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

sensitive_log_masking.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

service_logs.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

settings.rs

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

slack_approvals_unauthed.rs

fix: authenticate slack callback payload with per-workspace hmac (#9461)

2026-06-06 08:02:20 +00:00

token_hash.rs

fix(native-triggers): serialize Google channel renewal across replicas (#9060)

2026-05-08 07:59:46 +00:00

token_label_idor.rs

fix: prevent token label collision bypassing job read access control (#9462)

2026-06-06 07:47:52 +00:00

trash.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

trigger_e2e.rs

fix: advance postgres replication slot lsn via periodic standby status updates (#9227)

2026-05-19 05:44:13 +00:00

triggers.rs

fix: replace email with permissioned_as for triggers/schedules (#8439)

2026-03-20 16:28:38 +00:00

users.rs

feat: edit scopes on existing API tokens (#8967)

2026-04-29 19:49:56 +00:00

variables.rs

fix(security): scope variable and resource value caches by caller identity (#9427)

2026-06-03 10:31:45 +00:00

workspace_comparison.rs

fix(forks): require admin of both sides for the compare visibility guard (#9869)

2026-07-01 23:29:53 +02:00

workspace_dependencies_git_sync.rs

fix: scope promotion-mode debounce key per repo (#9145)

2026-05-13 11:35:30 +00:00

workspace_deps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

workspace_encryption_key_git_sync.rs

fix: batch encryption-key rotation into one git-sync job (#9355)

2026-05-29 05:12:35 +00:00

workspaces.rs

fix: preserve fork parent linkage on workspace id change (#9716)

2026-06-23 20:54:07 +00:00