hugocasaandClaude Opus 4.8 12649031f2 refactor: simplify on_behalf_of deploy guard and prune redundant job-token denylist ...

The token-authority cap (require_super_admin/is_super_admin/require_devops_role
deny job tokens) is the actual fix, so:

- validate_on_behalf_of is now sync and sentinel-only. Dropped the belong-to
  check (superadmin on_behalf_of_email must match on_behalf_of): it false-rejected
  legitimate deploys (a superadmin who is not a member of the deploying workspace
  with automate_username_creation off resolves to `…@unknown.windmill.dev`;
  pre-existing inconsistent apps failed on redeploy) and the cap already closes
  the escalation at execution.
- Removed forbid_superadmin_job_token from the 9 routes that call
  require_super_admin first (now redundant with the cap). Kept it on the
  self-service routes with no require_super_admin: create_token, set_password,
  create_user.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-14 17:19:59 +02:00

..

src

refactor: simplify on_behalf_of deploy guard and prune redundant job-token denylist

2026-07-14 17:19:59 +02:00

Cargo.toml

feat: ducklake materialization for data pipelines (#9689)

2026-06-20 15:42:03 +02:00