mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-24 00:00:46 +00:00
hugocasa
19eaf3e2cf
A job token ($WM_TOKEN) derives its identity from an app/flow/schedule on_behalf_of, which a wm_deployers member controls. Ensure such a token can never act above workspace admin, regardless of the identity it runs as. - ApiAuthed gains token_is_job (set from the JWT job_id claim). - require_super_admin / is_super_admin / require_devops_role now take &ApiAuthed and deny job tokens for superadmin/devops-gated endpoints (one choke point instead of a per-route denylist); require_super_admin_email kept for internal, non-request callers. - Inline is_super_admin_email(authed.email) capability gates migrated to the cap-aware is_super_admin(db, &authed). - Defense in depth: validate_on_behalf_of rejects reserved internal identities and mismatched-superadmin emails when persisting an app/flow/script/schedule/ trigger on_behalf_of; app execution refuses reserved-identity policies. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise