hugocasa 19eaf3e2cf fix: cap job token authority at workspace admin ...

A job token ($WM_TOKEN) derives its identity from an app/flow/schedule
on_behalf_of, which a wm_deployers member controls. Ensure such a token can
never act above workspace admin, regardless of the identity it runs as.

- ApiAuthed gains token_is_job (set from the JWT job_id claim).
- require_super_admin / is_super_admin / require_devops_role now take &ApiAuthed
  and deny job tokens for superadmin/devops-gated endpoints (one choke point
  instead of a per-route denylist); require_super_admin_email kept for
  internal, non-request callers.
- Inline is_super_admin_email(authed.email) capability gates migrated to the
  cap-aware is_super_admin(db, &authed).
- Defense in depth: validate_on_behalf_of rejects reserved internal identities
  and mismatched-superadmin emails when persisting an app/flow/script/schedule/
  trigger on_behalf_of; app execution refuses reserved-identity policies.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-14 16:40:10 +02:00

..

folder_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

folders.rs

fix(folders): allow dots and at-signs in folder owner validation (#9856)

2026-07-01 12:49:36 +02:00

granular_acls.rs

perf: eliminate dual-connection DB pool contention across worker, queue, and api (#9798)

2026-06-25 21:33:17 +00:00

groups.rs

fix: cap job token authority at workspace admin

2026-07-14 16:40:10 +02:00

lib.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00