mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-21 16:02:28 +00:00
4483d0cab9
* fix: redact GitHub App tokens and Slack OAuth secret for non-admins `GET /workspaces/get_settings` returned the full `git_app_installations` JSONB to any workspace member. That column caches the GitHub App JWT and installation token used by git-sync; the installation token is refreshed on every git-sync action and valid for ~55 minutes, so the value sitting in the DB is essentially always live. Null it out for non-admins, matching the existing `slack_oauth_client_secret` redaction. The tarball export's v2 settings format (added in #8935) included `slack_oauth_client_secret` with no admin gating, regressing the same redaction. Mirror the admin check there. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor: split get_settings into admin-only + public endpoint Adds `WorkspacePublicSettings` and `GET /workspaces/get_public_settings`, which returns only fields safe for any workspace member to read (workspace_id, slack/teams team identity, mute_critical_alerts, deploy_ui, large_file_storage, datatable). `get_settings` is now admin-only via `require_admin`. Migrates frontend callers: every caller that read non-sensitive fields (deploy_ui on trigger pages, mute_critical_alerts on the root layout, slack team identity for handler pickers, etc.) now uses `getPublicSettings`. The admin-managed settings UI, git-sync admin context, operator settings, checkout polling, and full settings page stay on `getSettings`. This replaces the field-level redactions added in the previous commit: the type system itself defines the public surface, so adding a sensitive column to `workspace_settings` no longer defaults to leaking — it stays out of `WorkspacePublicSettings` unless explicitly added. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
193 lines
5.2 KiB
Svelte
193 lines
5.2 KiB
Svelte
<script lang="ts">
|
|
import type { Schema } from '$lib/common'
|
|
import { VariableService, WorkspaceService, type InputTransform } from '$lib/gen'
|
|
import { workspaceStore } from '$lib/stores'
|
|
import { allTrue, type DynamicInput as DynamicInputTypes } from '$lib/utils'
|
|
import { untrack } from 'svelte'
|
|
import { Button } from './common'
|
|
import StepInputsGen from './copilot/StepInputsGen.svelte'
|
|
import type { PickableProperties } from './flows/previousResults'
|
|
import InputTransformForm from './InputTransformForm.svelte'
|
|
import ItemPicker from './ItemPicker.svelte'
|
|
import VariableEditor from './VariableEditor.svelte'
|
|
import { Plus } from 'lucide-svelte'
|
|
import ResizeTransitionWrapper from './common/ResizeTransitionWrapper.svelte'
|
|
|
|
interface Props {
|
|
schema: Schema | { properties?: Record<string, any> }
|
|
args?: Record<string, InputTransform | any>
|
|
isValid?: boolean
|
|
extraLib?: string
|
|
previousModuleId?: string | undefined
|
|
filter?: string[] | undefined
|
|
noDynamicToggle?: boolean
|
|
pickableProperties?: PickableProperties | undefined
|
|
enableAi?: boolean
|
|
class?: string
|
|
helperScript?: DynamicInputTypes.HelperScript
|
|
isAgentTool?: boolean
|
|
allowedAiTransforms?: string[] | undefined
|
|
chatInputEnabled?: boolean
|
|
}
|
|
|
|
let {
|
|
schema = $bindable(),
|
|
args = $bindable({}),
|
|
isValid = $bindable(true),
|
|
extraLib = $bindable('missing extraLib'),
|
|
previousModuleId = undefined,
|
|
filter = undefined,
|
|
noDynamicToggle = false,
|
|
pickableProperties = undefined,
|
|
enableAi = false,
|
|
class: clazz = '',
|
|
helperScript = undefined,
|
|
isAgentTool = false,
|
|
allowedAiTransforms = isAgentTool ? undefined : [],
|
|
chatInputEnabled = false
|
|
}: Props = $props()
|
|
|
|
let inputCheck: { [id: string]: boolean } = $state({})
|
|
|
|
$effect(() => {
|
|
isValid = allTrue(inputCheck) ?? false
|
|
})
|
|
|
|
$effect(() => {
|
|
if (args == undefined || typeof args !== 'object') {
|
|
args = {}
|
|
}
|
|
})
|
|
|
|
export function setArgs(nargs: Record<string, InputTransform | any>) {
|
|
args = nargs
|
|
}
|
|
|
|
function removeExtraKey() {
|
|
const nargs = {}
|
|
Object.keys(args ?? {}).forEach((key) => {
|
|
if (keys.includes(key)) {
|
|
nargs[key] = args[key]
|
|
}
|
|
})
|
|
args = nargs
|
|
}
|
|
|
|
let pickForField: string | undefined = $state()
|
|
let itemPicker: ItemPicker | undefined = $state(undefined)
|
|
let variableEditor: VariableEditor | undefined = $state(undefined)
|
|
|
|
let s3StorageConfigured = $state(true)
|
|
|
|
async function checkS3Storage() {
|
|
try {
|
|
if ($workspaceStore) {
|
|
const settings = await WorkspaceService.getPublicSettings({ workspace: $workspaceStore })
|
|
s3StorageConfigured = settings.large_file_storage?.s3_resource_path !== undefined
|
|
}
|
|
} catch (error) {
|
|
console.error('Failed to fetch workspace settings:', error)
|
|
s3StorageConfigured = true
|
|
}
|
|
}
|
|
|
|
checkS3Storage()
|
|
|
|
let keys: string[] = $state([])
|
|
$effect(() => {
|
|
let lkeys = Object.keys(schema?.properties ?? {})
|
|
if (schema?.properties && JSON.stringify(lkeys) != JSON.stringify(keys)) {
|
|
keys = lkeys
|
|
untrack(() => removeExtraKey())
|
|
}
|
|
})
|
|
</script>
|
|
|
|
<div class="w-full mb-6 {clazz}">
|
|
{#if enableAi}
|
|
<div class="pt-2">
|
|
<StepInputsGen
|
|
{pickableProperties}
|
|
argNames={keys
|
|
? keys.filter(
|
|
(argName) =>
|
|
Object.keys(schema.properties ?? {}).includes(argName) &&
|
|
Object.keys(args ?? {}).includes(argName) &&
|
|
((args[argName].type === 'static' && !args[argName].value) ||
|
|
(args[argName].type === 'javascript' && !args[argName].expr))
|
|
)
|
|
: []}
|
|
{schema}
|
|
/>
|
|
</div>
|
|
{/if}
|
|
{#if keys.length > 0}
|
|
{#each keys as argName, index (argName)}
|
|
{#if (!filter || filter.includes(argName)) && Object.keys(schema.properties ?? {}).includes(argName)}
|
|
<ResizeTransitionWrapper class="mt-6" innerClass="w-full" vertical>
|
|
<InputTransformForm
|
|
{previousModuleId}
|
|
bind:arg={args[argName]}
|
|
bind:schema
|
|
bind:argName={keys[index]}
|
|
argExtra={schema.properties?.[argName] ?? {}}
|
|
bind:inputCheck={
|
|
() => inputCheck[argName] ?? false, (value) => (inputCheck[argName] = value)
|
|
}
|
|
bind:extraLib
|
|
{variableEditor}
|
|
{itemPicker}
|
|
bind:pickForField
|
|
{noDynamicToggle}
|
|
{pickableProperties}
|
|
{enableAi}
|
|
{helperScript}
|
|
{isAgentTool}
|
|
{allowedAiTransforms}
|
|
{s3StorageConfigured}
|
|
{chatInputEnabled}
|
|
otherArgs={Object.fromEntries(
|
|
Object.entries(args ?? {}).filter(([key]) => key !== argName)
|
|
)}
|
|
/>
|
|
</ResizeTransitionWrapper>
|
|
{/if}
|
|
{/each}
|
|
{:else}
|
|
<div class="text-primary text-xs mt-2">No inputs</div>
|
|
{/if}
|
|
</div>
|
|
|
|
<ItemPicker
|
|
bind:this={itemPicker}
|
|
pickCallback={(path, _) => {
|
|
if (pickForField) {
|
|
args[pickForField].value = '$var:' + path
|
|
}
|
|
}}
|
|
itemName="Variable"
|
|
extraField="path"
|
|
loadItems={async () =>
|
|
(await VariableService.listVariable({ workspace: $workspaceStore ?? '' })).map((x) => ({
|
|
name: x.path,
|
|
...x
|
|
}))}
|
|
>
|
|
{#snippet submission()}
|
|
<div class="flex flex-row-reverse w-full border-t border-gray-200 rounded-bl-lg rounded-br-lg">
|
|
<Button
|
|
variant="accent"
|
|
size="sm"
|
|
startIcon={{ icon: Plus }}
|
|
on:click={() => {
|
|
variableEditor?.initNew?.()
|
|
}}
|
|
>
|
|
New variable
|
|
</Button>
|
|
</div>
|
|
{/snippet}
|
|
</ItemPicker>
|
|
|
|
<VariableEditor bind:this={variableEditor} />
|