AlexRV12andClaude Opus 5 db3aba57e3 Merge branch 'main' into alexandre/win-2332-add-expiration-to-secret-variable-trigger-runnable-on ...

Conflicts were all additive on both sides:
- workspace_settings column lists (workspaces_extra.rs, summarized_schema.txt)
- feature usage disclosure copy (InstanceSettings.svelte)
- VariableForm/VariableEditor imports against the new operatingWorkspace helper
- utils_draft_deploy.test.ts: kept both the variable expiry and resource suites
- cli variable push rebased onto main's extra_perms split of localVariableBody

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG

2026-09-21 19:12:01 +02:00

..

fixtures

feat: put a data table's connection under Postgres roles (#11020)

2026-09-18 13:56:41 +02:00

ai_routes.rs

fix(ai): enforce RLS and scope check on user-supplied X-Resource-Path (#9276)

2026-05-21 15:21:27 +00:00

apps.rs

feat: make createApp and updateApp the full-code app tools over MCP (#10510)

2026-08-04 18:20:48 +02:00

assets.rs

fix: show runtime-detected assets in a run's Assets tab (#10738)

2026-08-18 10:26:20 +02:00

audit.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

capture_unauthed.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

ci_tests.rs

feat: WM_TESTED_RUNNABLE env var + wildcards in test: annotation (#8926)

2026-04-24 12:52:25 +00:00

concurrency_groups.rs

authorize GET /concurrency_groups/{job_id}/key per job (#10665)

2026-08-12 21:05:02 +02:00

configs.rs

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

datatable_acl.rs

feat: add an ACL editor for data table roles (#11063)

2026-09-19 23:23:50 +02:00

datatable_roles.rs

fix: guard data table migration routes against operators and unauthorized authors (#11243)

2026-09-21 14:47:47 +00:00

dbt_materialize_target.rs

feat: let // materialize declare a dbt:// warehouse-relation write (#10978)

2026-09-07 17:38:07 +02:00

drafts.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

favorites.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

flows.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

folder_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

folders.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

fork_clone_on_behalf_of.rs

feat: drafts follow their item through a move; behind means base ≠ head (#10577)

2026-09-18 20:54:23 +02:00

fork_member_grant.rs

feat(forks): let a fork's creator manage developers on it without being an admin (#10166)

2026-07-17 15:13:36 +02:00

fork_members.rs

feat: add a workspace toggle that adds its admins and developers to new forks (#11215)

2026-09-18 15:15:35 +02:00

fork_secret_replication_azure.rs

fix: replicate all secrets on fork when external backend is configured (#10060)

2026-07-12 10:19:20 +02:00

granular_acls.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

group_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

groups.rs

fix: skip instance group members that are not email addresses (#11128)

2026-09-15 09:45:10 +02:00

health.rs

test nits

2026-03-27 12:28:54 +00:00

inputs.rs

fix: show scheduled singlestepflow runs in flow history sidebar (#10312)

2026-07-24 18:12:09 +02:00

job_metrics.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

jobs_authed.rs

report the EE gate instead of a 500 on restart flow at step (#10846)

2026-08-26 00:31:21 +02:00

jobs_unauthed.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

login_link.rs

Revert "feat(auth): 2 h login links and a click-to-sign-in page for emailed ones (#11203)" (#11267)

2026-09-21 16:54:28 +00:00

max_token_expiration.rs

feat: cap user token expiration with an instance setting (#11159)

2026-09-18 14:37:39 +02:00

mcp_preprocessor_headers.rs

test: keep the mcp preprocessor header test off the dependency job (#10989)

2026-09-05 11:10:41 +02:00

mcp_protocol_versions.rs

feat(mcp): serve the 2026-07-28 spec alongside the legacy protocol (#10535)

2026-08-05 13:52:09 +02:00

mcp_token_query_param.rs

feat: add an instance setting to refuse a token in MCP URLs (#11162)

2026-09-18 15:24:00 +02:00

native_triggers.rs

fix: make the native trigger disable/enable toggle actually save (#11024)

2026-09-08 17:07:26 +02:00

nested_dev_workspace.rs

feat: offer more dev workspace environment labels (#10570)

2026-08-06 18:32:19 +00:00

npm_proxy.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

offboarding.rs

refactor: make the app policy's principal the authority for its identity (#10440)

2026-09-12 09:10:15 +02:00

permissions.rs

feat: store hashed tokens instead of plaintext (#8217)

2026-03-17 01:15:38 +00:00

protection_rules.rs

fix: let a draft-only schedule, trigger or resource be deleted (#11010)

2026-09-07 18:55:40 +02:00

raw_apps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

resources.rs

feat: store resource type display names and label hub integrations (#11113)

2026-09-15 11:32:50 +02:00

run_inline.rs

feat: mcp oauth gateway (#8443)

2026-03-20 16:12:59 +00:00

schedules.rs

fix: let a draft-only schedule, trigger or resource be deleted (#11010)

2026-09-07 18:55:40 +02:00

scripts.rs

fix: record supplied script lock hashes so importers can skip relocking (#10915)

2026-09-02 19:20:49 +02:00

sensitive_log_masking.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

service_logs.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

settings.rs

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

slack_approvals_unauthed.rs

fix: authenticate slack callback payload with per-workspace hmac (#9461)

2026-06-06 08:02:20 +00:00

token_expiry_warning.rs

feat: cap user token expiration with an instance setting (#11159)

2026-09-18 14:37:39 +02:00

token_hash.rs

fix: keep native triggers attached when a runnable is renamed (#10432)

2026-07-31 23:44:25 +02:00

token_label_idor.rs

fix: skip expiry notifications for app embed and SDK tokens (#11169)

2026-09-16 17:28:53 +02:00

trash.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

trigger_e2e.rs

fix: advance postgres replication slot lsn via periodic standby status updates (#9227)

2026-05-19 05:44:13 +00:00

triggers.rs

feat: support application default credentials for gcp pub/sub triggers (#10778)

2026-08-21 10:41:14 +02:00

users.rs

fix: let a principal without a login account own a draft (#10925)

2026-09-01 23:42:08 +02:00

variables.rs

feat: run a workspace handler when a secret variable expires

2026-08-27 12:15:23 +02:00

workspace_comparison.rs

feat: run a workspace handler when a secret variable expires

2026-08-27 12:15:23 +02:00

workspace_dependencies_git_sync.rs

fix(git-sync): run auto-pull as the admin who enabled it (#11121)

2026-09-15 10:34:57 +02:00

workspace_deps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

workspace_encryption_key_git_sync.rs

fix: re-encrypt git sync secrets on workspace key rotation (#11218)

2026-09-18 15:21:07 +02:00

workspaces.rs

fix: keep instance groups when editing auto-invite (#11217)

2026-09-18 14:32:55 +02:00