mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-19 08:01:25 +00:00
Ruben Fiszel
3bf6e102af
The list_apps and list_search_apps endpoints did not filter returned rows against the calling token's resource-qualified scope. A token scoped to apps:read:u/foo/specific_app could list every app in the workspace, including full app_version.value definitions. Apply build_scope_path_predicate, mirroring the protection already in place for script, flow, resource and variable list endpoints. Fixes WIN-2046 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
48 lines
1.4 KiB
Rust
48 lines
1.4 KiB
Rust
/*
|
|
* Author: Ruben Fiszel
|
|
* Copyright: Windmill Labs, Inc 2022
|
|
* This file and its contents are licensed under the AGPLv3 License.
|
|
* Please see the included NOTICE for copyright information and
|
|
* LICENSE-AGPL for a copy of the license.
|
|
*/
|
|
|
|
use axum::{body::Body, response::Response};
|
|
use serde::{Deserialize, Deserializer};
|
|
|
|
pub use windmill_api_auth::{
|
|
build_scope_path_predicate, check_scopes, require_devops_role, require_super_admin,
|
|
};
|
|
|
|
#[cfg(feature = "private")]
|
|
pub use windmill_common::usernames::generate_instance_wide_unique_username;
|
|
|
|
#[cfg(feature = "enterprise")]
|
|
pub use windmill_alerting::{
|
|
acknowledge_all_critical_alerts, acknowledge_critical_alert, get_critical_alerts,
|
|
AlertQueryParams,
|
|
};
|
|
|
|
pub fn content_plain(body: Body) -> Response {
|
|
use axum::http::header;
|
|
Response::builder()
|
|
.header(header::CONTENT_TYPE, "text/plain")
|
|
.body(body)
|
|
.unwrap()
|
|
}
|
|
|
|
#[allow(unused)]
|
|
pub fn non_empty_str<'de, D>(deserializer: D) -> Result<Option<String>, D::Error>
|
|
where
|
|
D: Deserializer<'de>,
|
|
{
|
|
let o: Option<String> = Option::deserialize(deserializer)?;
|
|
Ok(o.filter(|s| !s.trim().is_empty()))
|
|
}
|
|
|
|
#[cfg(feature = "http_trigger")]
|
|
pub use windmill_common::utils::ExpiringCacheEntry;
|
|
|
|
lazy_static::lazy_static! {
|
|
static ref DUCKLAKE_INSTANCE_PG_PASSWORD: std::sync::RwLock<Option<String>> = std::sync::RwLock::new(None);
|
|
}
|