Ruben Fiszel 4b1bea8aed fix: enforce auth guards on app component preview execution (#9235) ...

* fix: enforce auth guards on app component preview execution

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: guard previewed runnable path and worker tag in app preview

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: validate app_script id ownership and keep root push isolation

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor: scope app preview guards to operator check + referenced runnables

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: require jobs:run scope and tag check on app preview (apps:run escalation)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-19 17:40:55 +00:00

..

fixtures

fix: enforce auth guards on app component preview execution (#9235)

2026-05-19 17:40:55 +00:00

scripts

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

agent_workers.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

app_custom_path_cross_workspace.rs

fix: actionable error when a custom_path is taken by an app in another workspace (#9190)

2026-05-16 08:29:53 +00:00

app_preview_auth.rs

fix: enforce auth guards on app component preview execution (#9235)

2026-05-19 17:40:55 +00:00

batch_rerun.rs

fix: handle singlestepflow zombies and stop filtering them from runs page (#9055)

2026-05-07 08:00:38 +00:00

bun_jobs.rs

fix(bun): pass --preserve-symlinks on unbundled execution (#9147)

2026-05-13 13:04:31 +00:00

ci_tests.rs

feat: add CI test scripts with auto-trigger on deploy (#8736)

2026-04-09 17:21:36 +00:00

dedicated_workers.rs

refactor: convert read-hot globals to AtomicBool/I64 and ArcSwap (#8815)

2026-04-14 00:04:10 +00:00

delete_after_secs.rs

feat: add scheduled job deletion with configurable retention period (#8753)

2026-04-08 04:15:28 +00:00

dependency_map.rs

feat: add scheduled job deletion with configurable retention period (#8753)

2026-04-08 04:15:28 +00:00

end_user_email.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

error_handler.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

flow_engine_parity.rs

fix(flows): inherit flow_env in sub-flow predicates (#9042)

2026-05-05 20:11:38 +00:00

folder_default_permissioned_as.rs

feat: folder default_permissioned_as rules for ownership defaults on deploy (#8801)

2026-04-12 20:14:07 +00:00

fork_deployment_requests.rs

feat: add deploy restriction rule and fork review requests (#8804)

2026-04-13 17:10:37 +00:00

instance_config.rs

fix: treat empty global setting strings as unset (#8793)

2026-04-10 14:23:37 +00:00

job_payload.rs

feat: support restart from steps inside BranchOne, ForLoop, Subflow (#8955)

2026-04-28 20:00:03 +00:00

list_jobs.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

nativets_dedicated.rs

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

nativets_jobs.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

nativets_stress.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

operator_db_sync.rs

fix: add secretKeyRef support for jwt_secret and rsa_keys (#8698)

2026-04-03 18:17:27 +00:00

otel.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

preserve_on_behalf_of.rs

fix: replace email with permissioned_as for triggers/schedules (#8439)

2026-03-20 16:28:38 +00:00

protection_rules.rs

feat: add deploy restriction rule and fork review requests (#8804)

2026-04-13 17:10:37 +00:00

python_jobs.rs

fix(python): preserve strings containing Infinity/NaN in result JSON (#9149)

2026-05-13 15:49:36 +00:00

relock_skip.rs

feat: add scheduled job deletion with configurable retention period (#8753)

2026-04-08 04:15:28 +00:00

restart_at_step_api.rs

feat: support restart from steps inside BranchOne, ForLoop, Subflow (#8955)

2026-04-28 20:00:03 +00:00

retry.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

script_auto_kind_failure.rs

fix: never mark failure/trigger/approval scripts as auto_kind=lib (#9168)

2026-05-14 13:29:56 +00:00

script_auto_parent_archived.rs

fix: reset parent_hash in auto_parent when all versions at path are archived (#9172)

2026-05-16 07:43:35 +00:00

script_modules.rs

chore: fix cargo checks

2026-05-01 20:39:41 +00:00

success_handler.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

suspend_resume.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

trigger_listener_queries.rs

feat: read-only flag on API tokens (#9144)

2026-05-13 15:26:21 +00:00

volume_tests.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

worker.rs

fix: bubble handle_flow chaining errors to parent flow (#9058)

2026-05-06 23:47:13 +00:00

workspace_dependencies.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

workspace_export.rs

refactor: replace SELECT * with explicit column lists (#9010)

2026-05-04 08:39:45 +00:00

ws_specific.rs

feat: add workspace-specific flag for resources and variables (#8836)

2026-05-07 13:35:54 +00:00