mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-25 08:00:59 +00:00
Alexander Petric
4cb89d0b8d
Security: on the agent-worker path the completion payload's owner fields (permissioned_as/email) are attacker-supplied, and create_token_for_owner(perms: None) falls back to fetch_authed_from_permissioned_as — letting a completion mint a token for an arbitrary identity. Instead fetch the server-written job_perms row and pass Some(perms); when the row is absent (e.g. zombie replay after the queue row was reaped) keep the step token rather than trusting the payload. Gating: refresh based on the token's actual remaining lifetime (DB-free decode_without_verify) instead of step duration. This confines the extra get_job_perms lookup to near-expiry completions and also covers completions with no recorded duration (Noop/cache), which the duration guard missed. Add job_token_remaining_lifetime_secs + JOB_TOKEN_REFRESH_MARGIN_SECS (must exceed the 60s JWT leeway) in windmill-common::auth, with unit tests pinning the margin-vs-leeway invariant and the near-expiry detection. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise