mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-29 16:15:51 +00:00
Ruben FiszelandClaude Opus 4.7
593522033a
WIN-1978's tightening of the `g/<groupname>` owner branch only verified that the group exists in the target workspace. The default `all` group is provisioned in every workspace, so any forged `owner=g/all` token paired with an arbitrary `workspace_id` still passed the existence check and authenticated as a group user there — including for an email that was not a member of that workspace. Additionally require the token holder's email to be a non-disabled member of the target workspace, mirroring the spirit of the `u/` branch's `usr` lookup. Adds an integration regression covering both the forged non-member case and the legitimate member case. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise