Ruben FiszelandClaude Opus 4.8 6b3dedbe49 fix: bound the guest JWT email; serve stale JWKS during refresh ...

- Cap the email claim at 254 bytes as well as requiring a plain address. An
  over-255-byte email fit the signature but overflowed the guest_activity.email
  column: the activity write and the login_guest audit both failed while the
  guest was still admitted, so a guest could enter uncounted and unaudited. Now
  refused before authentication.
- Serve a stale-but-good JWKS entry while a refresh runs off the request path,
  so a slow or hanging issuer no longer stalls guest requests for the fetch
  timeout at each 15-minute TTL boundary. Only a cold or negative entry blocks,
  still under the single-flight lock; the background refresh no-ops when a fetch
  is already in flight and keeps the stale keys on failure.
- Tests: an oversized email is refused alongside the group-shaped and
  slash-in-email cases.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

2026-09-03 09:25:39 +00:00

..

fixtures

fix: scope capture deletion to the workspace in the request path (#10795)

2026-08-22 10:01:25 +00:00

scripts

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

agent_workers.rs

fix: keep agent-worker server job-completed processor alive & self-healing (#10033)

2026-07-10 23:42:30 +02:00

app_anonymous_execution_mode.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

app_custom_path_cross_workspace.rs

fix: actionable error when a custom_path is taken by an app in another workspace (#9190)

2026-05-16 08:29:53 +00:00

app_guest_execution_mode.rs

fix: guest controls read the plan, not the key; gate the guest tests on the features they need

2026-09-02 17:27:18 +00:00

app_guest_jwt_entry.rs

fix: bound the guest JWT email; serve stale JWKS during refresh

2026-09-03 09:25:39 +00:00

app_preview_auth.rs

fix: add apps:run to the token scope picker and confine path-scoped app tokens (#10428)

2026-07-31 11:38:05 +02:00

app_s3_onbehalf.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

asset_trigger_dispatch.rs

fix: expand AZURE_DEVOPS_TOKEN placeholder in backend git probes (#10677)

2026-08-13 11:06:55 +00:00

batch_rerun.rs

[ee] feat(backend): native script retry without one-step-flow wrapping (#9688)

2026-06-25 13:22:26 +00:00

bun_jobs.rs

fix: invalidate bun bundle cache on transitive relative-import changes (#9891)

2026-07-02 23:57:26 +02:00

capture_cross_workspace.rs

fix: scope capture deletion to the workspace in the request path (#10795)

2026-08-22 10:01:25 +00:00

ci_tests.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

datatable_migration_add_down.rs

feat(datatables): add a down migration from the migration viewer (#10812)

2026-08-24 22:36:32 +02:00

datatable_migrations_grants.rs

fix: surface the real postgres error when data table migrations fail (#10371)

2026-07-28 14:29:06 +02:00

debounce_e2e.rs

fix(debounce): never supersede a running debounce survivor (#9780)

2026-06-25 16:36:16 +00:00

dedicated_workers.rs

refactor: convert read-hot globals to AtomicBool/I64 and ArcSwap (#8815)

2026-04-14 00:04:10 +00:00

delete_after_secs.rs

feat: add scheduled job deletion with configurable retention period (#8753)

2026-04-08 04:15:28 +00:00

dependency_map.rs

fix: stop app updates from silently converting an app between raw and low-code (#10495)

2026-08-04 10:52:20 +02:00

drafts_nul.rs

fix(backend): strip NUL bytes from draft values on write (#9673)

2026-06-19 13:33:36 +00:00

end_user_email.rs

refactor: deprecate username_to_email in favor of WM_END_USER_EMAIL (#10429)

2026-07-31 11:47:58 +02:00

error_handler.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

flow_engine_parity.rs

feat(flows): opt-in to include the stopping step's result in early-stop errors (#9446)

2026-06-04 18:57:05 +00:00

folder_default_permissioned_as.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

fork_deployment_requests.rs

feat: add deploy restriction rule and fork review requests (#8804)

2026-04-13 17:10:37 +00:00

freshness_watchdog.rs

feat(pipelines): asset freshness — fresh/stale badge (CE) + watchdog (EE) (#9909)

2026-07-04 06:23:44 +02:00

inline_preview_auth.rs

block operators from inline preview job execution (#9572)

2026-06-15 00:07:46 +02:00

instance_config.rs

feat(git-sync): dedicated base url for GitHub webhook delivery (#10411)

2026-07-30 23:27:12 +02:00

job_payload.rs

feat: support restart from steps inside BranchOne, ForLoop, Subflow (#8955)

2026-04-28 20:00:03 +00:00

jobs_read_auth.rs

fix: confine jobs:run tokens to the jobs of the runnables they may start (#10635)

2026-08-14 18:57:57 +02:00

list_jobs.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

list_scripts_parent_hash.rs

fix: make the listScripts parent_hash filter valid SQL (#10752)

2026-08-18 18:22:03 +02:00

mcp_resource_authz.rs

fix(ai): enforce resource authz when loading MCP tools in agent worker (#9571)

2026-06-14 23:50:18 +02:00

mcp_token_exfil.rs

feat: let the global AI chat call connected MCP servers as the user (#10656)

2026-08-14 18:51:19 +02:00

nativets_dedicated.rs

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

nativets_jobs.rs

fix(jobs): sanitize NUL in completed job result before jsonb insert (#10274)

2026-07-23 10:39:38 +02:00

nativets_stress.rs

perf: resolve the worker external IP in the background (#10697)

2026-08-14 14:27:21 +02:00

on_behalf_of.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

operator_db_sync.rs

fix: add secretKeyRef support for jwt_secret and rsa_keys (#8698)

2026-04-03 18:17:27 +00:00

otel.rs

feat(otel): connect jobs to the inbound distributed trace (#9456)

2026-06-05 16:50:07 +00:00

postgres_trigger_scope.rs

feat: guest JWT entry for embedded apps

2026-09-03 08:00:25 +00:00

preserve_on_behalf_of.rs

fix(security): a WM_TOKEN job token can never be a global superadmin (GHSA-hfh4-cx4h-3fcr) (#10124)

2026-08-19 22:33:46 +02:00

preview_native_tag.rs

fix: carry the token label into job-run audit rows (#10433)

2026-07-31 16:13:12 +02:00

protection_rules.rs

fix: let admins edit the dev workspace lock ruleset (#10512)

2026-08-04 18:25:59 +02:00

python_jobs.rs

fix: support @typechecked decorator in Python relative imports (#8495)

2026-08-17 12:30:25 +02:00

raw_app_missing_css.rs

fix: raw apps with no stylesheet were permanently un-deployable (#10364)

2026-07-27 22:32:57 +02:00

relock_skip.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

resource_versioning.rs

feat: version resource values with history, diff and restore (#10596)

2026-08-10 21:32:18 +02:00

restart_at_step_api.rs

feat: support restart from steps inside BranchOne, ForLoop, Subflow (#8955)

2026-04-28 20:00:03 +00:00

retry.rs

fix(flows): skip_if evaluates wrong previous_result during retry (#9547)

2026-06-12 17:31:31 +02:00

runnables_list_pagination.rs

fix: home search matches each term instead of the whole query verbatim (#10663)

2026-08-12 21:10:56 +02:00

runnables_owner_counts.rs

feat: show per-owner runnable counts in the homepage tree (WIN-2253) (#10351)

2026-07-27 14:57:54 +02:00

script_auto_kind_failure.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

script_auto_parent_archived.rs

fix: reset parent_hash in auto_parent when all versions at path are archived (#9172)

2026-05-16 07:43:35 +00:00

script_modules.rs

feat: Data Pipelines alpha (#9193)

2026-06-18 18:09:02 +02:00

script_rename_clears_assets.rs

fix: clear old path asset usage when renaming a script (#9979)

2026-07-07 14:23:31 +02:00

session_workspace_status.rs

stop destroying AI sessions in workspaces reached without a usr row (#10567)

2026-08-06 12:45:34 +02:00

sign_s3_objects_authz.rs

feat: configurable expiry for presigned s3 public url signatures (#10835)

2026-08-26 00:47:24 +02:00

success_handler.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

suspend_resume.rs

fix: keep the same_worker pin when a suspend ends without approval (#10552)

2026-08-05 23:59:42 +02:00

suspended_pull_index.rs

perf: index the suspended-job resume test instead of filtering it (#10863)

2026-08-27 00:39:03 +02:00

trigger_listener_queries.rs

feat: guest JWT entry for embedded apps

2026-09-03 08:00:25 +00:00

v2_job_delete_orphans.rs

perf: drop v2_job side-table ON DELETE CASCADE FKs to speed retention deletes (#9786)

2026-06-25 13:52:30 +00:00

volume_tests.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

wac_approval_resume.rs

feat: bind WAC approval urls to a named wait_for_approval step (#10317)

2026-07-25 11:41:48 +02:00

wac_approval_urls.rs

feat: bind WAC approval urls to a named wait_for_approval step (#10317)

2026-07-25 11:41:48 +02:00

wm_token_confinement.rs

feat: guest JWT entry for embedded apps

2026-09-03 08:00:25 +00:00

worker_ping_ip.rs

perf: resolve the worker external IP in the background (#10697)

2026-08-14 14:27:21 +02:00

worker.rs

fix(security): a WM_TOKEN job token can never be a global superadmin (GHSA-hfh4-cx4h-3fcr) (#10124)

2026-08-19 22:33:46 +02:00

workspace_dependencies.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

workspace_encryption_key_scope.rs

fix: require an unscoped token to reach the workspace encryption key (#10798)

2026-08-22 09:55:44 +00:00

workspace_export.rs

fix: require admin on workspace tarball settings export (#10817)

2026-08-26 00:49:13 +02:00

workspace_fairness.rs

fix(queue): duration-weighted workspace fairness signal (#9329)

2026-05-26 11:47:45 +00:00

workspace_storage_by_name.rs

fix: name the requested storage when a workspace storage lookup finds nothing (#10803)

2026-08-22 09:50:30 +00:00

ws_specific.rs

fix(security): enforce variables:write scope on resource-delete var cascade (GHSA-xmr2-98m6-cjf7) (#10123)

2026-07-15 13:19:17 +02:00

zombie_flow_recovery.rs

feat(monitor): make between-steps zombie flows hand-recoverable (#10287)

2026-07-23 19:09:28 +02:00