mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-07 08:02:40 +00:00
Alexander PetricandClaude Opus 4.8
2e249ff892
* fix(flows): mint fresh orchestration token so long steps don't expire the result-fetch JWT
A flow step's ephemeral JWT is minted at step pull time with a lifetime of
SCRIPT_TOKEN_EXPIRY (900s on cloud) and reused to drive post-completion flow
orchestration — including the next step's input-transform isolated-eval, which
fetches prior steps' results (e.g. `[...results.x]`). If the step whose
completion triggers that fetch ran longer than the token's lifetime minus the
60s JWT leeway (~16min on cloud), the reused token is already expired and the
fetch is rejected as anonymous:
Failed to fetch results for step 'x':
Bad request: As a non logged in user, you can only see jobs ran by anonymous users
This surfaces as an intermittent, hard-to-diagnose failure of long-running
flows (per-step duration, not total flow duration).
Mint a fresh token for flow-step completions so the orchestration client's
lifetime is independent of how long the finished step ran (falls back to the
step token on error).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* address review: derive end-user label, guard mint on step staleness, trim comment
- Derive the token label the same way as create_token
(ephemeral-script-end-user-{created_by} when permissioned_as differs from
created_by) so run-on-behalf-of flows keep the end-user override that
username_override_from_label relies on, instead of hardcoding "ephemeral-script".
- Only mint the fresh token when the finished step could actually have expired it
(duration >= SCRIPT_TOKEN_EXPIRY/2), so the common short-step path keeps the
pull-time token and avoids an extra get_job_perms query per completion.
- Add warn_after_seconds(5) on the mint, matching create_token.
- Trim the comment to the durable invariant and drop the internal ticket id
(comment + log line) per AGENTS.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>