mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-11 00:06:06 +00:00
hugocasaandClaude Opus 4.8
732ca11de2
The MCP endpoint-tool proxy re-mints a JWT from the caller's ApiAuthed to forward the proxied request, but passed job_id: None. A job's WM_TOKEN is capped at workspace admin (GHSA-hfh4-cx4h-3fcr); dropping the job_id here re-minted an uncapped token that satisfies require_super_admin / require_devops_role on the proxied route (e.g. listWorkers exposing worker IPs, job/workspace IDs, and sensitive tags). Carry api_authed.job_id into create_jwt_token. Adds an in-module regression that decodes the forwarded JWT and asserts the job_id is preserved for a job caller and absent for a non-job caller. Reported by Codex CI review (P1) on #10124. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise