starred/windmill

mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-08 08:04:25 +00:00

Files

T

History

hugocasaandClaude Opus 4.8 732ca11de2 fix(mcp): preserve job-token provenance when minting the proxy JWT

The MCP endpoint-tool proxy re-mints a JWT from the caller's ApiAuthed to
forward the proxied request, but passed job_id: None. A job's WM_TOKEN is
capped at workspace admin (GHSA-hfh4-cx4h-3fcr); dropping the job_id here
re-minted an uncapped token that satisfies require_super_admin /
require_devops_role on the proxied route (e.g. listWorkers exposing worker
IPs, job/workspace IDs, and sensitive tags).

Carry api_authed.job_id into create_jwt_token. Adds an in-module regression
that decodes the forwarded JWT and asserts the job_id is preserved for a job
caller and absent for a non-job caller.

Reported by Codex CI review (P1) on #10124.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-17 17:14:27 +02:00

..

chore: refresh vendored docs snapshot (#9955 )

2026-07-06 10:01:13 +02:00

fix(mcp): preserve job-token provenance when minting the proxy JWT

2026-07-17 17:14:27 +02:00

banned_domains.txt

increase banned_domains list

2022-12-14 10:24:18 +01:00

build_openapi.sh

add scalar at openapi2.html

2024-04-08 01:42:43 +02:00

build.rs

refactor: extract object store into dedicated crate with filesystem backend (#7996 )

2026-02-18 12:24:45 +00:00

Cargo.toml

feat(ducklake): scheduled lake maintenance (expiry, compaction, orphan cleanup) (#9916 )

2026-07-04 17:23:23 +02:00

openapi-deref.json

perf(audit): re-anchor S3 audit export on enable + opt-in backfill (#9818 )

2026-06-26 21:37:33 +02:00

openapi-deref.yaml

perf(audit): re-anchor S3 audit export on enable + opt-in backfill (#9818 )

2026-06-26 21:37:33 +02:00

openapi.yaml

feat(forks): let a fork's creator manage developers on it without being an admin (#10166 )

2026-07-17 15:13:36 +02:00

README.md

restructure the entire backend layout using workspaces (#815 )

2022-10-29 11:58:06 +02:00

README.md

Windmill API

The API server, exposing functionality to other components and the frontend

This crate exposes both a library as well as a binary target.