mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-20 08:01:35 +00:00
6f363163df
* feat(websocket-trigger): honor HTTPS_PROXY/HTTP_PROXY/NO_PROXY (WIN-1988)
`tokio_tungstenite::connect_async` opens a raw TCP socket and ignores
the standard outbound-proxy env vars, so deployments behind a forward
HTTP proxy can't reach the WebSocket endpoint and Test Connection
times out after 30s.
Add a small `proxy` module that resolves the right proxy URL for the
target host (HTTPS_PROXY for wss://, HTTP_PROXY for ws://, NO_PROXY
exclusions, ALL_PROXY fallback, lowercase variants), opens an HTTP
CONNECT tunnel when one applies, and hands the resulting TcpStream to
`client_async_tls_with_config` for the TLS + WS handshake. Direct
connect remains the default when no proxy env is set.
Unit tests cover NO_PROXY matching, proxy URL parsing (including IPv6
literals and basic-auth userinfo), and the CONNECT handshake itself
against an in-process fake proxy (success, basic-auth header, 407
rejection).
Fixes WIN-1988
* refactor(websocket-trigger): reduce blast radius and reuse existing logic
Follow-up to the proxy support change. Three things:
1. Skip the new code path entirely when no proxy is configured.
`connect_async_with_proxy` now checks the env-var snapshots up front
and delegates straight to `tokio_tungstenite::connect_async` if
neither `HTTP_PROXY` nor `HTTPS_PROXY` is set. Same fall-through
applies when proxy env is set but `NO_PROXY` excludes the host or
the proxy URL doesn't parse. Non-proxied deployments now exercise
exactly the previous code path.
2. Move the `NO_PROXY` / `HTTP_PROXY` / `HTTPS_PROXY` env-var snapshots
from `windmill-worker::worker` into `windmill-common`. The worker's
`PROXY_ENVS` static now reads from there, and the websocket trigger
reads from the same source — one place reads the env, one source
of truth for both call sites.
3. Replace the hand-rolled proxy-URL parser with `url::Url::parse`
(already a workspace dep, used across the codebase). Half the LoC
and handles edge cases (userinfo percent-encoding, IPv6 literals,
path/query stripping) via the well-tested crate instead of by hand.
All 13 proxy unit tests still pass. `cargo check` is clean.
* fix(websocket-trigger): unbreak EE build + trim proxy tests
- Re-export `NO_PROXY` / `HTTP_PROXY` / `HTTPS_PROXY` from
`windmill-worker::worker` (via `pub use windmill_common::...`) so the
EE `otel_tracing_proxy_ee` module's `use crate::{HTTPS_PROXY, ...}`
resolves like it did before. Fixes the `check_ee_full` / `cargo_test`
CI failures from the previous commit.
- Trim the proxy tests to one un-ignored canary
(`http_connect_tunnel_sends_well_formed_request_and_unwraps_stream`)
that exercises the actual on-wire CONNECT handshake plus byte-perfect
tunnel passthrough. The NO_PROXY-matching, URL-parsing, and edge-case
tunnel tests are kept under `#[ignore]` for manual debugging
(`cargo test -- --ignored`) since they're either delegated to
`url::Url::parse` or trivial string matching — low ROI on every CI run.
291 lines
9.1 KiB
Rust
291 lines
9.1 KiB
Rust
use std::borrow::Cow;
|
|
|
|
use async_trait::async_trait;
|
|
use itertools::Itertools;
|
|
use serde_json::value::RawValue;
|
|
use sqlx::{types::Json as SqlxJson, PgConnection};
|
|
use windmill_api_auth::ApiAuthed;
|
|
use windmill_common::DB;
|
|
use windmill_common::{
|
|
db::UserDB,
|
|
error::{Error, Result},
|
|
worker::to_raw_value,
|
|
};
|
|
use windmill_git_sync::DeployedObject;
|
|
use windmill_trigger::{Trigger, TriggerCrud, TriggerData};
|
|
|
|
use super::{
|
|
get_url_from_runnable_value, proxy::connect_async_with_proxy, TestWebsocketConfig,
|
|
WebsocketConfig, WebsocketConfigRequest, WebsocketTrigger,
|
|
};
|
|
|
|
#[async_trait]
|
|
impl TriggerCrud for WebsocketTrigger {
|
|
type TriggerConfig = WebsocketConfig;
|
|
type Trigger = Trigger<Self::TriggerConfig>;
|
|
type TriggerConfigRequest = WebsocketConfigRequest;
|
|
type TestConnectionConfig = TestWebsocketConfig;
|
|
|
|
const TABLE_NAME: &'static str = "websocket_trigger";
|
|
const TRIGGER_TYPE: &'static str = "websocket";
|
|
const SUPPORTS_SERVER_STATE: bool = true;
|
|
const SUPPORTS_TEST_CONNECTION: bool = true;
|
|
const ROUTE_PREFIX: &'static str = "/websocket_triggers";
|
|
const DEPLOYMENT_NAME: &'static str = "WebSocket trigger";
|
|
const ADDITIONAL_SELECT_FIELDS: &[&'static str] = &[
|
|
"url",
|
|
"filters",
|
|
"filter_logic",
|
|
"initial_messages",
|
|
"url_runnable_args",
|
|
"can_return_message",
|
|
"can_return_error_result",
|
|
"heartbeat",
|
|
];
|
|
const IS_ALLOWED_ON_CLOUD: bool = false;
|
|
|
|
fn get_deployed_object(path: String, parent_path: Option<String>) -> DeployedObject {
|
|
DeployedObject::WebsocketTrigger { path, parent_path }
|
|
}
|
|
|
|
async fn validate_config(
|
|
&self,
|
|
_db: &DB,
|
|
config: &Self::TriggerConfigRequest,
|
|
_workspace_id: &str,
|
|
) -> Result<()> {
|
|
if config.url.trim().is_empty() {
|
|
return Err(Error::BadRequest(
|
|
"WebSocket URL cannot be empty".to_string(),
|
|
));
|
|
}
|
|
|
|
if let Some(args) = &config.url_runnable_args {
|
|
if !args.is_object() {
|
|
return Err(Error::BadRequest(
|
|
"url_runnable_args must be an object".to_string(),
|
|
));
|
|
}
|
|
}
|
|
|
|
if let Some(ref hb) = config.heartbeat {
|
|
if hb.interval_secs < 1 {
|
|
return Err(Error::BadRequest(
|
|
"heartbeat interval_secs must be at least 1".to_string(),
|
|
));
|
|
}
|
|
if hb.message.is_empty() {
|
|
return Err(Error::BadRequest(
|
|
"heartbeat message cannot be empty".to_string(),
|
|
));
|
|
}
|
|
}
|
|
|
|
Ok(())
|
|
}
|
|
|
|
async fn create_trigger(
|
|
&self,
|
|
_db: &DB,
|
|
tx: &mut PgConnection,
|
|
authed: &ApiAuthed,
|
|
w_id: &str,
|
|
trigger: TriggerData<Self::TriggerConfigRequest>,
|
|
) -> Result<()> {
|
|
let resolved_edited_by = trigger.base.resolve_edited_by(authed);
|
|
let resolved_permissioned_as = trigger.base.resolve_permissioned_as(authed);
|
|
let filters = trigger
|
|
.config
|
|
.filters
|
|
.into_iter()
|
|
.map(|v| SqlxJson(serde_json::value::to_raw_value(&v).unwrap()))
|
|
.collect_vec();
|
|
let initial_messages = trigger
|
|
.config
|
|
.initial_messages
|
|
.unwrap_or_default()
|
|
.into_iter()
|
|
.map(|v| SqlxJson(serde_json::value::to_raw_value(&v).unwrap()))
|
|
.collect_vec();
|
|
sqlx::query!(
|
|
r#"
|
|
INSERT INTO websocket_trigger (
|
|
workspace_id,
|
|
path,
|
|
url,
|
|
script_path,
|
|
is_flow,
|
|
mode,
|
|
filters,
|
|
filter_logic,
|
|
initial_messages,
|
|
url_runnable_args,
|
|
edited_by,
|
|
can_return_message,
|
|
can_return_error_result,
|
|
permissioned_as,
|
|
edited_at,
|
|
error_handler_path,
|
|
error_handler_args,
|
|
retry,
|
|
heartbeat
|
|
) VALUES (
|
|
$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, now(), $15, $16, $17, $18
|
|
)
|
|
"#,
|
|
w_id,
|
|
trigger.base.path,
|
|
trigger.config.url,
|
|
trigger.base.script_path,
|
|
trigger.base.is_flow,
|
|
trigger.base.mode() as _,
|
|
&filters as _,
|
|
trigger.config.filter_logic,
|
|
&initial_messages as _,
|
|
trigger
|
|
.config
|
|
.url_runnable_args
|
|
.map(|v| SqlxJson(serde_json::value::to_raw_value(&v).unwrap())) as _,
|
|
&resolved_edited_by,
|
|
trigger.config.can_return_message,
|
|
trigger.config.can_return_error_result,
|
|
resolved_permissioned_as,
|
|
trigger.error_handling.error_handler_path,
|
|
trigger.error_handling.error_handler_args as _,
|
|
trigger.error_handling.retry as _,
|
|
trigger.config.heartbeat.map(SqlxJson) as _
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
Ok(())
|
|
}
|
|
|
|
async fn update_trigger(
|
|
&self,
|
|
_db: &DB,
|
|
tx: &mut PgConnection,
|
|
authed: &ApiAuthed,
|
|
w_id: &str,
|
|
path: &str,
|
|
trigger: TriggerData<Self::TriggerConfigRequest>,
|
|
) -> Result<()> {
|
|
let resolved_edited_by = trigger.base.resolve_edited_by(authed);
|
|
let resolved_permissioned_as = trigger.base.resolve_permissioned_as(authed);
|
|
let filters = trigger
|
|
.config
|
|
.filters
|
|
.into_iter()
|
|
.map(|v| SqlxJson(serde_json::value::to_raw_value(&v).unwrap()))
|
|
.collect_vec();
|
|
let initial_messages = trigger
|
|
.config
|
|
.initial_messages
|
|
.unwrap_or_default()
|
|
.into_iter()
|
|
.map(|v| SqlxJson(serde_json::value::to_raw_value(&v).unwrap()))
|
|
.collect_vec();
|
|
|
|
// important to update server_id to NULL to stop current websocket listener
|
|
sqlx::query!(
|
|
"
|
|
UPDATE
|
|
websocket_trigger
|
|
SET
|
|
url = $1,
|
|
script_path = $2,
|
|
path = $3,
|
|
is_flow = $4,
|
|
filters = $5,
|
|
filter_logic = $6,
|
|
initial_messages = $7,
|
|
url_runnable_args = $8,
|
|
edited_by = $9,
|
|
permissioned_as = $10,
|
|
can_return_message = $11,
|
|
can_return_error_result = $12,
|
|
edited_at = now(),
|
|
server_id = NULL,
|
|
error = NULL,
|
|
error_handler_path = $15,
|
|
error_handler_args = $16,
|
|
retry = $17,
|
|
heartbeat = $18
|
|
WHERE
|
|
workspace_id = $13 AND path = $14
|
|
",
|
|
trigger.config.url,
|
|
trigger.base.script_path,
|
|
trigger.base.path,
|
|
trigger.base.is_flow,
|
|
filters.as_slice() as &[SqlxJson<Box<RawValue>>],
|
|
trigger.config.filter_logic,
|
|
initial_messages.as_slice() as &[SqlxJson<Box<RawValue>>],
|
|
trigger
|
|
.config
|
|
.url_runnable_args
|
|
.map(|v| SqlxJson(serde_json::value::to_raw_value(&v).unwrap()))
|
|
as Option<SqlxJson<Box<RawValue>>>,
|
|
&resolved_edited_by,
|
|
resolved_permissioned_as,
|
|
trigger.config.can_return_message,
|
|
trigger.config.can_return_error_result,
|
|
w_id,
|
|
path,
|
|
trigger.error_handling.error_handler_path,
|
|
trigger.error_handling.error_handler_args as _,
|
|
trigger.error_handling.retry as _,
|
|
trigger.config.heartbeat.map(SqlxJson) as _
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
|
|
Ok(())
|
|
}
|
|
|
|
async fn test_connection(
|
|
&self,
|
|
db: &DB,
|
|
authed: &ApiAuthed,
|
|
_user_db: &UserDB,
|
|
workspace_id: &str,
|
|
config: Self::TestConnectionConfig,
|
|
) -> Result<()> {
|
|
let url = &config.url;
|
|
|
|
let connect_url: Cow<str> = if url.starts_with("$") {
|
|
if url.starts_with("$flow:") || url.starts_with("$script:") {
|
|
let path = url.splitn(2, ':').nth(1).unwrap();
|
|
Cow::Owned(
|
|
get_url_from_runnable_value(
|
|
path,
|
|
url.starts_with("$flow:"),
|
|
&db,
|
|
authed.clone(),
|
|
config.url_runnable_args.as_ref().map(to_raw_value).as_ref(),
|
|
&workspace_id,
|
|
)
|
|
.await?,
|
|
)
|
|
} else {
|
|
return Err(Error::BadConfig(format!(
|
|
"Invalid WebSocket runnable path: {}",
|
|
url
|
|
)));
|
|
}
|
|
} else {
|
|
Cow::Borrowed(&url)
|
|
};
|
|
|
|
connect_async_with_proxy(&*connect_url)
|
|
.await
|
|
.map_err(|err| {
|
|
Error::BadConfig(format!(
|
|
"Error connecting to WebSocket: {}",
|
|
err.to_string()
|
|
))
|
|
})?;
|
|
|
|
Ok(())
|
|
}
|
|
}
|