mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-06 00:02:13 +00:00
Diego ImbertandClaude Opus 5
9580e9985a
`admin` has no login to swap in — it is the data table's own connection — so the check that the data table still points where its roles live sat inside the branch that swaps credentials and never ran for it. A caller granted `admin` was handed whatever the resource pointed at, which is the case the record exists for: the guards on the resource can be gone around through a `$var:` or a concurrent enable. It runs for every permissioned data table now, whatever role the caller lands on, and only for callers with an identity — the machinery that repairs a moved data table resolves as admin and has to keep working, which is what re-saving its permissions does. The disabled schema toggle's tooltip names the specific refusal first, like the hint beside it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S5arH3G2Sa1Qqm32veJQ1n
Windmill frontend
The Windmill frontend written in Svelte 5 + Tailwind CSS
The frontend is under AGPL, see the LICENSE file at the root of this repo