mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-05 16:03:47 +00:00
Ruben FiszelandClaude Fable 5.1
9b64a89cd4
* fix: let operators use wmill.datatable() from within running jobs Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RHR4fytgt6m4q37WCXs2Rp * fix: refuse content-driven redirects and deferral in the operator datatable exemption * fix: check the datatable exemption against the expanded query, not the raw content * fix: fail closed on a language-overriding expansion and state the exemption's real scope --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
25 lines
1.7 KiB
SQL
25 lines
1.7 KiB
SQL
-- Fixture for the inline preview authorization regression test (GHSA-pp5h-96x3-3wqq).
|
|
-- Layered on top of `base` (which provides test-workspace and the non-operator
|
|
-- `test-user-2`/SECRET_TOKEN_2). Adds an Operator member so we can assert that
|
|
-- Operators cannot reach the arbitrary-code inline preview path
|
|
-- (`POST /jobs/run_inline/preview`) with their own token, plus two deployed script
|
|
-- jobs of the operator: one running, so we can assert that its WM_TOKEN can, and
|
|
-- one queued but not yet pulled, so we can assert that "queued" is not enough.
|
|
|
|
INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
|
|
VALUES ('operator@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Operator User');
|
|
|
|
INSERT INTO usr(workspace_id, email, username, is_admin, operator, role) VALUES
|
|
('test-workspace', 'operator@windmill.dev', 'operator-user', false, true, 'Operator');
|
|
|
|
INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin) VALUES
|
|
(encode(sha256('OPERATOR_TOKEN'::bytea), 'hex'), 'OPERATOR_T', 'OPERATOR_TOKEN', 'operator@windmill.dev', 'operator token', false);
|
|
|
|
INSERT INTO v2_job(id, workspace_id, kind, runnable_path, created_by, permissioned_as, permissioned_as_email) VALUES
|
|
('2aa0c0de-0000-4000-8000-000000000001', 'test-workspace', 'script', 'u/test-user/deployed', 'operator-user', 'u/operator-user', 'operator@windmill.dev'),
|
|
('2aa0c0de-0000-4000-8000-000000000002', 'test-workspace', 'script', 'u/test-user/deployed', 'operator-user', 'u/operator-user', 'operator@windmill.dev');
|
|
|
|
INSERT INTO v2_job_queue(id, workspace_id, scheduled_for, running) VALUES
|
|
('2aa0c0de-0000-4000-8000-000000000001', 'test-workspace', now(), true),
|
|
('2aa0c0de-0000-4000-8000-000000000002', 'test-workspace', now(), false);
|