mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-25 00:01:55 +00:00
Ruben Fiszel
6e9e0de481
A workspace setting that lets every operator of that workspace compose flows and full-code apps out of runnables that already exist, without authoring code. Operators of such a workspace consume a full seat instead of half a seat. The operator boundary stays where it was: authoring code and running arbitrary code. Builder rights do not move it, they only let an operator assemble what is already deployed. Backend: - `builder` on `operator_settings` (no migration), read through a cached `operator_builder_enabled`; `check_operator_can_build` is the gate helper. - `check_flow_is_composition_only` walks the whole flow value (modules, preprocessor, failure module, branches, AI agent tools) and refuses inline code, hoisted flow-node references, hub runnables and resource-linked AI agents, then returns the worker tags its steps pin so the caller can authorize them. Runs on every write AND every preview: `run_preview_flow_job` and `push_flow_dependencies_job` both take a caller-supplied flow value. - Raw apps: `create_app_raw` / `update_app_raw` open, `*_raw_source` stays shut (it compiles caller-supplied sources with a bundler job on a worker). `check_operator_composed_app` refuses inline scripts anywhere in the app value and forces `policy.sandbox`, so a bundle nobody reviewed cannot borrow the viewer's Windmill session. - Low-code apps, scripts, script previews and dependency jobs stay closed. Frontend: the flow editor and raw app editor open for builders, with every affordance that authors code removed (inline languages, hub browser, AI builders, script edit/fork, the inline starter runnable). Fixes a separate bug: `can_preserve_on_behalf_of` granted preservation to anyone in `wm_deployers`, a group a group owner can grant, so an operator could edit a runnable while keeping it pointed at its original admin author. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>