mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-06 16:02:23 +00:00
* feat: bind WAC approval urls to a named wait_for_approval step Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: reject duplicate WAC approval step keys instead of renaming them Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: reject WAC approval links minted for a step that is not awaiting approval Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: bind WAC approval links to the awaiting step and stop step key aliasing Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: reject empty approval keys and scope minted-key writes to the workspace Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: enforce WAC approval binding at consumption and reject colliding keys Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: make WAC approval binding and collision checks atomic, harden TS step keys Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: decrement WAC suspend atomically instead of from a pre-lock snapshot Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore: add sqlx cache entry for the atomic WAC suspend decrement Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: omit empty approver param from python get_approval_urls Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test: pin the suspend-snapshot decrement and the colliding-mint race Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test: drop the suspend-snapshot interleave test, it cannot both be stable and discriminate Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: reject step keys that cannot be minted as a URL path segment Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
24 lines
1.4 KiB
SQL
24 lines
1.4 KiB
SQL
-- A Workflow-as-Code job in the queue, suspended on a wait_for_approval step
|
|
-- (see tests/wac_approval_urls.rs). WAC parents are plain script jobs with no
|
|
-- parent_job, which is what makes get_flow_info_for_resume treat them as WAC.
|
|
INSERT INTO public.v2_job (
|
|
id, workspace_id, created_by, created_at, permissioned_as, permissioned_as_email,
|
|
kind, script_lang, runnable_path, tag, visible_to_owner
|
|
) VALUES (
|
|
'a1a1a1a1-a1a1-a1a1-a1a1-a1a1a1a1a1a1', 'test-workspace', 'test-user',
|
|
'2023-01-01 00:00:00', 'u/test-user', 'test@windmill.dev',
|
|
'script', 'bun', 'u/test-user/wac_workflow', 'bun', true
|
|
);
|
|
INSERT INTO public.v2_job_queue (id, workspace_id, scheduled_for, running, suspend, tag) VALUES
|
|
('a1a1a1a1-a1a1-a1a1-a1a1-a1a1a1a1a1a1', 'test-workspace', '2023-01-01 00:00:00', true, 1, 'bun');
|
|
|
|
-- A second workspace the caller also administers, so a cross-workspace mint is
|
|
-- rejected by the job's workspace check rather than by workspace authorization.
|
|
INSERT INTO workspace (id, name, owner) VALUES
|
|
('test-workspace-2', 'test-workspace-2', 'test-user');
|
|
INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
|
|
('test-workspace-2', 'test@windmill.dev', 'test-user', true, 'Admin');
|
|
INSERT INTO workspace_key(workspace_id, kind, key) VALUES
|
|
('test-workspace-2', 'cloud', 'test-key-2');
|
|
INSERT INTO workspace_settings (workspace_id) VALUES ('test-workspace-2');
|