windmill

starred/windmill

Fork 0

mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-21 08:03:33 +00:00

Files

T

History

Ruben FiszelandClaude Opus 5.5 09a59110d9 fix: scope delete_jobs side-table deletes to the request workspace (#11836 )

* fix: scope delete_jobs side-table deletes to the request workspace

The /jobs/delete purge deleted resume_job, v2_job_runtime, v2_job_status
and concurrency_key rows by job id alone. Those tables have no
workspace_id, so a workspace admin could pass another workspace's job ids
and wipe its flow status, runtime, resume and concurrency rows. Scope
each delete through v2_job, as zombie_job_counter already is.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: filter delete_jobs ids to the workspace once

Resolve the request's job ids against v2_job up front and run every
delete on that filtered list, instead of repeating the v2_job subquery in
each side-table delete. The workspace scoping lives in one place and the
side-table deletes keep their plain id form.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-17 09:32:01 +02:00

concurrency_groups.rs

fix(security): a WM_TOKEN job token can never be a global superadmin (GHSA-hfh4-cx4h-3fcr) (#10124 )

2026-08-19 22:33:46 +02:00

execution.rs

feat: agents run on behalf of their deployer (#11430 )

2026-10-15 19:31:21 +02:00

job_metrics.rs

feat: restricted job tokens per script and flow (#11484 )

2026-10-03 09:33:44 +02:00

jobs_export.rs

fix: scope delete_jobs side-table deletes to the request workspace (#11836 )