mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-18 16:02:10 +00:00
Ruben Fiszel
c69f08073a
* fix: expose apps:run in the token scope picker and let apps:write grant it Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: confine path-scoped app run/write tokens to the app they name Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: let apps:run read back its own app's S3 files, condense scope comments Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: let apps:write mint apps:run and extend run read-back to app S3 display routes Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: drop stale embed-token wording from the app S3 helper summary Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
50 lines
3.5 KiB
SQL
50 lines
3.5 KiB
SQL
-- Fixture for the app component preview authorization regression test.
|
|
-- Layered on top of `base` (which provides test-workspace, the admin
|
|
-- `test-user`/SECRET_TOKEN, and the non-operator `test-user-2`/SECRET_TOKEN_2).
|
|
-- Adds an Operator member so we can assert that Operators cannot reach the
|
|
-- arbitrary-code app preview path (`force_viewer_static_fields` + `raw_code`).
|
|
|
|
INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
|
|
VALUES ('operator@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Operator User');
|
|
|
|
INSERT INTO usr(workspace_id, email, username, is_admin, operator, role) VALUES
|
|
('test-workspace', 'operator@windmill.dev', 'operator-user', false, true, 'Operator');
|
|
|
|
INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin) VALUES
|
|
(encode(sha256('OPERATOR_TOKEN'::bytea), 'hex'), 'OPERATOR_T', 'OPERATOR_TOKEN', 'operator@windmill.dev', 'operator token', false);
|
|
|
|
-- A non-operator token scoped to `apps:run` but NOT `jobs:run`. It can reach
|
|
-- the `apps_u/execute_component` route (route maps to the `apps` scope domain)
|
|
-- but must not be able to enqueue arbitrary preview `raw_code`.
|
|
INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin, scopes) VALUES
|
|
(encode(sha256('APPS_RUN_TOKEN'::bytea), 'hex'), 'APPS_RUN_T', 'APPS_RUN_TOKEN', 'test2@windmill.dev', 'apps:run scoped token', false, '{apps:run}');
|
|
|
|
-- Path-qualified app scopes, as the token scope picker mints them. Both must be
|
|
-- confined to `u/test-user/vapp` on the execution route (`apps:write` covers run
|
|
-- for the same app, never for another one).
|
|
INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin, scopes) VALUES
|
|
(encode(sha256('APPS_RUN_VAPP_TOKEN'::bytea), 'hex'), 'APPS_RUN_V', 'APPS_RUN_VAPP_TOKEN', 'test2@windmill.dev', 'apps:run path-scoped token', false, '{apps:run:u/test-user/vapp}'),
|
|
(encode(sha256('APPS_WRITE_VAPP_TOKEN'::bytea), 'hex'), 'APPS_WRIT_', 'APPS_WRITE_VAPP_TOKEN', 'test2@windmill.dev', 'apps:write path-scoped token', false, '{apps:write:u/test-user/vapp}');
|
|
|
|
-- A private app owned by `test-user` with a persisted inline script. Used to
|
|
-- assert that `test-user-2` cannot preview-execute another app's app_script id.
|
|
INSERT INTO app (id, workspace_id, path, summary, policy, versions) VALUES
|
|
(999001, 'test-workspace', 'u/test-user/private', 'private app', '{}'::jsonb, '{}');
|
|
INSERT INTO app_script (id, app, hash, code, code_sha256) VALUES
|
|
(999777, 999001, repeat('a', 64), 'export function main(){ return "secret" }', repeat('b', 64));
|
|
|
|
-- An app owned by `test-user-2` with its own persisted inline script, to assert
|
|
-- the id-ownership check does not over-block a legitimate persisted preview.
|
|
INSERT INTO app (id, workspace_id, path, summary, policy, versions) VALUES
|
|
(999002, 'test-workspace', 'u/test-user-2/ownapp', 'own app', '{}'::jsonb, '{}');
|
|
INSERT INTO app_script (id, app, hash, code, code_sha256) VALUES
|
|
(999778, 999002, repeat('c', 64), 'export function main(){ return "ok" }', repeat('d', 64));
|
|
|
|
-- A deployed empty Viewer-mode app owned by `test-user` with NO runnables pinned
|
|
-- in `triggerables_v2`. Used to assert run mode rejects caller-supplied inline
|
|
-- `raw_code` whose sha is not publisher-pinned (the CVE-2026-22683 residual:
|
|
-- the Viewer default fallback let any caller / an operator run arbitrary code).
|
|
INSERT INTO app (id, workspace_id, path, summary, policy, versions) VALUES
|
|
(999003, 'test-workspace', 'u/test-user/vapp', 'empty viewer app',
|
|
'{"execution_mode": "viewer", "triggerables_v2": {}}'::jsonb, '{}');
|