Ruben FiszelandClaude Opus 4.8 cb8fa45114 fix: reuse VALID_EMAIL, guard app_path, accept base64url JWT headers ...

- Validate the email claim with `windmill_common::users::VALID_EMAIL` (the `usr`
  table's own constraint) plus the 254-byte bound, rather than a hand-rolled
  predicate. It requires an `@`, which is what keeps a guest's name its own
  principal, never a `u/<user>` or `g/<group>`.
- Reject an `app_path` claim carrying a scope metacharacter (`*`, `,`, `:`,
  whitespace) before authenticating: it is interpolated into `apps:read:<path>`
  and `apps:run:<path>`, where `*` or `,` would widen the guest past its one app.
- `isJwt` on the custom-path route normalises base64url before `atob`, so a
  header carrying `-`/`_` (a `kid`, a signature) is recognised instead of taken
  for a path segment; it also checks the three-segment structure.
- Drop the dead stale-key carry-forward in the blocking JWKS path (a stale-good
  entry is served by the fast path) and clean up the test's env var.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

2026-09-03 16:54:36 +00:00

..

examples

fix: enrich OTEL log records with per-request LogContext (#8812)

2026-04-13 21:50:50 +00:00

src

fix: reuse VALID_EMAIL, guard app_path, accept base64url JWT headers

2026-09-03 16:54:36 +00:00

tests

fix: let a principal without a login account own a draft (#10925)

2026-09-01 23:42:08 +02:00

Cargo.toml

fix: datatable full schema hangs behind a transaction-pooling postgres proxy (#10352)

2026-07-27 12:32:44 +02:00