mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-07 08:02:40 +00:00
Ruben FiszelandClaude Opus 4.8
cb8fa45114
- Validate the email claim with `windmill_common::users::VALID_EMAIL` (the `usr` table's own constraint) plus the 254-byte bound, rather than a hand-rolled predicate. It requires an `@`, which is what keeps a guest's name its own principal, never a `u/<user>` or `g/<group>`. - Reject an `app_path` claim carrying a scope metacharacter (`*`, `,`, `:`, whitespace) before authenticating: it is interpolated into `apps:read:<path>` and `apps:run:<path>`, where `*` or `,` would widen the guest past its one app. - `isJwt` on the custom-path route normalises base64url before `atob`, so a header carrying `-`/`_` (a `kid`, a signature) is recognised instead of taken for a path segment; it also checks the three-segment structure. - Drop the dead stale-key carry-forward in the blocking JWKS path (a stale-good entry is served by the fast path) and clean up the test's env var. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3
Windmill frontend
The Windmill frontend written in Svelte 5 + Tailwind CSS
The frontend is under AGPL, see the LICENSE file at the root of this repo