mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-15 16:03:02 +00:00
d493eff237
* feat: refuse unscoped tokens of restricted jobs, add OIDC scopes claim Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep restricted job_perms rows by a stamp that survives retention Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: log refused unscoped job tokens at warn Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: key the unrestricted cache by token, keep restricted rows on bulk delete Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: clear a sweep stamp raced onto a queued job Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: stamp restricted job_perms rows under a row lock Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test: give the memo test's job token scopes Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: keep only the OIDC claim, drop the server-side refusal A relying party can already tell a restricted job from the claim, which is absent when the presented token carries no scopes. The auth-layer refusal, its lookup cache and the job_perms retention it needed are removed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 065c2c64c3904d5c0b2766b424210d34f9e54d2d This commit updates the EE repository reference after PR #845 was merged in windmill-ee-private. Previous ee-repo-ref: ea5354477cdf281598a816a5e16ad1f476d42afb New ee-repo-ref: 065c2c64c3904d5c0b2766b424210d34f9e54d2d Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise