Ruben Fiszel 7ec56ef619 fix: require auth on GET /concurrency_groups/{job_id}/key (#10221) ...

The /concurrency_groups global service is registered after the router's
.route_layer(from_extractor::<ApiAuthed>()), and Axum's route_layer only
wraps routes present at the call site, so this handler was left with no
router-level auth. Unlike its siblings list_concurrency_groups and
prune_concurrency_group, get_concurrency_key declared no ApiAuthed
parameter, so GET /api/concurrency_groups/{job_id}/key was reachable
unauthenticated and would return concurrency keys (which can embed
workspace ids, script/flow paths, and $args-templated argument values)
for arbitrary jobs instance-wide.

Add _authed: ApiAuthed so the extractor independently enforces
authentication regardless of layer placement, matching the
defense-in-depth pattern of the sibling handlers.

Fixes WIN-2212

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-21 07:08:16 +02:00

..

src

fix: require auth on GET /concurrency_groups/{job_id}/key (#10221)

2026-07-21 07:08:16 +02:00

Cargo.toml

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00