mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-07 00:01:49 +00:00
Ruben FiszelandClaude Opus 4.8
e2c6e659ea
- Gate the audit with a conditional upsert (`DO UPDATE ... WHERE NOT guest_activity.jwt_entry RETURNING 1`) read with fetch_optional. The row comes back exactly once per email per day, decided by the conflicting tuple, so it keeps the atomicity `xmax = 0` had (no double audit when two first requests race on a metered instance, which takes no advisory lock) and still fires on the first JWT after an IdP sign-in created today's row. The prior CTE decided this from the statement snapshot and could double-audit. - Negative-cache only a real allowance refusal (`PermissionDenied`); a transient DB error inside guest_admission denies this request but no longer locks the email out for 30 seconds. - Refuse a JWKS key whose `key_ops` is present and omits `verify`: it is published for something other than signature verification. Unit-tested. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise