mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-07 08:02:40 +00:00
46eca13282
* fix: carry the validated token endpoint with MCP OAuth credentials get_or_refresh_mcp_client already resolved and checked the token endpoint on both its cached and freshly-registered paths, then dropped the result. Keeping it on McpClientCredentials lets the callers that post the client_secret there connect to the address that was checked, and removes a second lookup they were each doing on their own. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor: hand out the token URL with the client pinned to it Makes the pin unrepresentable-if-wrong rather than documented: the validated target is private and reachable only through token_request, which returns the URL together with the client pinned to the address it was checked against, so a caller cannot pin one host and post to another. Adds the test that was missing under the whole guard: that the pinned client really does connect to the pinned address instead of resolving the host. The accept loop is bounded, so a pin that stops working fails in seconds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: keep the token endpoint private behind token_request Leaving the URL public still allowed posting the client_secret to it on an unpinned client, so the invariant was only documented. Both the URL and its validated target are now private and reachable together, and the pinning test resets the accepted socket to blocking so it does not read empty on macOS. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test: drop the non-blocking reset from the pinning test Linux hands back a blocking socket from accept regardless of the listener's flag, and no runner here builds this crate for a platform that does otherwise. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to f8d523195e40fd1d740595dcab6ce5cdc1bdbf09 This commit updates the EE repository reference after PR #718 was merged in windmill-ee-private. Previous ee-repo-ref: 729df45314c6f2168b44eddb6edea401b0495d6d New ee-repo-ref: f8d523195e40fd1d740595dcab6ce5cdc1bdbf09 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise