mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-21 16:02:36 +00:00
Diego ImbertandClaude Opus 5
22b3e69c07
A data table backed by the instance database resolved to exactly one Postgres connection, `custom_instance_user`, for everyone who could reach it at all. There was no way to say this job reads, that one writes, this one never sees the salaries table. A data table role is now a real Postgres login on the cluster, defined once for the instance by a superadmin and named exactly as they named it. A script that declares `-- role analytics` connects as `analytics`, and Postgres decides what it may touch — grants are ordinary SQL. Windmill answers only "may this caller ask for this role", from the tenant lists on the data table entry: `u/alice`, `g/analysts`, `f/finance` or `*`. A data table with no `permissions` block behaves exactly as before. Everything that opens a connection on someone's behalf goes through one chokepoint, `get_datatable_resource_from_db`, which takes the identity explicitly and fails closed when there is none. The role logs in as itself — never `SET ROLE`, which a script could `RESET ROLE` its way out of. A fork's data table entry becomes a pointer at the workspace that governs it rather than a copy of it. The settings clone used to hand a fork a byte-identical entry naming the parent's database, which a fork admin could edit to grant themselves `admin` there; a pointer has nothing local to edit, and its tenants are evaluated as a member of the governing workspace, by email. `permissions` is stripped from the workspace export and ignored on import: tenants name principals of one workspace, and a settings push is not where an access decision should be made. Operations that see the whole database whatever the roles grant stay with the governing workspace's admins: editing the roles, a migration that declares none, and opening a replication stream for a Postgres trigger or capture. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012ti5HyeTikPMYyW8YSdiHR
42 lines
1.1 KiB
TOML
42 lines
1.1 KiB
TOML
[package]
|
|
name = "windmill-api-settings"
|
|
version.workspace = true
|
|
authors.workspace = true
|
|
edition.workspace = true
|
|
|
|
[lib]
|
|
name = "windmill_api_settings"
|
|
path = "src/lib.rs"
|
|
|
|
[features]
|
|
default = []
|
|
enterprise = ["license"]
|
|
private = ["windmill-common/private", "windmill-audit/private"]
|
|
parquet = ["windmill-common/parquet", "windmill-object-store/parquet"]
|
|
license = ["dep:rsa"]
|
|
|
|
[dependencies]
|
|
windmill-ai = { workspace = true, default-features = false }
|
|
windmill-alerting.workspace = true
|
|
windmill-api-auth.workspace = true
|
|
windmill-audit.workspace = true
|
|
windmill-common = { workspace = true, default-features = false }
|
|
axum.workspace = true
|
|
anyhow.workspace = true
|
|
bytes.workspace = true
|
|
chrono.workspace = true
|
|
futures.workspace = true
|
|
lazy_static.workspace = true
|
|
regex.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
serde_yml.workspace = true
|
|
sqlx.workspace = true
|
|
tokio.workspace = true
|
|
tracing.workspace = true
|
|
uuid.workspace = true
|
|
base64.workspace = true
|
|
sha2.workspace = true
|
|
rsa = { workspace = true, optional = true }
|
|
windmill-object-store.workspace = true
|