mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-16 08:03:02 +00:00
e277735788
* feat: count OIDC signatures and reuse server-side tokens Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee ref Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee ref Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee ref Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to cbda28f632d773fd44e9bef8bea36dcb5e35b55d This commit updates the EE repository reference after PR #847 was merged in windmill-ee-private. Previous ee-repo-ref: cec12fc52eb1bb5d3f4f4ae489d86a64e96c6c0c New ee-repo-ref: cbda28f632d773fd44e9bef8bea36dcb5e35b55d Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
128 lines
3.4 KiB
Rust
128 lines
3.4 KiB
Rust
#[cfg(feature = "private")]
|
|
#[allow(unused)]
|
|
pub use crate::oidc_ee::*;
|
|
|
|
/*
|
|
* Author: Ruben Fiszel
|
|
* Copyright: Windmill Labs, Inc 2023
|
|
* This file and its contents are licensed under the AGPLv3 License.
|
|
* Please see the included NOTICE for copyright information and
|
|
* LICENSE-AGPL for a copy of the license.
|
|
*/
|
|
|
|
#[cfg(not(feature = "private"))]
|
|
use serde::{Deserialize, Serialize};
|
|
#[cfg(not(feature = "private"))]
|
|
use tokio::sync::RwLock;
|
|
#[cfg(all(
|
|
feature = "enterprise",
|
|
feature = "openidconnect",
|
|
not(feature = "private")
|
|
))]
|
|
use {
|
|
crate::db::DB,
|
|
crate::{
|
|
auth::IdToken as WindmillIdToken,
|
|
error::{Error, Result},
|
|
},
|
|
anyhow,
|
|
};
|
|
|
|
#[cfg(all(feature = "openidconnect", not(feature = "private")))]
|
|
use openidconnect::AdditionalClaims;
|
|
|
|
#[cfg(all(feature = "openidconnect", not(feature = "private")))]
|
|
impl AdditionalClaims for JobClaim {}
|
|
|
|
#[cfg(all(feature = "openidconnect", not(feature = "private")))]
|
|
impl AdditionalClaims for WorkspaceClaim {}
|
|
|
|
#[cfg(all(feature = "openidconnect", not(feature = "private")))]
|
|
impl AdditionalClaims for InstanceClaim {}
|
|
|
|
#[derive(Clone, Debug, Default, Deserialize, PartialEq, Eq, Serialize)]
|
|
#[cfg(not(feature = "private"))]
|
|
pub struct WorkspaceClaim {
|
|
pub workspace: String,
|
|
}
|
|
|
|
#[derive(Clone, Debug, Default, Deserialize, PartialEq, Eq, Serialize)]
|
|
#[cfg(not(feature = "private"))]
|
|
pub struct InstanceClaim {}
|
|
|
|
#[derive(Clone, Debug, Default, Deserialize, PartialEq, Eq, Serialize)]
|
|
#[cfg(not(feature = "private"))]
|
|
pub struct JobClaim {
|
|
pub job_id: String,
|
|
pub path: Option<String>,
|
|
pub flow_path: Option<String>,
|
|
pub groups: Vec<String>,
|
|
pub username: String,
|
|
pub email: String,
|
|
pub workspace: String,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
pub fork_parent_workspace: Option<String>,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
pub end_user_email: Option<String>,
|
|
pub job_kind: String,
|
|
pub deployed: bool,
|
|
pub root_job_id: String,
|
|
pub root_path: Option<String>,
|
|
pub root_job_kind: String,
|
|
pub root_trigger_kind: Option<String>,
|
|
pub root_trigger: Option<String>,
|
|
pub latest: bool,
|
|
pub version: Option<String>,
|
|
pub root_version: Option<String>,
|
|
pub digest: Option<String>,
|
|
pub root_digest: Option<String>,
|
|
pub tag: String,
|
|
pub worker_group: Option<String>,
|
|
pub run_as_type: String,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
pub job_token_scopes: Option<Vec<String>>,
|
|
pub jti: String,
|
|
}
|
|
|
|
#[cfg(not(feature = "private"))]
|
|
lazy_static::lazy_static! {
|
|
static ref PRIVATE_KEY: RwLock<Option<String>> = RwLock::new(None);
|
|
}
|
|
|
|
#[cfg(not(feature = "private"))]
|
|
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
|
|
pub enum OidcCaller {
|
|
JobMint,
|
|
S3Instance,
|
|
S3Workspace,
|
|
Vault,
|
|
Sqs,
|
|
Bedrock,
|
|
}
|
|
|
|
#[cfg(not(feature = "private"))]
|
|
pub async fn generate_id_token<T: AdditionalClaims>(
|
|
_caller: OidcCaller,
|
|
_db: Option<&DB>,
|
|
_claim: T,
|
|
_audience: &str,
|
|
_identifier: String,
|
|
_email: Option<String>,
|
|
_expires_in: Option<i64>,
|
|
) -> Result<WindmillIdToken> {
|
|
Err(Error::internal_err(
|
|
"Not implemented in Windmill's Open Source repository".to_string(),
|
|
))
|
|
}
|
|
|
|
#[cfg(all(
|
|
feature = "enterprise",
|
|
feature = "openidconnect",
|
|
not(feature = "private")
|
|
))]
|
|
pub async fn get_private_key(_db: Option<&DB>) -> anyhow::Result<String> {
|
|
Err(anyhow::anyhow!(
|
|
"Not implemented in Windmill's Open Source repository"
|
|
))
|
|
}
|