mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-19 08:03:16 +00:00
hugocasaandClaude Opus 5
f329edaf98
`authed.folders` is a snapshot cached alongside the caller's token, so a grant made after it was cached denies a script the caller can legitimately read: the folder created by the deploy they are being redirected from, or one an admin has just added them to. Enforcing RLS on the by-hash reads without accounting for that would reintroduce the staleness the privileged-pool shortcut was papering over. Resolve the path first and refresh group and folder membership from the database before running the read under RLS. The existence probe the miss path already did now comes from that same lookup, so the denial path is a query cheaper. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise