Ruben Fiszel 91e1b087a2 feat(auth): add runtime NO_AUTH mode for authentication bypass (#9962) ...

* feat(auth): add runtime NO_AUTH mode for authentication bypass

Adds a runtime `NO_AUTH` env flag that makes every request resolve as the
`admin@windmill.dev` superadmin with no login required, so self-hosted
deployments can front Windmill with their own authenticating gateway
without building a dedicated `oss` (compile-time `no_auth`) binary.

- `NO_AUTH` is honored in any build but is force-disabled when
  `CLOUD_HOSTED` is set, so the managed cloud always enforces real auth.
- The existing compile-time `no_auth` feature keeps its always-on behavior
  (`cfg!(feature = "no_auth") || *NO_AUTH`), so `oss` builds are unchanged.
- `Tokened` now yields a synthetic token in no-auth mode so handlers that
  require it (e.g. global_whoami, called by the frontend on load) resolve.
- A loud startup banner warns when the mode is on; `HIDE_NO_AUTH_BANNER`
  silences it once the operator has deliberately deployed behind a gateway.

Fixes WIN-2131

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(auth): dismissable NO_AUTH warning banner via global setting

Replaces the HIDE_NO_AUTH_BANNER env flag with a UI warning banner that
can be permanently dismissed for all users from within the running
instance (not exposed in instance settings).

- New `no_auth_banner_dismissed` global setting, only ever written by
  dismissing the banner itself.
- `GET /api/settings/no_auth_banner` returns whether to show the banner
  (true only when NO_AUTH is active and it hasn't been dismissed).
- NoAuthBanner.svelte renders a top-of-app warning in NO_AUTH mode; its
  dismiss button opens a confirmation modal, then writes the global
  setting via the existing setGlobal endpoint so it stays hidden for
  everyone.
- The server still logs the startup NO_AUTH warning unconditionally.

Fixes WIN-2131

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(auth): resolve NO_AUTH in AuthCache so all_runnables works

Codex/Pi review flagged that `/api/users/all_runnables` still failed in
NO_AUTH mode: `get_all_runnables` extracts `Tokened` and re-validates the
request token per workspace via `AuthCache::get_authed`, which rejected the
fabricated `"no_auth"` token (no matching DB row) with a 400.

Short-circuit `AuthCache::get_opt_job_authed` (the resolver behind
`get_authed`) to the admin superadmin in no-auth mode, so any direct cache
caller resolves without a real token. Single-source the mode check and the
synthetic identity via `is_no_auth()` / `no_auth_admin_authed()` and reuse
them across the extractor, resolver, and login paths.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* revert(auth): drop the NO_AUTH dismissable UI banner

The in-app banner added a GET /api/settings/no_auth_banner request to every
instance load for little benefit. The startup log warning already surfaces
that auth is bypassed to operators, so drop the banner, its endpoint, and the
no_auth_banner_dismissed global setting entirely.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-06 17:02:51 +00:00

..

src

feat(auth): add runtime NO_AUTH mode for authentication bypass (#9962)

2026-07-06 17:02:51 +00:00

Cargo.toml

rate limit token creation on CLOUD_HOSTED (10/min per user) (#8664)

2026-04-02 01:52:02 +00:00