mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-21 16:02:28 +00:00
6e56ce11db
The two paths derive the endpoint and the credential header independently, so a resource could authenticate in one and 401 in the other. A parity test pins them together across the provider/platform matrix and fails on each divergence below. - Anthropic base URLs were read differently: the proxy trimmed and re-appended `/v1` while the agent step appended `/messages` to the stored value, so a `.../anthropic` base worked in workspace settings and 404'd in an agent step. `build_anthropic_api_url` accepts both forms for both paths, and the URL no longer depends on the client-supplied `X-Anthropic-SDK` header, which is gone. - A base URL stored with a trailing slash doubled it in an agent step. - An OpenAI resource pointed at Azure got Azure's URL layout and `api-key` header from the proxy but bearer auth and the plain path from the agent step, where `OpenAIQueryBuilder` ignored `is_azure`. - The agent step sent an empty credential when the resource had no api key, where the proxy sends none at all. `retain_effective_credentials` gives both the same rule, so an endpoint that authenticates another way still works. - An OAuth resource cannot resolve to a token in a worker: there is no client credentials exchange there, so it now fails with that reason unless it carries the credential header its provider reads. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Windmill Worker
The worker. Used to process and execute flows & jobs.
This crate exposes both a library as well as a binary target.