windmill-cli 1.701.0 → 1.702.0

package/esm/main.js

@@ -16752,7 +16752,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.701.0",
+    VERSION: "1.702.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -47151,7 +47151,7 @@ async function downloadZip(workspace, plainSecrets, skipVariables, skipResources
     }
   }
   const includeWorkspaceDependenciesValue = !(skipWorkspaceDependencies ?? false);
-  const baseParams = `&plain_secret=${plainSecrets ?? false}&skip_variables=${skipVariables ?? false}&skip_resources=${skipResources ?? false}&skip_secrets=${skipSecrets ?? false}&include_schedules=${includeSchedules ?? false}&include_triggers=${includeTriggers ?? false}&include_users=${includeUsers ?? false}&include_groups=${includeGroups ?? false}&include_settings=${includeSettings ?? false}&include_key=${includeKey ?? false}&include_workspace_dependencies=${includeWorkspaceDependenciesValue}&default_ts=${defaultTs ?? "bun"}&skip_resource_types=${skipResourceTypes ?? false}&settings_version=v2`;
+  const baseParams = `&plain_secret=${plainSecrets ?? false}&skip_variables=${skipVariables ?? false}&skip_resources=${skipResources ?? false}&skip_secrets=${skipSecrets ?? false}&include_schedules=${includeSchedules ?? false}&include_triggers=${includeTriggers ?? false}&include_users=${includeUsers ?? false}&include_groups=${includeGroups ?? false}&include_settings=${includeSettings ?? false}&include_key=${includeKey ?? false}&include_workspace_dependencies=${includeWorkspaceDependenciesValue}&default_ts=${defaultTs ?? "bun"}&skip_resource_types=${skipResourceTypes ?? false}&settings_version=v2&preserve_extra_perms=true`;
   const baseUrl2 = workspace.remote + "api/w/" + workspace.workspaceId + "/workspaces/tarball?";
   const zipUrl = baseUrl2 + "archive_type=zip" + baseParams;
   const zipResponse = await fetch(zipUrl, { headers: requestHeaders, method: "GET" });
@@ -61584,6 +61584,109 @@ var require_dist3 = __commonJS((exports) => {
   __exportStar2(require_validation3(), exports);
 });
 
+// src/core/extra_perms.ts
+function normalize5(value, source) {
+  const perms = {};
+  const invalidOwners = new Set;
+  if (value === null || value === undefined || typeof value !== "object" || Array.isArray(value)) {
+    if (value !== undefined && value !== null) {
+      error(colors.red(`extra_perms: ${source} is not a {owner: boolean} map — skipping ACL sync to avoid clobbering remote ACLs`));
+      return { perms, invalidOwners, malformedTop: true };
+    }
+    return { perms, invalidOwners, malformedTop: false };
+  }
+  const invalidList = [];
+  for (const [k, v] of Object.entries(value)) {
+    if (typeof v === "boolean") {
+      perms[k] = v;
+    } else {
+      invalidOwners.add(k);
+      invalidList.push(k);
+    }
+  }
+  if (invalidList.length > 0) {
+    error(colors.red(`extra_perms: ${invalidList.length} invalid entry/entries in ${source} (non-boolean value, treating as "no opinion"): ${invalidList.join(", ")}`));
+  }
+  return { perms, invalidOwners, malformedTop: false };
+}
+function formatError(e) {
+  if (!e || typeof e !== "object")
+    return String(e);
+  const anyE = e;
+  if (anyE.body !== undefined) {
+    if (typeof anyE.body === "string")
+      return anyE.body;
+    try {
+      return JSON.stringify(anyE.body);
+    } catch {}
+  }
+  if (typeof anyE.message === "string")
+    return anyE.message;
+  try {
+    return JSON.stringify(e);
+  } catch {
+    return String(e);
+  }
+}
+async function applyExtraPermsDiff(workspace, kind, path7, local, remote) {
+  if (local === undefined || local === null) {
+    return 0;
+  }
+  const localN = normalize5(local, "local yaml");
+  if (localN.malformedTop) {
+    return 0;
+  }
+  const remoteN = normalize5(remote, "remote response");
+  const localPerms = localN.perms;
+  const remotePerms = remoteN.perms;
+  const toGrant = [];
+  for (const [owner, write] of Object.entries(localPerms)) {
+    if (!(owner in remotePerms) || remotePerms[owner] !== write) {
+      toGrant.push([owner, write]);
+    }
+  }
+  const toRevoke = Object.keys(remotePerms).filter((owner) => !(owner in localPerms) && !localN.invalidOwners.has(owner));
+  if (toGrant.length === 0 && toRevoke.length === 0) {
+    return 0;
+  }
+  let calls = 0;
+  for (const [owner, write] of toGrant) {
+    const access = write ? "write" : "read";
+    try {
+      await addGranularAcls({
+        workspace,
+        kind,
+        path: path7,
+        requestBody: { owner, write }
+      });
+      info(colors.green(`  extra_perms: granted ${access} to ${owner} on ${kind}/${path7}`));
+      calls += 1;
+    } catch (e) {
+      error(colors.red(`  extra_perms: failed to grant ${access} to ${owner} on ${kind}/${path7}: ${formatError(e)}`));
+    }
+  }
+  for (const owner of toRevoke) {
+    try {
+      await removeGranularAcls({
+        workspace,
+        kind,
+        path: path7,
+        requestBody: { owner }
+      });
+      info(colors.green(`  extra_perms: revoked ${owner} on ${kind}/${path7}`));
+      calls += 1;
+    } catch (e) {
+      error(colors.red(`  extra_perms: failed to revoke ${owner} on ${kind}/${path7}: ${formatError(e)}`));
+    }
+  }
+  return calls;
+}
+var init_extra_perms = __esm(() => {
+  init_services_gen();
+  init_log();
+  init_colors2();
+});
+
 // src/core/specific_items.ts
 async function resolveWsNameForGitBranch(branchName) {
   const config = await readConfigFile({ warnIfMissing: false });
@@ -62451,6 +62554,7 @@ async function handleFile(path8, workspace, alreadySynced, message, opts, rawWor
         if (typed == undefined || typed.description === remote.description && typed.summary === remote.summary && typed.kind == remote.kind && !remote.archived && (Array.isArray(remote?.lock) ? remote?.lock?.join(`
 `) : remote?.lock ?? "").trim() == (typed?.lock ?? "").trim() && deepEqual(typed.schema, remote.schema) && typed.tag == remote.tag && (typed.ws_error_handler_muted ?? false) == remote.ws_error_handler_muted && typed.dedicated_worker == remote.dedicated_worker && typed.cache_ttl == remote.cache_ttl && typed.concurrency_time_window_s == remote.concurrency_time_window_s && typed.concurrent_limit == remote.concurrent_limit && Boolean(typed.restart_unless_cancelled) == Boolean(remote.restart_unless_cancelled) && Boolean(typed.visible_to_runner_only) == Boolean(remote.visible_to_runner_only) && Boolean(typed.has_preprocessor) == Boolean(remote.has_preprocessor) && typed.priority == Boolean(remote.priority) && typed.timeout == remote.timeout && typed.concurrency_key == remote["concurrency_key"] && typed.debounce_key == remote["debounce_key"] && typed.debounce_delay_s == remote["debounce_delay_s"] && typed.codebase == remote.codebase && (hasOnBehalfOf ? true : typed.on_behalf_of_email == remote.on_behalf_of_email) && deepEqual(typed.envs, remote.envs) && deepEqual(modules ?? null, remote.modules ?? null)) {
           info(colors.green(`Script ${remotePath} is up to date`));
+          await applyExtraPermsDiff(workspaceId, "script", remotePath.replaceAll(SEP4, "/"), typed?.extra_perms, remote?.extra_perms);
           return true;
         }
       }
@@ -62471,6 +62575,7 @@ async function handleFile(path8, workspace, alreadySynced, message, opts, rawWor
       const execTime = await createScript2(bundleContent, workspaceId, body, workspace);
       info(colors.yellow.bold(`Created new script ${remotePath} (${execTime.toFixed(0)}ms)`));
     }
+    await applyExtraPermsDiff(workspaceId, "script", remotePath.replaceAll(SEP4, "/"), typed?.extra_perms, remote?.extra_perms);
     return true;
   }
   return false;
@@ -63213,6 +63318,7 @@ async function setPermissionedAs(opts, scriptPath, email) {
 }
 var import_yaml6, exts, languageAliases, command4, script_default;
 var init_script = __esm(async () => {
+  init_extra_perms();
   init_colors2();
   init_mod3();
   init_mod6();
@@ -69443,31 +69549,32 @@ async function pushRawApp(workspace, remotePath, localPath, message) {
   if (localApp.data) {
     value.data = localApp.data;
   }
+  const { extra_perms: localPerms, ...localAppNoPerms } = localApp;
   if (app) {
-    const metadataUpToDate = isSuperset({ ...localApp, runnables }, app);
+    const metadataUpToDate = isSuperset({ ...localAppNoPerms, runnables }, app);
     const filesUpToDate = deepEqual(files, app.value?.files);
     if (metadataUpToDate && filesUpToDate) {
       info(colors.green(`App ${remotePath} is up to date`));
-      return;
+    } else {
+      const { js, css } = await createBundleRaw();
+      info(colors.bold.yellow(`Updating app ${remotePath}...`));
+      await updateAppRaw({
+        workspace,
+        path: remotePath,
+        formData: {
+          app: {
+            value,
+            path: remotePath,
+            summary: localApp.summary,
+            policy: appForPolicy.policy,
+            deployment_message: message,
+            ...localApp.custom_path ? { custom_path: localApp.custom_path } : {}
+          },
+          js,
+          css
+        }
+      });
     }
-    const { js, css } = await createBundleRaw();
-    info(colors.bold.yellow(`Updating app ${remotePath}...`));
-    await updateAppRaw({
-      workspace,
-      path: remotePath,
-      formData: {
-        app: {
-          value,
-          path: remotePath,
-          summary: localApp.summary,
-          policy: appForPolicy.policy,
-          deployment_message: message,
-          ...localApp.custom_path ? { custom_path: localApp.custom_path } : {}
-        },
-        js,
-        css
-      }
-    });
   } else {
     const { js, css } = await createBundleRaw();
     await createAppRaw({
@@ -69486,6 +69593,7 @@ async function pushRawApp(workspace, remotePath, localPath, message) {
       }
     });
   }
+  await applyExtraPermsDiff(workspace, "raw_app", remotePath, localPerms, app?.extra_perms);
 }
 async function generatingPolicy(app, path14, publicApp) {
   info(colors.gray(`Generating fresh policy for app ${path14}...`));
@@ -69503,6 +69611,7 @@ var init_raw_apps = __esm(async () => {
   init_log();
   init_lib_es();
   init_services_gen();
+  init_extra_perms();
   init_path_assigner();
   await __promiseAll([
     init_auth(),
@@ -72340,21 +72449,22 @@ async function pushApp(workspace, remotePath, localPath, message, permissionedAs
       }
     }
   }
+  const { extra_perms: localPerms, ...localAppBody } = localApp;
   if (app) {
-    if (isSuperset(localApp, app)) {
+    if (isSuperset(localAppBody, app)) {
       info(colors.green(`App ${remotePath} is up to date`));
-      return;
+    } else {
+      info(colors.bold.yellow(`Updating app ${remotePath}...`));
+      await updateApp({
+        workspace,
+        path: remotePath,
+        requestBody: {
+          deployment_message: message,
+          ...localAppBody,
+          ...preserveFields
+        }
+      });
     }
-    info(colors.bold.yellow(`Updating app ${remotePath}...`));
-    await updateApp({
-      workspace,
-      path: remotePath,
-      requestBody: {
-        deployment_message: message,
-        ...localApp,
-        ...preserveFields
-      }
-    });
   } else {
     info(colors.yellow.bold("Creating new app..."));
     await createApp({
@@ -72362,11 +72472,12 @@ async function pushApp(workspace, remotePath, localPath, message, permissionedAs
       requestBody: {
         path: remotePath,
         deployment_message: message,
-        ...localApp,
+        ...localAppBody,
         ...preserveFields
       }
     });
   }
+  await applyExtraPermsDiff(workspace, "app", remotePath, localPerms, app?.extra_perms);
 }
 async function generatingPolicy2(app, path19, publicApp) {
   info(colors.gray(`Generating fresh policy for app ${path19}...`));
@@ -72496,6 +72607,7 @@ var init_app = __esm(async () => {
   init_lib_es();
   init_services_gen();
   init_global();
+  init_extra_perms();
   await __promiseAll([
     init_auth(),
     init_context(),
@@ -75706,22 +75818,23 @@ async function pushFlow(workspace, remotePath, localPath, message, permissionedA
       info(`Preserving ${flow.on_behalf_of_email} as on_behalf_of for flow ${remotePath}`);
     }
   }
+  const { extra_perms: localPerms, ...localFlowBody } = localFlow;
   if (flow) {
-    if (isSuperset(localFlow, flow)) {
+    if (isSuperset(localFlowBody, flow)) {
       info(colors.green(`Flow ${remotePath} is up to date`));
-      return;
-    }
-    info(colors.bold.yellow(`Updating flow ${remotePath}...`));
-    await updateFlow({
-      workspace,
-      path: remotePath.replaceAll(SEP20, "/"),
-      requestBody: {
+    } else {
+      info(colors.bold.yellow(`Updating flow ${remotePath}...`));
+      await updateFlow({
+        workspace,
         path: remotePath.replaceAll(SEP20, "/"),
-        deployment_message: message,
-        ...localFlow,
-        ...preserveFields
-      }
-    });
+        requestBody: {
+          path: remotePath.replaceAll(SEP20, "/"),
+          deployment_message: message,
+          ...localFlowBody,
+          ...preserveFields
+        }
+      });
+    }
   } else {
     info(colors.bold.yellow("Creating new flow..."));
     try {
@@ -75730,7 +75843,7 @@ async function pushFlow(workspace, remotePath, localPath, message, permissionedA
         requestBody: {
           path: remotePath.replaceAll(SEP20, "/"),
           deployment_message: message,
-          ...localFlow,
+          ...localFlowBody,
           ...preserveFields
         }
       });
@@ -75738,6 +75851,7 @@ async function pushFlow(workspace, remotePath, localPath, message, permissionedA
       throw new Error(`Failed to create flow ${remotePath}: ${e.body ?? e.message}`);
     }
   }
+  await applyExtraPermsDiff(workspace, "flow", remotePath.replaceAll(SEP20, "/"), localPerms, flow?.extra_perms);
 }
 async function push11(opts, filePath, remotePath) {
   if (!validatePath(remotePath)) {
@@ -76164,6 +76278,7 @@ var init_flow = __esm(async () => {
   init_mod6();
   init_log();
   init_services_gen();
+  init_extra_perms();
   await __promiseAll([
     init_types(),
     init_confirm(),
@@ -89686,7 +89801,7 @@ var config_default = command35;
 
 // src/main.ts
 await init_context();
-var VERSION = "1.701.0";
+var VERSION = "1.702.0";
 async function checkVersionSafe(cmd) {
   const mainCommand = cmd.getMainCommand();
   const upgradeCommand = mainCommand.getCommand("upgrade");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windmill-cli",
-  "version": "1.701.0",
+  "version": "1.702.0",
   "description": "CLI for Windmill",
   "license": "Apache 2.0",
   "type": "module",