windmill-components 1.623.1 → 1.642.0

package/package/validators/workspaceSettings.js

@@ -0,0 +1,72 @@
+import { z } from 'zod';
+// Deploy path filter validation
+const deployPathFilterSchema = z
+    .string()
+    .min(1, 'Path filter cannot be empty')
+    .refine((val) => {
+    // Allow alphanumeric characters, underscores, slashes, asterisks, and hyphens
+    // But don't allow consecutive slashes or ending with slash
+    const validChars = /^[a-zA-Z0-9/_*-]+$/;
+    const noConsecutiveSlashes = !/\/\//.test(val);
+    const noEndingSlash = !val.endsWith('/');
+    const noEndingDash = !val.endsWith('-');
+    return validChars.test(val) && noConsecutiveSlashes && noEndingSlash && noEndingDash;
+}, {
+    message: 'Path filter contains invalid characters or format. Allowed: letters, numbers, /, _, -, *. Cannot end with / or -'
+})
+    .refine((val) => {
+    // Validate glob patterns - * and ** are allowed, but *** is not
+    const invalidGlobPattern = /\*{3,}/.test(val);
+    return !invalidGlobPattern;
+}, {
+    message: 'Invalid glob pattern. Use * for single level wildcard or ** for multi-level wildcard'
+});
+// Webhook URL validation
+const webhookUrlSchema = z
+    .string()
+    .refine((val) => {
+    if (!val || val.trim() === '')
+        return true; // Allow empty
+    try {
+        new URL(val);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}, {
+    message: 'Please enter a valid URL (e.g., https://example.com/webhook)'
+})
+    .optional()
+    .or(z.literal(''));
+// Workspace encryption key validation
+const encryptionKeySchema = z.string().regex(/^[a-zA-Z0-9]{64}$/, {
+    message: 'Encryption key must be exactly 64 characters long and contain only letters and numbers'
+});
+export function validateDeployPathFilters(paths) {
+    const errors = {};
+    paths.forEach((path, index) => {
+        const result = deployPathFilterSchema.safeParse(path);
+        if (!result.success) {
+            errors[index] = result.error.issues[0]?.message || 'Invalid path filter';
+        }
+    });
+    return {
+        isValid: Object.keys(errors).length === 0,
+        errors
+    };
+}
+export function validateWebhookUrl(url) {
+    const result = webhookUrlSchema.safeParse(url);
+    return {
+        isValid: result.success,
+        error: result.success ? undefined : result.error.issues[0]?.message || 'Invalid URL'
+    };
+}
+export function validateEncryptionKey(key) {
+    const result = encryptionKeySchema.safeParse(key);
+    return {
+        isValid: result.success,
+        error: result.success ? undefined : result.error.issues[0]?.message || 'Invalid encryption key'
+    };
+}

package/package/workspaceProtectionRules.svelte.d.ts

@@ -0,0 +1,73 @@
+import { type ProtectionRuleset, type ProtectionRuleKind } from './gen';
+import type { UserExt } from './stores';
+/**
+ * Exported reactive state object with readonly getters
+ */
+export declare const protectionRulesState: {
+    readonly rulesets: ProtectionRuleset[] | undefined;
+    readonly loading: boolean;
+    readonly error: string | undefined;
+    readonly workspace: string | undefined;
+};
+/**
+ * Internal function to reset state (used by storeUtils)
+ */
+export declare function resetProtectionRules(): void;
+/**
+ * Loads protection rules for a workspace from the API and updates the state
+ * Early returns if already loading the same workspace to prevent duplicate requests
+ */
+export declare function loadProtectionRules(workspace: string): Promise<void>;
+/**
+ * Fetches protection rules for a specific workspace without updating the state
+ * @param workspace The workspace ID to fetch rules for
+ * @returns Array of protection rulesets, or empty array on error
+ */
+export declare function fetchProtectionRulesForWorkspace(workspace: string): Promise<ProtectionRuleset[]>;
+/**
+ * Checks if a user can bypass a specific ruleset
+ * @param ruleset The protection ruleset to check
+ * @param userInfo The user information
+ * @returns true if user can bypass (is admin, in bypass_users, or has group in bypass_groups)
+ */
+export declare function canUserBypassRule(ruleset: ProtectionRuleset, userInfo: UserExt): boolean;
+/**
+ * Checks if a specific rule type is active in ANY ruleset
+ * FIXED: No longer uses await without async context
+ * @param ruleKind The rule type to check
+ * @returns true if the rule is active in at least one ruleset, false if not loaded or not active
+ */
+export declare function isRuleActive(ruleKind: ProtectionRuleKind): boolean;
+/**
+ * Checks if a user can bypass a specific rule type
+ * @param ruleKind The rule type to check
+ * @param userInfo The user information
+ * @returns true if the rule is not active OR user can bypass ALL rulesets containing it
+ */
+export declare function canUserBypassRuleKind(ruleKind: ProtectionRuleKind, userInfo: UserExt | undefined): boolean;
+/**
+ * Returns all rulesets that contain a specific rule kind
+ */
+export declare function getActiveRulesetsForKind(ruleKind: ProtectionRuleKind): ProtectionRuleset[];
+/**
+ * Checks if a specific rule kind is active in given rulesets (workspace-agnostic version)
+ * @param rulesets Array of protection rulesets to check
+ * @param ruleKind The rule type to check
+ * @returns true if the rule is active in at least one ruleset
+ */
+export declare function isRuleActiveInRulesets(rulesets: ProtectionRuleset[], ruleKind: ProtectionRuleKind): boolean;
+/**
+ * Checks if user can bypass a rule kind in given rulesets (workspace-agnostic version)
+ * @param rulesets Array of protection rulesets to check
+ * @param ruleKind The rule type to check
+ * @param userInfo The user information
+ * @returns true if the rule is not active OR user can bypass ALL rulesets containing it
+ */
+export declare function canUserBypassRuleKindInRulesets(rulesets: ProtectionRuleset[], ruleKind: ProtectionRuleKind, userInfo: UserExt | undefined): boolean;
+/**
+ * Returns rulesets that contain a specific rule kind from given rulesets (workspace-agnostic version)
+ * @param rulesets Array of protection rulesets to filter
+ * @param ruleKind The rule type to filter by
+ * @returns Array of rulesets containing the specified rule
+ */
+export declare function getActiveRulesetsForKindInRulesets(rulesets: ProtectionRuleset[], ruleKind: ProtectionRuleKind): ProtectionRuleset[];

package/package/workspaceProtectionRules.svelte.js

@@ -0,0 +1,176 @@
+import { WorkspaceService } from './gen';
+/**
+ * Internal reactive state using Svelte 5 $state rune
+ */
+let state = $state({
+    rulesets: undefined,
+    loading: false,
+    error: undefined,
+    workspace: undefined
+});
+/**
+ * Exported reactive state object with readonly getters
+ */
+export const protectionRulesState = {
+    get rulesets() {
+        return state.rulesets;
+    },
+    get loading() {
+        return state.loading;
+    },
+    get error() {
+        return state.error;
+    },
+    get workspace() {
+        return state.workspace;
+    }
+};
+/**
+ * Internal function to reset state (used by storeUtils)
+ */
+export function resetProtectionRules() {
+    state.rulesets = undefined;
+    state.loading = false;
+    state.error = undefined;
+    state.workspace = undefined;
+}
+/**
+ * Loads protection rules for a workspace from the API and updates the state
+ * Early returns if already loading the same workspace to prevent duplicate requests
+ */
+export async function loadProtectionRules(workspace) {
+    // Early return if already loading for this workspace
+    if (state.loading && state.workspace === workspace) {
+        return;
+    }
+    state.loading = true;
+    state.workspace = workspace;
+    try {
+        const rulesets = await WorkspaceService.listProtectionRules({ workspace });
+        state.rulesets = rulesets;
+        state.loading = false;
+        state.error = undefined;
+    }
+    catch (error) {
+        console.error('Failed to load protection rulesets:', error);
+        // Fail open: set empty array to allow operations
+        state.rulesets = [];
+        state.loading = false;
+        state.error = error instanceof Error ? error.message : 'Unknown error';
+    }
+}
+/**
+ * Fetches protection rules for a specific workspace without updating the state
+ * @param workspace The workspace ID to fetch rules for
+ * @returns Array of protection rulesets, or empty array on error
+ */
+export async function fetchProtectionRulesForWorkspace(workspace) {
+    try {
+        const rulesets = await WorkspaceService.listProtectionRules({ workspace });
+        return rulesets;
+    }
+    catch (error) {
+        console.error(`Failed to fetch protection rules for workspace ${workspace}:`, error);
+        return [];
+    }
+}
+/**
+ * Checks if a user can bypass a specific ruleset
+ * @param ruleset The protection ruleset to check
+ * @param userInfo The user information
+ * @returns true if user can bypass (is admin, in bypass_users, or has group in bypass_groups)
+ */
+export function canUserBypassRule(ruleset, userInfo) {
+    // Admin always bypasses
+    if (userInfo.is_admin) {
+        return true;
+    }
+    if (ruleset.bypass_users.includes(userInfo.username)) {
+        return true;
+    }
+    if (ruleset.bypass_groups.some((bg) => userInfo.groups.includes(bg))) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Checks if a specific rule type is active in ANY ruleset
+ * FIXED: No longer uses await without async context
+ * @param ruleKind The rule type to check
+ * @returns true if the rule is active in at least one ruleset, false if not loaded or not active
+ */
+export function isRuleActive(ruleKind) {
+    // Safe default: return false if rules not loaded yet
+    if (!state.rulesets) {
+        return false;
+    }
+    return state.rulesets.some((ruleset) => ruleset.rules.includes(ruleKind));
+}
+/**
+ * Checks if a user can bypass a specific rule type
+ * @param ruleKind The rule type to check
+ * @param userInfo The user information
+ * @returns true if the rule is not active OR user can bypass ALL rulesets containing it
+ */
+export function canUserBypassRuleKind(ruleKind, userInfo) {
+    // If no user info, default to permissive
+    if (!userInfo) {
+        return false;
+    }
+    if (!state.rulesets) {
+        return true; // No rules loaded, allow
+    }
+    // Find all rulesets containing this rule
+    const rulesetsWithThisRule = state.rulesets.filter((rs) => rs.rules.includes(ruleKind));
+    if (rulesetsWithThisRule.length === 0) {
+        return true; // Rule not active
+    }
+    // User must be able to bypass ALL rulesets containing this rule
+    return rulesetsWithThisRule.every((rs) => canUserBypassRule(rs, userInfo));
+}
+/**
+ * Returns all rulesets that contain a specific rule kind
+ */
+export function getActiveRulesetsForKind(ruleKind) {
+    if (!state.rulesets)
+        return [];
+    return state.rulesets.filter((rs) => rs.rules.includes(ruleKind));
+}
+/**
+ * Checks if a specific rule kind is active in given rulesets (workspace-agnostic version)
+ * @param rulesets Array of protection rulesets to check
+ * @param ruleKind The rule type to check
+ * @returns true if the rule is active in at least one ruleset
+ */
+export function isRuleActiveInRulesets(rulesets, ruleKind) {
+    return rulesets.some((ruleset) => ruleset.rules.includes(ruleKind));
+}
+/**
+ * Checks if user can bypass a rule kind in given rulesets (workspace-agnostic version)
+ * @param rulesets Array of protection rulesets to check
+ * @param ruleKind The rule type to check
+ * @param userInfo The user information
+ * @returns true if the rule is not active OR user can bypass ALL rulesets containing it
+ */
+export function canUserBypassRuleKindInRulesets(rulesets, ruleKind, userInfo) {
+    // If no user info, default to not allowing bypass
+    if (!userInfo) {
+        return false;
+    }
+    // Find all rulesets containing this rule
+    const rulesetsWithThisRule = rulesets.filter((rs) => rs.rules.includes(ruleKind));
+    if (rulesetsWithThisRule.length === 0) {
+        return true; // Rule not active
+    }
+    // User must be able to bypass ALL rulesets containing this rule
+    return rulesetsWithThisRule.every((rs) => canUserBypassRule(rs, userInfo));
+}
+/**
+ * Returns rulesets that contain a specific rule kind from given rulesets (workspace-agnostic version)
+ * @param rulesets Array of protection rulesets to filter
+ * @param ruleKind The rule type to filter by
+ * @returns Array of rulesets containing the specified rule
+ */
+export function getActiveRulesetsForKindInRulesets(rulesets, ruleKind) {
+    return rulesets.filter((rs) => rs.rules.includes(ruleKind));
+}

package/package.json

@@ -1,12 +1,13 @@
 {
 	"name": "windmill-components",
-	"version": "1.623.1",
+	"version": "1.642.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
 		"build:utils": "vite build --config sharedUtils/vite.sharedUtils.config.js",
 		"preview": "vite preview",
 		"postinstall": "node -e \"if (require('fs').existsSync('./scripts/untar_ui_builder.js')) { require('child_process').execSync('node ./scripts/untar_ui_builder.js', {stdio: 'inherit'}) }\"",
+		"check:fast": "bun --bun svelte-fast-check --no-svelte-warnings --incremental",
 		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --threshold warning",
 		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
 		"lint": "prettier --ignore-path .gitignore --check --plugin-search-dir=. . && eslint --ignore-path .gitignore .",
@@ -58,6 +59,7 @@
 		"svelte": "^5.38.0",
 		"svelte-awesome-color-picker": "^3.0.4",
 		"svelte-check": "^4.0.0",
+		"svelte-fast-check": "^0.4.5",
 		"svelte-floating-ui": "^1.5.8",
 		"svelte-highlight": "^7.6.0",
 		"svelte-popperjs": "^1.3.2",
@@ -117,6 +119,7 @@
 		"hash-sum": "^2.0.0",
 		"highlight.js": "^11.8.0",
 		"idb": "^8.0.2",
+		"jszip": "^3.10.1",
 		"lru-cache": "^11.1.0",
 		"lucide-svelte": "^0.540.0",
 		"minimatch": "^10.0.1",
@@ -148,14 +151,14 @@
 		"windmill-parser-wasm-java": "1.510.1",
 		"windmill-parser-wasm-nu": "1.510.1",
 		"windmill-parser-wasm-php": "1.574.1",
-		"windmill-parser-wasm-py": "1.601.1",
-		"windmill-parser-wasm-regex": "1.593.0",
+		"windmill-parser-wasm-py": "^1.628.3",
+		"windmill-parser-wasm-regex": "1.639.0",
 		"windmill-parser-wasm-ruby": "1.526.1",
 		"windmill-parser-wasm-rust": "1.558.1",
-		"windmill-parser-wasm-ts": "1.593.0",
+		"windmill-parser-wasm-ts": "1.623.1",
 		"windmill-parser-wasm-yaml": "1.593.0",
 		"windmill-sql-datatype-parser-wasm": "1.512.0",
-		"windmill-utils-internal": "^1.3.2",
+		"windmill-utils-internal": "^1.3.4",
 		"xterm": "^5.3.0",
 		"xterm-readline": "^1.1.2",
 		"y-monaco": "^0.1.4",

package/package/components/DropdownSelect.svelte

@@ -1,26 +0,0 @@
-<script lang="ts">import DropdownV2 from './DropdownV2.svelte';
-import { ChevronDown } from 'lucide-svelte';
-import { twMerge } from 'tailwind-merge';
-let { items = [], extraLabel, selected, selectedDisplayName, btnClasses } = $props();
-const filteredItems = $derived(items.filter((item) => item.id !== selected));
-</script>
-
-<DropdownV2 items={filteredItems}>
-	{#snippet buttonReplacement()}
-		<div
-			class={twMerge(
-				'p-2 h-8 flex flex-row items-center gap-2 border hover:bg-surface-hover cursor-pointer rounded-md',
-				btnClasses
-			)}
-		>
-			<div class="flex flex-row items-center gap-1 pr-2 justify-between w-full">
-				<span class="text-xs whitespace-nowrap">
-					{selectedDisplayName ?? items.find((item) => item.id === selected)?.displayName ?? ''}
-				</span>
-
-				{@render extraLabel?.()}
-			</div>
-			<ChevronDown size={12} />
-		</div>
-	{/snippet}
-</DropdownV2>

package/package/components/DropdownSelect.svelte.d.ts

@@ -1,11 +0,0 @@
-import type { Item } from '../utils';
-interface Props {
-    items?: Item[];
-    extraLabel?: import('svelte').Snippet;
-    selected: string;
-    selectedDisplayName?: string;
-    btnClasses?: string;
-}
-declare const DropdownSelect: import("svelte").Component<Props, {}, "">;
-type DropdownSelect = ReturnType<typeof DropdownSelect>;
-export default DropdownSelect;

package/package/components/FlowPreviewResult.svelte

@@ -1,88 +0,0 @@
-<script lang="ts">import { Loader2 } from 'lucide-svelte';
-import FlowJobResult from './FlowJobResult.svelte';
-import FlowPreviewStatus from './preview/FlowPreviewStatus.svelte';
-import FlowStatusWaitingForEvents from './FlowStatusWaitingForEvents.svelte';
-import { emptyString } from '../utils';
-import Badge from './common/badge/Badge.svelte';
-let { job, workspaceId, isOwner, hideFlowResult, hideDownloadLogs, innerModules, suspendStatus, hideJobId, extra, result_streams } = $props();
-// Sometimes the approval form is duplicated but I can't reproduce the issue
-// This is a temporary debug log to try to catch it when it happens
-// (See the #each below)
-$effect(() => console.log('suspendStatusVal', Object.entries(suspendStatus.val || {}).map(([k, v]) => [k, v.job.id])));
-</script>
-
-<FlowPreviewStatus {job} {hideJobId} {extra} />
-
-{#if !job}
-	<div>
-		<Loader2 class="animate-spin" />
-	</div>
-{:else if `result` in job}
-	{#if !hideFlowResult}
-		<div class="w-full h-full">
-			<FlowJobResult
-				workspaceId={job?.workspace_id}
-				jobId={job?.id}
-				tag={job?.tag}
-				loading={job['running'] == true}
-				result={job.result}
-				logs={job.logs}
-				downloadLogs={!hideDownloadLogs}
-			/>
-		</div>
-	{/if}
-{:else if job.flow_status?.modules?.[job?.flow_status?.step]?.type === 'WaitingForEvents'}
-	<FlowStatusWaitingForEvents {workspaceId} {job} {isOwner} />
-{:else if suspendStatus.val && Object.keys(suspendStatus.val).length > 0}
-	<div class="flex gap-2 flex-col">
-		{#each Object.values(suspendStatus.val) as suspendCount (suspendCount.job.id)}
-			<div>
-				<div class="text-sm">
-					Flow suspended, waiting for {suspendCount.nb} events
-				</div>
-				<FlowStatusWaitingForEvents job={suspendCount.job} {workspaceId} {isOwner} />
-			</div>
-		{/each}
-	</div>
-{:else if job.logs}
-	<div
-		class="text-xs p-4 bg-surface-secondary overflow-auto max-h-80 border border-tertiary-inverse"
-	>
-		<pre class="w-full">{job.logs}</pre>
-	</div>
-{:else if innerModules && innerModules?.length > 0}
-	<div class="flex flex-col gap-1">
-		{#each innerModules as mod, i (mod.id)}
-			{#if mod.type == 'InProgress'}
-				{@const rawMod = job.raw_flow?.modules[i]}
-
-				<div>
-					<span class="inline-flex gap-1">
-						<Badge
-							color="indigo"
-							wrapperClass="max-w-full"
-							baseClass="max-w-full truncate !px-1"
-							title={mod.id}
-						>
-							<span class="max-w-full text-2xs truncate">{mod.id}</span></Badge
-						>
-						<span class="font-medium text-primary mt-0.5">
-							{#if !emptyString(rawMod?.summary)}
-								{rawMod?.summary ?? ''}
-							{:else if rawMod?.value.type == 'script'}
-								{rawMod.value.path ?? ''}
-							{:else if rawMod?.value.type}
-								{rawMod?.value.type}
-							{/if}
-						</span>
-
-						<Loader2 class="animate-spin mt-0.5" /></span
-					></div
-				>
-				{#if mod.job && result_streams?.[mod.job]}
-					<pre class="text-xs text-primary">{result_streams?.[mod.job]}</pre>
-				{/if}
-			{/if}
-		{/each}
-	</div>
-{/if}

package/package/components/FlowPreviewResult.svelte.d.ts

@@ -1,20 +0,0 @@
-import type { FlowStatusModule, Job } from '../gen';
-import { type StateStore } from '../utils';
-interface Props {
-    job: Job;
-    workspaceId: string | undefined;
-    isOwner: boolean;
-    hideFlowResult: boolean;
-    hideDownloadLogs: boolean;
-    innerModules: FlowStatusModule[] | undefined;
-    suspendStatus: StateStore<Record<string, {
-        job: Job;
-        nb: number;
-    }>>;
-    hideJobId?: boolean;
-    extra?: import('svelte').Snippet;
-    result_streams?: Record<string, string | undefined>;
-}
-declare const FlowPreviewResult: import("svelte").Component<Props, {}, "">;
-type FlowPreviewResult = ReturnType<typeof FlowPreviewResult>;
-export default FlowPreviewResult;