windmill-components 1.623.2 → 1.655.0

package/package/components/instanceSettings.js

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 // Languages that support HTTP request tracing via OTEL proxy
 export const OTEL_TRACING_PROXY_LANGUAGES = [
     'nativets',
@@ -11,12 +12,38 @@ export const OTEL_TRACING_PROXY_LANGUAGES = [
     'nu',
     'ruby'
 ];
+const positiveNumber = z.number().positive('Must be a positive number');
+const indexerSettingsSchema = z
+    .object({
+    writer_memory_budget: positiveNumber.optional(),
+    commit_job_max_batch_size: positiveNumber.optional(),
+    refresh_index_period: positiveNumber.optional(),
+    max_indexed_job_log_size: positiveNumber.optional(),
+    commit_log_max_batch_size: positiveNumber.optional(),
+    refresh_log_index_period: positiveNumber.optional(),
+    max_index_time_window_secs: positiveNumber.optional()
+})
+    .passthrough();
+function validateIndexerSettings(v) {
+    if (!v)
+        return {};
+    const result = indexerSettingsSchema.safeParse(v);
+    if (result.success)
+        return {};
+    const errors = {};
+    for (const issue of result.error.issues) {
+        const field = issue.path[0]?.toString();
+        if (field)
+            errors[field] = issue.message;
+    }
+    return errors;
+}
 export const scimSamlSetting = [
     {
         label: 'SCIM token',
         description: 'Token used to authenticate requests from the IdP',
         key: 'scim_token',
-        fieldType: 'text',
+        fieldType: 'password',
         placeholder: 'mytoken',
         storage: 'setting',
         ee_only: ''
@@ -49,11 +76,15 @@ export const settings = {
         },
         {
             label: 'Email domain',
-            description: 'Domain to display in webhooks for <a href="https://www.windmill.dev/docs/advanced/email_triggers">email triggers</a> (should match the MX record)',
+            description: 'Domain to display in webhooks for email triggers (should match the MX record)',
             key: 'email_domain',
             fieldType: 'text',
+            placeholder: 'mail.windmill.com',
             storage: 'setting',
-            placeholder: 'mail.windmill.com'
+            error: 'Must be a valid domain',
+            isValid: (value) => value == undefined ||
+                value === '' ||
+                /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)*$/.test(value)
         },
         {
             label: 'Request size limit in MB',
@@ -64,6 +95,65 @@ export const settings = {
             placeholder: '50',
             storage: 'setting'
         },
+        {
+            label: 'License key',
+            description: 'License key required to use the EE (switch image for windmill-ee). <a href="https://www.windmill.dev/docs/advanced/instance_settings#license-key">Learn more</a>',
+            key: 'license_key',
+            fieldType: 'license_key',
+            placeholder: 'only for EE',
+            storage: 'setting'
+        },
+        {
+            label: 'Non-prod instance',
+            description: 'Whether we should consider the reported usage of this instance as non-prod. <a href="https://www.windmill.dev/docs/advanced/instance_settings#non-prod-instance">Learn more</a>',
+            key: 'dev_instance',
+            fieldType: 'boolean',
+            storage: 'setting',
+            ee_only: '',
+            hideInQuickSetup: true
+        },
+        {
+            label: 'App workspace prefix',
+            description: 'When enabled apps will be accessible at /a/{workspace_id}/{custom_path} instead of /a/{custom_path} allowing you to define same custom path for apps in different workspace without conflict',
+            key: 'app_workspaced_route',
+            fieldType: 'boolean',
+            storage: 'setting',
+            ee_only: '',
+            hideInQuickSetup: true
+        },
+        {
+            label: 'Audit log retention (days)',
+            key: 'audit_log_retention_days',
+            description: 'How long to keep audit log entries in the database. Default: 365 days.',
+            fieldType: 'number',
+            placeholder: '365',
+            storage: 'setting',
+            ee_only: '',
+            hideInQuickSetup: true
+        }
+    ],
+    Jobs: [
+        {
+            label: 'Job isolation',
+            key: 'job_isolation',
+            fieldType: 'select',
+            description: 'Isolation mode for job execution. None: no isolation. Unshare: PID namespace isolation via unshare. Nsjail: full nsjail sandboxing. <a href="https://www.windmill.dev/docs/advanced/security_isolation">Learn more</a>',
+            storage: 'setting',
+            select_items: [
+                {
+                    label: 'None',
+                    value: 'none'
+                },
+                {
+                    label: 'Unshare',
+                    value: 'unshare'
+                },
+                {
+                    label: 'Nsjail',
+                    value: 'nsjail_sandboxing'
+                }
+            ]
+        },
         {
             label: 'Default timeout',
             key: 'job_default_timeout',
@@ -72,37 +162,20 @@ export const settings = {
             storage: 'setting',
             cloudonly: false
         },
-        {
-            label: 'Keep job directories for debug',
-            key: 'keep_job_dir',
-            fieldType: 'boolean',
-            description: 'Keep Job directories after execution at /tmp/windmill/WORKER/JOB_ID',
-            storage: 'setting'
-        },
         {
             label: 'Max timeout for sync endpoints',
             description: 'Maximum amount of time (measured in seconds) that a <a href="https://www.windmill.dev/docs/core_concepts/webhooks">sync endpoint</a> is allowed to run before it is forcibly stopped or timed out.',
             key: 'timeout_wait_result',
-            cloudonly: true,
             fieldType: 'seconds',
             placeholder: '60',
             storage: 'setting'
         },
         {
-            label: 'License key',
-            description: 'License key required to use the EE (switch image for windmill-ee). <a href="https://www.windmill.dev/docs/advanced/instance_settings#license-key">Learn more</a>',
-            key: 'license_key',
-            fieldType: 'license_key',
-            placeholder: 'only needed to prepare upgrade to EE',
-            storage: 'setting'
-        },
-        {
-            label: 'Non-prod instance',
-            description: 'Whether we should consider the reported usage of this instance as non-prod. <a href="https://www.windmill.dev/docs/advanced/instance_settings#non-prod-instance">Learn more</a>',
-            key: 'dev_instance',
+            label: 'Keep job directories for debug',
+            key: 'keep_job_dir',
             fieldType: 'boolean',
-            storage: 'setting',
-            ee_only: ''
+            description: 'Keep Job directories after execution at /tmp/windmill/WORKER/JOB_ID',
+            storage: 'setting'
         },
         {
             label: 'Retention period in secs',
@@ -113,32 +186,32 @@ export const settings = {
             storage: 'setting',
             ee_only: 'You can only adjust this setting to above 30 days in the EE version',
             cloudonly: false
-        },
-        {
-            label: 'Delete logs from s3 periodically',
-            description: 'Job and service logs are periodically deleted from disk. When this setting is on, they will also be deleted from the object storage.',
-            key: 'monitor_logs_on_s3',
-            fieldType: 'boolean',
-            storage: 'setting',
-            ee_only: ''
-        },
+        }
+    ],
+    'Object Storage': [
         {
             label: 'Instance object storage',
             description: ' S3/Azure bucket to store large logs and global cache for Python and Go. <a href="https://www.windmill.dev/docs/core_concepts/object_storage_in_windmill#instance-object-storage">Learn more</a>',
             key: 'object_store_cache_config',
             fieldType: 'object_store_config',
             storage: 'setting',
-            ee_only: ''
+            ee_only: '',
+            isValid: (v) => {
+                if (!v || v.type !== 'Gcs')
+                    return true;
+                return v.serviceAccountKey !== undefined;
+            }
         },
         {
-            label: 'Azure OpenAI base path',
-            description: 'All workspaces using an OpenAI resource for Windmill AI will run on the specified deployed model. Format: https://{your-resource-name}.openai.azure.com/openai/deployments/{deployment-id}. <a href="https://www.windmill.dev/docs/core_concepts/ai_generation#azure-openai-advanced-models">Learn more</a>',
-            key: 'openai_azure_base_path',
-            fieldType: 'text',
+            label: 'Delete logs from s3 periodically',
+            description: 'Job and service logs are periodically deleted from disk. When this setting is on, they will also be deleted from the object storage.',
+            key: 'monitor_logs_on_s3',
+            fieldType: 'boolean',
             storage: 'setting',
-            ee_only: '',
-            hiddenIfEmpty: true
-        },
+            ee_only: ''
+        }
+    ],
+    'Private Hub': [
         {
             label: 'Private Hub base url',
             description: 'Base URL of your Private Hub instance, without trailing slash. <a href="https://www.windmill.dev/docs/core_concepts/private_hub">Learn more</a>',
@@ -181,17 +254,27 @@ export const settings = {
             ee_only: ''
         },
         {
-            label: 'App workspace prefix',
-            description: 'When enabled apps will be accessible at /a/{workspace_id}/{custom_path} instead of /a/{custom_path} allowing you to define same custom path for apps in different workspace without conflict',
-            key: 'app_workspaced_route',
+            label: 'Azure OpenAI base path',
+            description: 'All workspaces using an OpenAI resource for Windmill AI will run on the specified deployed model. Format: https://{your-resource-name}.openai.azure.com/openai/deployments/{deployment-id}. <a href="https://www.windmill.dev/docs/core_concepts/ai_generation#azure-openai-advanced-models">Learn more</a>',
+            key: 'openai_azure_base_path',
+            fieldType: 'text',
+            storage: 'setting',
+            ee_only: '',
+            hiddenIfEmpty: true
+        },
+        {
+            label: 'Disable Hub',
+            description: 'Disable the Windmill Hub integration entirely. Enable this if your instance runs in a closed environment without internet access and you do not have a private hub setup.',
+            key: 'disable_hub',
             fieldType: 'boolean',
             storage: 'setting',
-            ee_only: ''
+            ee_only: '',
+            requiresReloadOnChange: true
         }
     ],
     SMTP: [
         {
-            label: 'SMTP',
+            label: 'SMTP configuration',
             key: 'smtp_settings',
             fieldType: 'smtp_connect',
             storage: 'setting',
@@ -235,7 +318,7 @@ export const settings = {
             label: 'UV index url',
             description: 'Add private Pip registry',
             key: 'pip_index_url',
-            fieldType: 'text',
+            fieldType: 'password',
             placeholder: 'https://username:password@pypi.company.com/simple',
             storage: 'setting',
             ee_only: ''
@@ -244,32 +327,69 @@ export const settings = {
             label: 'UV extra index url',
             description: 'Add private extra Pip registry',
             key: 'pip_extra_index_url',
-            fieldType: 'text',
+            fieldType: 'password',
             placeholder: 'https://username:password@pypi.company.com/simple',
             storage: 'setting',
             ee_only: ''
         },
         {
-            label: 'Npm config registry',
-            description: 'Add private npm registry',
+            label: 'UV index strategy',
+            description: 'Strategy for resolving packages from multiple indexes. See <a href="https://docs.astral.sh/uv/pip/compatibility/#packages-that-exist-on-multiple-indexes">uv docs</a>',
+            key: 'uv_index_strategy',
+            fieldType: 'select',
+            placeholder: 'unsafe-best-match',
+            defaultValue: () => 'unsafe-best-match',
+            select_items: [
+                {
+                    label: 'first-index',
+                    tooltip: 'Only use the first index that contains the package'
+                },
+                {
+                    label: 'unsafe-first-match',
+                    tooltip: 'Search for packages across all indexes, preferring the first match'
+                },
+                {
+                    label: 'unsafe-best-match (default)',
+                    value: 'unsafe-best-match',
+                    tooltip: 'Search for packages across all indexes, preferring the best match'
+                }
+            ],
+            storage: 'setting',
+            ee_only: ''
+        },
+        {
+            label: 'NPM Registry Configuration (.npmrc)',
+            description: 'Full .npmrc file content for private npm registries. Used by Bun, Deno, and the npm proxy. Takes precedence over the legacy fields below.',
+            key: 'npmrc',
+            fieldType: 'codearea',
+            codeAreaLang: 'ini',
+            placeholder: 'registry=https://registry.mycompany.com/\n//registry.mycompany.com/:_authToken=YOUR_TOKEN\n\n@myorg:registry=https://registry.myorg.com/\n//registry.myorg.com/:_authToken=SCOPED_TOKEN',
+            storage: 'setting',
+            ee_only: ''
+        },
+        {
+            label: 'Npm config registry (legacy)',
+            description: 'Add private npm registry. Prefer using the .npmrc field above.',
             key: 'npm_config_registry',
-            fieldType: 'text',
+            fieldType: 'password',
             placeholder: 'https://registry.npmjs.org/:_authToken=npm_FOOBAR',
             storage: 'setting',
-            ee_only: ''
+            ee_only: '',
+            hiddenIfEmpty: true
         },
         {
-            label: 'Bunfig install scopes',
-            description: 'Add private scoped registries for Bun, See: https://bun.sh/docs/install/registries',
+            label: 'Bunfig install scopes (legacy)',
+            description: 'Add private scoped registries for Bun. Prefer using the .npmrc field above. See: https://bun.sh/docs/install/registries',
             key: 'bunfig_install_scopes',
-            fieldType: 'text',
+            fieldType: 'password',
             placeholder: '"@myorg3" = { token = "mytoken", url = "https://registry.myorg.com/" }',
             storage: 'setting',
-            ee_only: ''
+            ee_only: '',
+            hiddenIfEmpty: true
         },
         {
             label: 'Nuget Config',
-            description: 'Write a nuget.config file to set custom package sources and credentials',
+            description: 'Write a nuget.config file to set custom package sources and credentials. Use <clear /> inside <packageSources> to remove default sources and only use your custom ones',
             key: 'nuget_config',
             fieldType: 'codearea',
             codeAreaLang: 'xml',
@@ -280,11 +400,20 @@ export const settings = {
             label: 'Maven/Ivy repositories',
             description: 'Add private Maven/Ivy repositories',
             key: 'maven_repos',
-            fieldType: 'text',
+            fieldType: 'password',
             placeholder: 'https://user:password@artifacts.foo.com/maven',
             storage: 'setting',
             ee_only: ''
         },
+        {
+            label: 'Maven settings.xml',
+            description: 'Write a Maven settings.xml file for custom repositories, mirrors, and credentials',
+            key: 'maven_settings_xml',
+            fieldType: 'codearea',
+            codeAreaLang: 'xml',
+            storage: 'setting',
+            ee_only: ''
+        },
         {
             label: 'Disable default Maven repository',
             description: 'Do not use default Maven repository',
@@ -297,11 +426,20 @@ export const settings = {
             label: 'Ruby Gems repositories',
             description: 'Add private Ruby repositories with credentials. Should end with /',
             key: 'ruby_repos',
-            fieldType: 'text',
+            fieldType: 'password',
             placeholder: 'https://user:password@gems.foo.com/',
             storage: 'setting',
             ee_only: ''
         },
+        {
+            label: 'Cargo registries',
+            description: 'Write a .cargo/config.toml to set custom Cargo registries and credentials',
+            key: 'cargo_registries',
+            fieldType: 'codearea',
+            codeAreaLang: 'toml',
+            storage: 'setting',
+            ee_only: ''
+        },
         {
             label: 'PowerShell Repository URL',
             description: 'Add private PowerShell repository URL',
@@ -313,7 +451,7 @@ export const settings = {
         },
         {
             label: 'PowerShell Repository PAT',
-            description: 'Add private PowerShell repository Personal Access Token',
+            description: 'Add private PowerShell repository Personal Access Token (optional, for authenticated repositories)',
             key: 'powershell_repo_pat',
             fieldType: 'password',
             storage: 'setting',
@@ -355,6 +493,14 @@ export const settings = {
             requiresReloadOnChange: true,
             ee_only: 'Critical alerts in UI are only available in the EE version'
         },
+        {
+            label: 'Alert on token expiry',
+            description: 'Send critical alerts when API tokens are about to expire (within 7 days) or have expired',
+            key: 'critical_alerts_on_token_expiry',
+            fieldType: 'boolean',
+            storage: 'setting',
+            ee_only: ''
+        },
         {
             label: 'Slack',
             key: 'slack',
@@ -404,12 +550,12 @@ export const settings = {
             key: 'indexer_settings',
             fieldType: 'indexer_rates',
             storage: 'setting',
-            ee_only: 'Full text search across jobs and service logs is an EE feature'
+            validate: validateIndexerSettings
         }
     ],
     Telemetry: [
         {
-            label: 'Disable telemetry',
+            label: 'Minimal telemetry',
             key: 'disable_stats',
             fieldType: 'boolean',
             storage: 'setting'
@@ -417,8 +563,8 @@ export const settings = {
     ],
     'Secret Storage': [
         {
-            label: 'Secret Storage Backend',
-            description: 'Configure where secrets (secret variables) are stored. By default, secrets are encrypted and stored in the database. Enterprise Edition supports HashiCorp Vault as an external secret store.',
+            label: 'Backend type',
+            description: 'By default, secrets are encrypted and stored in the database. Enterprise Edition supports HashiCorp Vault as an external secret store.',
             key: 'secret_backend',
             fieldType: 'secret_backend',
             storage: 'setting',
@@ -427,3 +573,239 @@ export const settings = {
     ]
 };
 export const settingsKeys = Object.keys(settings);
+// --- Sidebar navigation for instance settings ---
+export const instanceSettingsNavigationGroups = [
+    {
+        title: 'Core',
+        items: [
+            {
+                id: 'users',
+                label: 'Users',
+                aiId: 'instance-settings-users',
+                aiDescription: 'Instance users settings'
+            },
+            {
+                id: 'general',
+                label: 'General',
+                aiId: 'instance-settings-general',
+                aiDescription: 'Instance general settings'
+            },
+            {
+                id: 'jobs',
+                label: 'Jobs',
+                aiId: 'instance-settings-jobs',
+                aiDescription: 'Instance jobs settings'
+            }
+        ]
+    },
+    {
+        title: 'Authentication',
+        items: [
+            {
+                id: 'sso',
+                label: 'SSO',
+                aiId: 'instance-settings-sso',
+                aiDescription: 'Instance SSO settings'
+            },
+            {
+                id: 'oauth',
+                label: 'OAuth',
+                aiId: 'instance-settings-oauth',
+                aiDescription: 'Instance OAuth settings'
+            },
+            {
+                id: 'scim_saml',
+                label: 'SCIM/SAML',
+                aiId: 'instance-settings-scim-saml',
+                aiDescription: 'Instance SCIM/SAML settings',
+                isEE: true
+            }
+        ]
+    },
+    {
+        title: 'Infrastructure',
+        items: [
+            {
+                id: 'smtp',
+                label: 'SMTP',
+                aiId: 'instance-settings-smtp',
+                aiDescription: 'Instance SMTP settings'
+            },
+            {
+                id: 'registries',
+                label: 'Registries',
+                aiId: 'instance-settings-registries',
+                aiDescription: 'Instance registries settings'
+            },
+            {
+                id: 'object_storage',
+                label: 'Object Storage',
+                aiId: 'instance-settings-object-storage',
+                aiDescription: 'Instance object storage settings',
+                isEE: true
+            }
+        ]
+    },
+    {
+        title: 'Monitoring',
+        items: [
+            {
+                id: 'alerts',
+                label: 'Alerts',
+                aiId: 'instance-settings-alerts',
+                aiDescription: 'Instance alerts settings',
+                isEE: true
+            },
+            {
+                id: 'otel_prom',
+                label: 'OTEL/Prometheus',
+                aiId: 'instance-settings-otel-prom',
+                aiDescription: 'Instance OTEL/Prometheus settings',
+                isEE: true
+            },
+            {
+                id: 'indexer',
+                label: 'Indexer',
+                aiId: 'instance-settings-indexer',
+                aiDescription: 'Instance indexer settings',
+                isEE: true
+            }
+        ]
+    },
+    {
+        title: 'Advanced',
+        items: [
+            {
+                id: 'private_hub',
+                label: 'Private Hub',
+                aiId: 'instance-settings-private-hub',
+                aiDescription: 'Instance private hub settings',
+                isEE: true
+            },
+            {
+                id: 'telemetry',
+                label: 'Telemetry',
+                aiId: 'instance-settings-telemetry',
+                aiDescription: 'Instance telemetry settings'
+            },
+            {
+                id: 'secret_storage',
+                label: 'Secret Storage',
+                aiId: 'instance-settings-secret-storage',
+                aiDescription: 'Instance secret storage settings'
+            }
+        ]
+    }
+];
+export const tabToCategoryMap = {
+    general: 'Core',
+    sso: 'Auth/OAuth/SAML',
+    oauth: 'Auth/OAuth/SAML',
+    scim_saml: 'Auth/OAuth/SAML',
+    smtp: 'SMTP',
+    registries: 'Registries',
+    alerts: 'Alerts',
+    otel_prom: 'OTEL/Prom',
+    indexer: 'Indexer',
+    telemetry: 'Telemetry',
+    secret_storage: 'Secret Storage',
+    object_storage: 'Object Storage',
+    jobs: 'Jobs',
+    private_hub: 'Private Hub'
+};
+export const tabToAuthSubTab = {
+    sso: 'sso',
+    oauth: 'oauth',
+    scim_saml: 'scim'
+};
+// Navigation groups for the initial setup flow (no Users tab)
+export const setupNavigationGroups = instanceSettingsNavigationGroups
+    .map((group) => ({
+    ...group,
+    items: group.items.filter((item) => item.id !== 'users')
+}))
+    .filter((group) => group.items.length > 0);
+export const categoryToTabMap = {
+    Core: 'general',
+    SMTP: 'smtp',
+    'Auth/OAuth/SAML': 'sso',
+    Registries: 'registries',
+    Alerts: 'alerts',
+    'OTEL/Prom': 'otel_prom',
+    Indexer: 'indexer',
+    Telemetry: 'telemetry',
+    'Secret Storage': 'secret_storage',
+    'Object Storage': 'object_storage',
+    Jobs: 'jobs',
+    'Private Hub': 'private_hub'
+};
+/**
+ * Extract the label portion from a uFuzzy marked/highlighted string.
+ * Only allows `<mark>` and `</mark>` tags through (sanitizes everything else).
+ */
+export function extractMarkedLabel(marked, labelLength) {
+    if (!marked)
+        return '';
+    let plainIdx = 0;
+    let markedIdx = 0;
+    while (plainIdx < labelLength && markedIdx < marked.length) {
+        if (marked[markedIdx] === '<') {
+            while (markedIdx < marked.length && marked[markedIdx] !== '>')
+                markedIdx++;
+            markedIdx++;
+        }
+        else {
+            plainIdx++;
+            markedIdx++;
+        }
+    }
+    // Include any closing </mark> right after
+    if (marked.startsWith('</mark>', markedIdx)) {
+        markedIdx += '</mark>'.length;
+    }
+    // Sanitize: only allow <mark> and </mark> tags from uFuzzy highlight
+    return marked.slice(0, markedIdx).replace(/<(?!\/?mark>)[^>]*>/g, '');
+}
+export function buildSearchableSettingItems(navigationGroups = instanceSettingsNavigationGroups) {
+    const items = [];
+    // Add sidebar navigation items (tab-level)
+    for (const group of navigationGroups) {
+        for (const navItem of group.items) {
+            items.push({
+                label: navItem.label,
+                tabId: navItem.id,
+                category: group.title
+            });
+        }
+    }
+    // Add individual settings from each category
+    for (const [category, categorySettings] of Object.entries(settings)) {
+        const tabId = categoryToTabMap[category];
+        if (!tabId)
+            continue;
+        for (const setting of categorySettings) {
+            if (!setting.label)
+                continue;
+            items.push({
+                label: setting.label,
+                tabId,
+                settingKey: setting.key,
+                category,
+                description: setting.description?.replace(/<[^>]*>/g, '') ?? ''
+            });
+        }
+    }
+    // Add SCIM/SAML settings
+    for (const setting of scimSamlSetting) {
+        if (!setting.label)
+            continue;
+        items.push({
+            label: setting.label,
+            tabId: 'scim_saml',
+            settingKey: setting.key,
+            category: 'SCIM/SAML',
+            description: setting.description?.replace(/<[^>]*>/g, '') ?? ''
+        });
+    }
+    return items;
+}