fix: S3 advanced custom permissions (#7632)

* audit_author

* Fix S3 Permissions

* ee

* chore: update ee-repo-ref to e8605e72a6c93c9cf43737ebea74dd28e1f00e83

This commit updates the EE repository reference after PR #381 was merged in windmill-ee-private.

Previous ee-repo-ref: 0c8638d3895a1ead9422fc8e428e3e0405e3a060

New ee-repo-ref: e8605e72a6c93c9cf43737ebea74dd28e1f00e83

Automated by sync-ee-ref workflow.

---------

Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

backend/ee-repo-ref.txt

@@ -1 +1 @@
-7842807b641e25c6683f92c385f294c29f33c197
+e8605e72a6c93c9cf43737ebea74dd28e1f00e83

backend/windmill-api/src/apps.rs

@@ -2263,6 +2263,7 @@ async fn upload_s3_file_from_app(
                     );
                     let (_, s3_resource_opt) = get_workspace_s3_resource_and_check_paths(
                         &db_with_opt_authed,
+                        Some(&on_behalf_authed),
                         &w_id,
                         None,
                         &[(&file_key, S3Permission::WRITE)],
@@ -2294,6 +2295,7 @@ async fn upload_s3_file_from_app(
                 DbWithOptAuthed::from_authed(&on_behalf_authed, db.clone(), None);
             let (_, s3_resource_opt) = get_workspace_s3_resource_and_check_paths(
                 &db_with_opt_authed,
+                Some(&on_behalf_authed),
                 &w_id,
                 None,
                 &[(&file_key, S3Permission::WRITE)],
@@ -2333,6 +2335,7 @@ async fn upload_s3_file_from_app(
                 let db_with_opt_authed = DbWithOptAuthed::from_authed(&authed, db.clone(), None);
                 let (_, s3_resource) = get_workspace_s3_resource_and_check_paths(
                     &db_with_opt_authed,
+                Some(&authed),
                     &w_id,
                     None,
                     &[(&file_key, S3Permission::WRITE)],
@@ -2443,6 +2446,7 @@ async fn delete_s3_file_from_app(
         let db_with_opt_authed = DbWithOptAuthed::from_authed(&on_behalf_authed, db.clone(), None);
         let (_, s3_resource) = get_workspace_s3_resource_and_check_paths(
             &db_with_opt_authed,
+                Some(&on_behalf_authed),
             &w_id,
             None,
             &[(&path.to_string(), S3Permission::DELETE)],

backend/windmill-common/src/db.rs

@@ -148,6 +148,13 @@ impl<'a, T: Authable + Sync> DbWithOptAuthed<'a, T> {
             DbWithOptAuthed::DB { .. } => None,
         }
     }
+
+    pub fn audit_author(&self) -> Option<&AuditAuthor> {
+        match self {
+            DbWithOptAuthed::UserDB { .. } => None,
+            DbWithOptAuthed::DB { audit_author, .. } => Some(audit_author),
+        }
+    }
 }
 
 impl<'c, 'd, T: Authable + Sync> Acquire<'c> for &'c DbWithOptAuthed<'d, T> {