From 39a9a774178a067e2d5b1054d74fd50fe0bbdf1b Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Tue, 20 Jan 2026 21:44:10 +0100
Subject: [PATCH] fix: S3 advanced custom permissions (#7632)

* audit_author

* Fix S3 Permissions

* ee

* chore: update ee-repo-ref to e8605e72a6c93c9cf43737ebea74dd28e1f00e83

This commit updates the EE repository reference after PR #381 was merged in windmill-ee-private.

Previous ee-repo-ref: 0c8638d3895a1ead9422fc8e428e3e0405e3a060

New ee-repo-ref: e8605e72a6c93c9cf43737ebea74dd28e1f00e83

Automated by sync-ee-ref workflow.

---------

Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt           | 2 +-
 backend/windmill-api/src/apps.rs  | 4 ++++
 backend/windmill-common/src/db.rs | 7 +++++++
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 6d12d9fbb6..cbdbed26f4 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-7842807b641e25c6683f92c385f294c29f33c197
\ No newline at end of file
+e8605e72a6c93c9cf43737ebea74dd28e1f00e83
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index f013db7338..e183c44e22 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -2263,6 +2263,7 @@ async fn upload_s3_file_from_app(
                     );
                     let (_, s3_resource_opt) = get_workspace_s3_resource_and_check_paths(
                         &db_with_opt_authed,
+                        Some(&on_behalf_authed),
                         &w_id,
                         None,
                         &[(&file_key, S3Permission::WRITE)],
@@ -2294,6 +2295,7 @@ async fn upload_s3_file_from_app(
                 DbWithOptAuthed::from_authed(&on_behalf_authed, db.clone(), None);
             let (_, s3_resource_opt) = get_workspace_s3_resource_and_check_paths(
                 &db_with_opt_authed,
+                Some(&on_behalf_authed),
                 &w_id,
                 None,
                 &[(&file_key, S3Permission::WRITE)],
@@ -2333,6 +2335,7 @@ async fn upload_s3_file_from_app(
                 let db_with_opt_authed = DbWithOptAuthed::from_authed(&authed, db.clone(), None);
                 let (_, s3_resource) = get_workspace_s3_resource_and_check_paths(
                     &db_with_opt_authed,
+                Some(&authed),
                     &w_id,
                     None,
                     &[(&file_key, S3Permission::WRITE)],
@@ -2443,6 +2446,7 @@ async fn delete_s3_file_from_app(
         let db_with_opt_authed = DbWithOptAuthed::from_authed(&on_behalf_authed, db.clone(), None);
         let (_, s3_resource) = get_workspace_s3_resource_and_check_paths(
             &db_with_opt_authed,
+                Some(&on_behalf_authed),
             &w_id,
             None,
             &[(&path.to_string(), S3Permission::DELETE)],
diff --git a/backend/windmill-common/src/db.rs b/backend/windmill-common/src/db.rs
index 99c4b893dc..cf938504d3 100644
--- a/backend/windmill-common/src/db.rs
+++ b/backend/windmill-common/src/db.rs
@@ -148,6 +148,13 @@ impl<'a, T: Authable + Sync> DbWithOptAuthed<'a, T> {
             DbWithOptAuthed::DB { .. } => None,
         }
     }
+
+    pub fn audit_author(&self) -> Option<&AuditAuthor> {
+        match self {
+            DbWithOptAuthed::UserDB { .. } => None,
+            DbWithOptAuthed::DB { audit_author, .. } => Some(audit_author),
+        }
+    }
 }
 
 impl<'c, 'd, T: Authable + Sync> Acquire<'c> for &'c DbWithOptAuthed<'d, T> {