* s3 proxy works with get (no auth yet)
* nit
* support s3:// syntax
* Support s3:// syntax and fix vite api proxy normalizing double slashes in URI
* s3 checks authed
* nit
* PUT works
* delete file works
* Derive the JWT signature from the backend
* Authorize s3 correctly (JWT signature is never sent in cleartext)
* convert object store error to wmill error for correct status code
* stash
* fix
* POST first request proxy works
* s3 put for duckdb
* factor out direct proxy code
* Fix Issue with backend proxy and wrong signature due to Host header mismatch
* Add _default_ syntax to solve URI normalization issues with signing
* restricted to user paths toggle
* user path restriction works !
* change restriction to allow
* fix
* factor out code
* better permissions UX in object storage settings
* Revert to restrict_to_user_paths
* check permissions in old s3 api
* DuckDB now uses S3 Proxy and no longer needs LFS query
* implement todo
* fix hardcoded w_id
* s3 proxy size limit
* s3_proxy is ee
* nit
* add Google Cloud Storage as option to secondary storage
* GCS secret in duckdb
* fix toolchain compile
* Remove user permissions for v0
* fix ci 2
* fix CI OSS
* fix missing feature flag
* fix unused warning
* integration test fails bc rustc 1.85.0
* ee ref
* fix ci ...
* update ee ref
* feat(backend): retrieve root_job for MiniPulledJob + fix root job for flow jobs
* nit
* nits
* set root_job only if additional information meaning if not equal to innermost or parent
* nit
* feat: add root job env var
* nits
* fix build
* nit
* fix build
* nit
* sqlx
* feat: add 60-second cache for variables and resources with PostgreSQL invalidation
- Add new var_resource_cache module with 60-second TTL
- Implement PostgreSQL NOTIFY/LISTEN for immediate cache invalidation
- Cache get_variable() for non-secret, non-encrypted reads
- Cache get_resource_value() for all read operations
- Add database triggers on variable/resource table changes
- Initialize cache system in main.rs after database connection
- Add Clone derive to ListableVariable for cache compatibility
Performance benefits:
- Avoids database queries on cache hits
- Immediate invalidation ensures data consistency
- Selective caching respects security constraints
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor: move cache to API layer with allow_cache query param
- Move variable/resource cache from windmill-common to windmill-api
- Add allow_cache query parameter to variables and resources endpoints
- Follow raw script cache pattern with timestamp + value structure
- Create proper database migration for notification triggers
- Include encrypted values in cache when appropriate
- Only activate caching when explicitly requested
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* refactor: move cache to API layer with allow_cache query param
Move PostgreSQL LISTEN logic to main.rs following established pattern
- Remove custom listener initialization from cache module
- Add cache invalidation channels to centralized notification handler
- Simplified cache module to only handle cache operations
- Follow raw script cache pattern for notification handling
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* feat: add 60-second cache for workspace key retrieval
This implements a cache with 60-second staleness for the get_workspace_key
function to reduce database queries for workspace encryption keys. The cache
follows the same pattern as the existing CUSTOM_ENVS_CACHE but with a
shorter expiration time.
Requested by @rubenfiszel
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* Extend cache staleness from 60 to 300 seconds
* feat: add cache invalidation notifications for workspace keys
Add PostgreSQL LISTEN/NOTIFY mechanism to invalidate workspace key cache
across all servers and workers when workspace keys change.
- Add database migration with trigger function for workspace_key changes
- Add notification handler in main.rs to remove from WORKSPACE_KEY_CACHE
- Follow same pattern as existing workspace environment cache invalidation
- Ensures distributed cache consistency for workspace encryption keys
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* finish
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
