updating hub script: adding error logging to git sync

* fix no_uv not affecting deploy

Before this fix no_uv, no_uv_compile and no_uv_install were not affecting Dependency jobs

These jobs are only affected if used USE_PIP_COMPILE or USE_PIP_INSTALL env variables

To make it more consistant, no_uv should also affect dep jobs.

Also make ansible use uv by default

* Make it build

* Add no_uv_usage stats

* Provide build-env for Samael through shell.nix

* Run update_sqlx.sh

* Update ee-repo-ref

* Display memory peak while installing wheels with uv

* Invert DISABLE_NSJAIL

* Make it safer

---------

Co-authored-by: Ruben Fiszel <ruben@windmill.dev>

.github/change-versions-mac.sh

@@ -16,7 +16,7 @@ sed -i '' -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/frontend/
 sed -i '' -e "/^version =/s/= .*/= \"$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
 sed -i '' -e "/^windmill-api =/s/= .*/= \"\\^$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
 sed -i '' -e "/^version =/s/= .*/= \"$VERSION\"/" ${root_dirpath}/python-client/wmill_pg/pyproject.toml
-sed -i '' -e "/^ModuleVersion =/s/= .*/= '$VERSION'/" ${root_dirpath}/powershell-client/WindmillClient/WindmillClient.psd1
+sed -i '' -e "/^[[:space:]]*ModuleVersion[[:space:]]*=/s/= .*/= '$VERSION'/" ${root_dirpath}/powershell-client/WindmillClient/WindmillClient.psd1
 # sed -i '' -e "/^wmill =/s/= .*/= \"\\^$VERSION\"/" python-client/wmill_pg/pyproject.toml
 sed -i '' -e "/^wmill =/s/= .*/= \">=$VERSION\"/" ${root_dirpath}/lsp/Pipfile
 sed -i '' -e "/^wmill_pg =/s/= .*/= \">=$VERSION\"/" ${root_dirpath}/lsp/Pipfile

.github/change-versions.sh

@@ -17,7 +17,7 @@ sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/frontend/pac
 sed -i -e "/^version =/s/= .*/= \"$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
 sed -i -e "/^windmill-api =/s/= .*/= \"\\^$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
 sed -i -e "/^version =/s/= .*/= \"$VERSION\"/" ${root_dirpath}/python-client/wmill_pg/pyproject.toml
-sed -i -e "/^ModuleVersion =/s/= .*/= '$VERSION'/" ${root_dirpath}/powershell-client/WindmillClient/WindmillClient.psd1
+sed -i -e "/^[[:space:]]*ModuleVersion[[:space:]]*=/s/= .*/= '$VERSION'/" ${root_dirpath}/powershell-client/WindmillClient/WindmillClient.psd1
 # sed -i -e "/^wmill =/s/= .*/= \"\\^$VERSION\"/" ${root_dirpath}/python-client/wmill_pg/pyproject.toml
 sed -i -e "/^wmill =/s/= .*/= \">=$VERSION\"/" ${root_dirpath}/lsp/Pipfile
 sed -i -e "/^wmill_pg =/s/= .*/= \">=$VERSION\"/" ${root_dirpath}/lsp/Pipfile

.github/workflows/build-publish-rh-image.yml

@@ -64,7 +64,7 @@ jobs:
           platforms: linux/amd64
           push: true
           build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core,kafka
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core,kafka,php,mysql
           secrets: |
             rh_username=${{ secrets.RH_USERNAME }}
             rh_password=${{ secrets.RH_PASSWORD }}
@@ -81,7 +81,7 @@ jobs:
           platforms: linux/arm64
           push: true
           build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core,kafka
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core,kafka,php,mysql
           secrets: |
             rh_username=${{ secrets.RH_USERNAME }}
             rh_password=${{ secrets.RH_PASSWORD }}

.github/workflows/build-staging-image.yml

@@ -62,7 +62,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core,kafka
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core,kafka,php,mysql
           tags: |
             ${{ steps.meta-ee-public.outputs.tags }}
           labels: |

.github/workflows/build_windows_worker_.yml

@@ -45,7 +45,7 @@ jobs:
           $env:OPENSSL_DIR="${Env:VCPKG_INSTALLATION_ROOT}\installed\x64-windows-static"
           mkdir frontend/build && cd backend
           New-Item -Path . -Name "windmill-api/openapi-deref.yaml" -ItemType "File" -Force
-          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka
+          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka,php,mysql
 
       - name: Rename binary with corresponding architecture
         run: |

.github/workflows/docker-image-rpi4.yml

@@ -67,7 +67,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           build-args: |
-            features=embedding,parquet,openidconnect,deno_core
+            features=embedding,parquet,openidconnect,deno_core,php,mysql
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:dev
             ${{ steps.meta-public.outputs.tags }}

.github/workflows/docker-image.yml

@@ -76,7 +76,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           build-args: |
-            features=embedding,parquet,openidconnect,jemalloc,deno_core
+            features=embedding,parquet,openidconnect,jemalloc,deno_core,dind,php,mysql
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }}
             ${{ steps.meta-public.outputs.tags }}
@@ -138,7 +138,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka,otel,dind,php,mysql
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
             ${{ steps.meta-ee-public.outputs.tags }}
@@ -200,7 +200,7 @@ jobs:
           platforms: linux/amd64
           push: true
           build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka,otel,dind,php,mysql
             PYTHON_IMAGE=python:3.12.2-slim-bookworm
           tags: |
             ${{ steps.meta-ee-public-py312.outputs.tags }}

.github/workflows/publish_windows_worker.yml

@@ -47,7 +47,7 @@ jobs:
           $env:OPENSSL_DIR="${Env:VCPKG_INSTALLATION_ROOT}\installed\x64-windows-static"
           mkdir frontend/build && cd backend
           New-Item -Path . -Name "windmill-api/openapi-deref.yaml" -ItemType "File" -Force
-          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka
+          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka,php,mysql
 
       - name: Rename binary with corresponding architecture
         run: |

CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## [1.437.1](https://github.com/windmill-labs/windmill/compare/v1.437.0...v1.437.1) (2024-12-10)
+
+
+### Bug Fixes
+
+* **frontend:** fix newly deployed apps with frontend scripts ([bcd2cfe](https://github.com/windmill-labs/windmill/commit/bcd2cfe674038042f08f22d05286596b3442caf9))
+
+## [1.437.0](https://github.com/windmill-labs/windmill/compare/v1.436.0...v1.437.0) (2024-12-10)
+
+
+### Features
+
+* add ctx.name to apps [#4885](https://github.com/windmill-labs/windmill/issues/4885) ([2387503](https://github.com/windmill-labs/windmill/commit/23875033dd19d6d585f2433fa7b18a703175e329))
+
+
+### Bug Fixes
+
+* **parsers:** more robust pwsh param parsing ([#4884](https://github.com/windmill-labs/windmill/issues/4884)) ([7014389](https://github.com/windmill-labs/windmill/commit/7014389d677fba563bec02e08815452b195ecd0a))
+* **python:** do not follow symlinks when copying recursively in overlapping sites-package ([c173e46](https://github.com/windmill-labs/windmill/commit/c173e46a724b50d27416bbc169bf2a57fe68808c))
+
+## [1.436.0](https://github.com/windmill-labs/windmill/compare/v1.435.2...v1.436.0) (2024-12-09)
+
+
+### Features
+
+* add db storage for app inline scripts ([#4837](https://github.com/windmill-labs/windmill/issues/4837)) ([2bc4934](https://github.com/windmill-labs/windmill/commit/2bc4934c4f38ca2631eb99140d89a0b3d3b3a2cf))
+* add otlp support ([#4869](https://github.com/windmill-labs/windmill/issues/4869)) ([6d04744](https://github.com/windmill-labs/windmill/commit/6d047449e200d51f060d4107ff5ad0e10af99a66))
+* **cache:** refurbish fs backed cache ([#4863](https://github.com/windmill-labs/windmill/issues/4863)) ([3c4408e](https://github.com/windmill-labs/windmill/commit/3c4408e3dbf8a37c0b862805b1991af3d39ac054))
+* docker runtime ([2c5d07f](https://github.com/windmill-labs/windmill/commit/2c5d07f3d9069b21b877ea2d085f0a851b1975c1))
+* **frontend:** render new job kinds ([#4864](https://github.com/windmill-labs/windmill/issues/4864)) ([691ef64](https://github.com/windmill-labs/windmill/commit/691ef6468823c99ab129c53ae699de1a91f77c97))
+
+
+### Bug Fixes
+
+* fix `flow_node` uniqueness ([#4850](https://github.com/windmill-labs/windmill/issues/4850)) ([667167a](https://github.com/windmill-labs/windmill/commit/667167a022ed31cb67a6c189cc5bd54b09473f4f))
+* handle flow & workspace renames for `flow_node` ([#4861](https://github.com/windmill-labs/windmill/issues/4861)) ([f175158](https://github.com/windmill-labs/windmill/commit/f175158b9ffcc0d9c35938e61dfe3ce56d3b64c2))
+
+## [1.435.2](https://github.com/windmill-labs/windmill/compare/v1.435.1...v1.435.2) (2024-12-05)
+
+
+### Bug Fixes
+
+* job search toast on error ([#4851](https://github.com/windmill-labs/windmill/issues/4851)) ([a99e63f](https://github.com/windmill-labs/windmill/commit/a99e63f5435725c42e38b46933ff3caa345002b5))
+
+## [1.435.1](https://github.com/windmill-labs/windmill/compare/v1.435.0...v1.435.1) (2024-12-05)
+
+
+### Bug Fixes
+
+* improve critical alerts filters ([548cfcf](https://github.com/windmill-labs/windmill/commit/548cfcfbde23ac7ae129e10f6e92d57516e61f20))
+
+## [1.435.0](https://github.com/windmill-labs/windmill/compare/v1.434.2...v1.435.0) (2024-12-05)
+
+
+### Features
+
+* app custom paths ([#4828](https://github.com/windmill-labs/windmill/issues/4828)) ([1ec6c6f](https://github.com/windmill-labs/windmill/commit/1ec6c6f765904361e641d89495890bc87e8544aa))
+
+
+### Bug Fixes
+
+* pass USERPROFILE on windows ([5404ec9](https://github.com/windmill-labs/windmill/commit/5404ec9b48e8d7a0cb27b2319d54f04c94ec6fd0))
+
+## [1.434.2](https://github.com/windmill-labs/windmill/compare/v1.434.1...v1.434.2) (2024-12-04)
+
+
+### Bug Fixes
+
+* custom http routes auth ([#4835](https://github.com/windmill-labs/windmill/issues/4835)) ([02611e4](https://github.com/windmill-labs/windmill/commit/02611e42e1b5c81d9bc57e3b46795e4c8cad67f7))
+
+## [1.434.1](https://github.com/windmill-labs/windmill/compare/v1.434.0...v1.434.1) (2024-11-29)
+
+
+### Bug Fixes
+
+* improve flow status viewer performance ([35a4a53](https://github.com/windmill-labs/windmill/commit/35a4a5390da0d3c2acad0f8af9aae9e4fdc149f5))
+
 ## [1.434.0](https://github.com/windmill-labs/windmill/compare/v1.433.0...v1.434.0) (2024-11-29)
 
 

Dockerfile

@@ -175,9 +175,9 @@ RUN /usr/local/bin/python3 -m pip install pip-tools
 COPY --from=builder /frontend/build /static_frontend
 COPY --from=builder /windmill/target/release/windmill ${APP}/windmill
 
-COPY --from=denoland/deno:2.0.4 --chmod=755 /usr/bin/deno /usr/bin/deno
+COPY --from=denoland/deno:2.1.2 --chmod=755 /usr/bin/deno /usr/bin/deno
 
-COPY --from=oven/bun:1.1.34 /usr/local/bin/bun /usr/bin/bun
+COPY --from=oven/bun:1.1.38 /usr/local/bin/bun /usr/bin/bun
 
 COPY --from=php:8.3.7-cli /usr/local/bin/php /usr/bin/php
 COPY --from=composer:2.7.6 /usr/bin/composer /usr/bin/composer

backend/.sqlx/query-02424907504848e983bfa89eec343061932dc5b4b17cf13d5cf8d833aedbe6d5.json

@@ -5,7 +5,7 @@
     "columns": [
       {
         "ordinal": 0,
-        "name": "bool",
+        "name": "?column?",
         "type_info": "Bool"
       }
     ],

backend/.sqlx/query-062859f1d0e5cfba3115f4241115753b86a4ad239708851c998ff5620ebca5b8.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE queue SET last_ping = now() WHERE id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "062859f1d0e5cfba3115f4241115753b86a4ad239708851c998ff5620ebca5b8"
-}

backend/.sqlx/query-0a46f1f3047d15227f82ae24ad2113eb91d65b98927eaaba427cbde27dd79bfe.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*)\n                 FROM alerts\n                 WHERE COALESCE(acknowledged, false) = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Bool"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "0a46f1f3047d15227f82ae24ad2113eb91d65b98927eaaba427cbde27dd79bfe"
+}

backend/.sqlx/query-0ad36c1598ff4ece0c325eaeb9a9177a87e1accd192402e21db5ae09c3498ab0.json

@@ -44,7 +44,8 @@
                 "deploymentcallback",
                 "singlescriptflow",
                 "flowscript",
-                "flownode"
+                "flownode",
+                "appscript"
               ]
             }
           }

backend/.sqlx/query-0c6c80746733be8f561ab0b631854799f5e8122adaf35465cb16c3dc795bdc3b.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        INSERT INTO app_script (app, hash, lock, code, code_sha256)\n        VALUES ($1, $2, $3, $4, $5)\n        ON CONFLICT (hash) DO UPDATE SET app = EXCLUDED.app -- trivial update to return the id\n        RETURNING id\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Bpchar",
+        "Text",
+        "Text",
+        "Bpchar"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "0c6c80746733be8f561ab0b631854799f5e8122adaf35465cb16c3dc795bdc3b"
+}

backend/.sqlx/query-113b120ae10ea4469ec3575dc3506aaa6d6a8940017a1172403ca9851d0f13a7.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT flow as \"flow!: sqlx::types::Json<Box<RawValue>>\" FROM flow_node WHERE id = $1 LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "flow!: sqlx::types::Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "113b120ae10ea4469ec3575dc3506aaa6d6a8940017a1172403ca9851d0f13a7"
-}

backend/.sqlx/query-1bae415f9440cc1334f24ce3009242cf3a6287e7b4548c7f01ad888230c27013.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT format('rawscript/%s', code_sha256) as \"path!: String\"\n                        FROM app_script WHERE id = $1 LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path!: String",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "1bae415f9440cc1334f24ce3009242cf3a6287e7b4548c7f01ad888230c27013"
+}

backend/.sqlx/query-1ec97e1bf7c6edfa82b7e64585171ca897dcfa9e82618ce8f11afb08a39e3b20.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM app WHERE custom_path = $1 AND ($2::TEXT IS NULL OR workspace_id = $2))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "1ec97e1bf7c6edfa82b7e64585171ca897dcfa9e82618ce8f11afb08a39e3b20"
+}

backend/.sqlx/query-240cf4ba63ec39a7ccfa8360824259d2fdc6681bbbd44e3ccde0a3893f6cf9a0.json

@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n             SELECT \n                MAX (created_at) AS last_deploy, \n              COUNT (*) AS deploys_count \n                  , 'python' AS language\n               FROM metrics \n              WHERE id = 'no_uv_usage_py'\n\n          UNION ALL\n          \n             SELECT \n                MAX (created_at) AS last_deploy, \n              COUNT (*) AS deploys_count \n                  , 'ansible' AS language\n               FROM metrics \n              WHERE id = 'no_uv_usage_ansible'\n          ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "last_deploy",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "deploys_count",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "language",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "240cf4ba63ec39a7ccfa8360824259d2fdc6681bbbd44e3ccde0a3893f6cf9a0"
+}

backend/.sqlx/query-337f31c2172194cd594042c561998a03f751b246c40daf056fced0fd91f6dd73.json

@@ -34,7 +34,8 @@
                 "deploymentcallback",
                 "singlescriptflow",
                 "flowscript",
-                "flownode"
+                "flownode",
+                "appscript"
               ]
             }
           }

backend/.sqlx/query-372eb162ace15a4f07162bb46706eaca91a3616c9bfbd78a408b7079ca9706d4.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*)\n                 FROM alerts\n                 WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "372eb162ace15a4f07162bb46706eaca91a3616c9bfbd78a408b7079ca9706d4"
+}

backend/.sqlx/query-3d77e5b691dab38b3e39477ed980560bacd55c6ae9fafcbb0239163a3d7f3c0c.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT flow AS \"flow!: Json<Box<JsonRawValue>>\" FROM flow_node WHERE id = $1 LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "flow!: Json<Box<JsonRawValue>>",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "3d77e5b691dab38b3e39477ed980560bacd55c6ae9fafcbb0239163a3d7f3c0c"
-}

backend/.sqlx/query-497d93db931922b09f96cf73239513d7141f3d37f85ada46597079991b3bff30.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT \n            MAX (created_at) as last_deploy, \n          COUNT (*) as deploys_count \n           FROM metrics \n          WHERE id = 'no_uv_usage_py'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "last_deploy",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "deploys_count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "497d93db931922b09f96cf73239513d7141f3d37f85ada46597079991b3bff30"
+}

backend/.sqlx/query-5ac7c9eb3ce21e46f90e23435562b5f818a4274ba223f905e68280b86b24fa25.json

@@ -1,27 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        WITH existing AS (\n            SELECT id FROM flow_node\n            WHERE hash = $1 AND path = $2 AND workspace_id = $3 AND code = $4 AND lock = $5 AND (flow IS NOT DISTINCT FROM $6)\n            LIMIT 1\n        ),\n        inserted AS (\n            INSERT INTO flow_node (hash, path, workspace_id, code, lock, flow)\n            VALUES ($1, $2, $3, $4, $5, $6)\n            ON CONFLICT DO NOTHING\n            RETURNING id\n        )\n        SELECT id FROM existing\n        UNION ALL\n        SELECT id FROM inserted\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Text",
-        "Text",
-        "Text",
-        "Text",
-        "Jsonb"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "5ac7c9eb3ce21e46f90e23435562b5f818a4274ba223f905e68280b86b24fa25"
-}

backend/.sqlx/query-5af51d5bf7614274ade044120045893edb73694601544fea7cf20f45dd25a88d.json

@@ -0,0 +1,27 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        INSERT INTO flow_node (path, workspace_id, hash_v2, lock, code, flow)\n        VALUES ($1, $2, $3, $4, $5, $6)\n        ON CONFLICT (path, workspace_id, hash_v2) DO UPDATE SET path = EXCLUDED.path -- trivial update to return the id\n        RETURNING id\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Bpchar",
+        "Text",
+        "Text",
+        "Jsonb"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "5af51d5bf7614274ade044120045893edb73694601544fea7cf20f45dd25a88d"
+}

backend/.sqlx/query-5d7081a9ba0d702f63ed9d44be5ffe0ba043565790865c6a6f52fab6ce340d2c.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT policy as \"policy: sqlx::types::Json<Box<RawValue>>\"\n                FROM app WHERE app.path = $1 AND app.workspace_id = $2 LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "policy: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "5d7081a9ba0d702f63ed9d44be5ffe0ba043565790865c6a6f52fab6ce340d2c"
+}

backend/.sqlx/query-65da41c7ded54cdee8d33211561c068b72294cc99ff44ed0a13179df508ebc6a.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE alerts\n         SET\n           acknowledged = true,\n           acknowledged_workspace = CASE\n             WHEN $2::text IS NOT NULL AND workspace_id = $2 THEN true\n             ELSE acknowledged_workspace\n           END\n         WHERE id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int4",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "65da41c7ded54cdee8d33211561c068b72294cc99ff44ed0a13179df508ebc6a"
-}

backend/.sqlx/query-661f472ff3860983322162420457f5033b9c9afc344d9c3e385ba20a3ad2197a.json

@@ -5,7 +5,7 @@
     "columns": [
       {
         "ordinal": 0,
-        "name": "bool",
+        "name": "?column?",
         "type_info": "Bool"
       }
     ],

backend/.sqlx/query-6a72df33cf12824c54b29dbf011f2390af9d02efc7112a32a84e1a1247a95973.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT worker, worker_instance, vcpus, memory, ping_at, started_at FROM worker_ping WHERE ping_at > now() - interval '30 days' ORDER BY started_at",
+  "query": "SELECT worker, worker_instance, vcpus, memory, ping_at, started_at, worker_group FROM worker_ping WHERE ping_at > now() - interval '30 days' ORDER BY started_at",
   "describe": {
     "columns": [
       {
@@ -32,6 +32,11 @@
         "ordinal": 5,
         "name": "started_at",
         "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 6,
+        "name": "worker_group",
+        "type_info": "Varchar"
       }
     ],
     "parameters": {
@@ -43,8 +48,9 @@
       true,
       true,
       false,
+      false,
       false
     ]
   },
-  "hash": "a51007ca7b509b92faa6fe7aa59fa738594a2b7eaab8e38f3ca30e548f9a49a7"
+  "hash": "6a72df33cf12824c54b29dbf011f2390af9d02efc7112a32a84e1a1247a95973"
 }

backend/.sqlx/query-6aabe704395c9be30c86d15a5d22f3509b4fcea56227b019588837132b64d58b.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT * FROM usr where username = $1 AND workspace_id = $2",
+  "query": "SELECT usr.*, password.super_admin, password.name FROM usr LEFT JOIN password ON usr.email = password.email Where usr.username = $1 AND workspace_id = $2\n        ",
   "describe": {
     "columns": [
       {
@@ -42,6 +42,16 @@
         "ordinal": 7,
         "name": "role",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "super_admin",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 9,
+        "name": "name",
+        "type_info": "Varchar"
       }
     ],
     "parameters": {
@@ -58,8 +68,10 @@
       false,
       false,
       false,
+      true,
+      false,
       true
     ]
   },
-  "hash": "3d363466d79075df3f74f946eff43ca89faefca3bcdf2c533425ca3868b0369a"
+  "hash": "6aabe704395c9be30c86d15a5d22f3509b4fcea56227b019588837132b64d58b"
 }

backend/.sqlx/query-6b53f7c4bb73177316d6134698f3979f51b53dcd4d8ec50d312c9e7fe31ad5f5.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO app\n            (workspace_id, path, summary, policy, versions, draft_only)\n            VALUES ($1, $2, $3, $4, '{}', $5) RETURNING id",
+  "query": "INSERT INTO app\n            (workspace_id, path, summary, policy, versions, draft_only, custom_path)\n            VALUES ($1, $2, $3, $4, '{}', $5, $6) RETURNING id",
   "describe": {
     "columns": [
       {
@@ -15,12 +15,13 @@
         "Varchar",
         "Varchar",
         "Jsonb",
-        "Bool"
+        "Bool",
+        "Text"
       ]
     },
     "nullable": [
       false
     ]
   },
-  "hash": "75e880f9d9fbda36c2314706923cef36e4667d930fb8ee1876dd9ce1c92396b2"
+  "hash": "6b53f7c4bb73177316d6134698f3979f51b53dcd4d8ec50d312c9e7fe31ad5f5"
 }

backend/.sqlx/query-6f4817fad2739a11d89b6704edf62c3c267ca336a8b6bec5b29d4409030ed561.json

@@ -28,7 +28,8 @@
                 "deploymentcallback",
                 "singlescriptflow",
                 "flowscript",
-                "flownode"
+                "flownode",
+                "appscript"
               ]
             }
           }

backend/.sqlx/query-78cd3f9d43dcf292cfa97ed79f9b6ad60469d5a4949729676abdefb3ab2b1a7f.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                      INSERT INTO metrics (id, value) \n                           VALUES ('no_uv_usage_py', $1)\n                    ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "78cd3f9d43dcf292cfa97ed79f9b6ad60469d5a4949729676abdefb3ab2b1a7f"
+}

backend/.sqlx/query-7c32176755c6ea2b6ae531860d436caae3fa256fc0803749ec5107632669adb3.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE alerts \n         SET\n           acknowledged = true,\n           acknowledged_workspace = CASE\n             WHEN $1::text IS NOT NULL THEN true\n             ELSE acknowledged_workspace\n           END\n         WHERE ($1::text IS NOT NULL AND workspace_id = $1)\n            OR ($1::text IS NULL)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "7c32176755c6ea2b6ae531860d436caae3fa256fc0803749ec5107632669adb3"
-}

backend/.sqlx/query-80864158f61adaad8df934acc54ba523c9f17d106298d8781885134d28553d36.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE alerts \n         SET\n           acknowledged = true,\n           acknowledged_workspace = CASE\n             WHEN $2 THEN\n               CASE\n                 WHEN $1::text IS NOT NULL THEN true\n                 ELSE acknowledged_workspace\n               END\n             ELSE true\n           END\n         WHERE ($1::text IS NOT NULL AND workspace_id = $1)\n            OR ($1::text IS NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "80864158f61adaad8df934acc54ba523c9f17d106298d8781885134d28553d36"
+}

backend/.sqlx/query-8653373c2c8301c902e21e8bf5a11480ff040bb987a48b6f66522bc9b7e2c1d8.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT lock, code AS \"code!: String\" FROM flow_node WHERE id = $1 LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "lock",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "code!: String",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": [
-      true,
-      true
-    ]
-  },
-  "hash": "8653373c2c8301c902e21e8bf5a11480ff040bb987a48b6f66522bc9b7e2c1d8"
-}

backend/.sqlx/query-8bd028c8b5f8a4d566f89eebc2e63fd04beaf2b0b49e07c7df42ecddd70737f3.json

@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO resource\n        (workspace_id, path, value, resource_type, created_by, edited_at)\n        VALUES ($1, $2, $3, $4, $5, now()) ON CONFLICT (workspace_id, path)\n        DO UPDATE SET value = $3, edited_at = now()",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Jsonb",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "8bd028c8b5f8a4d566f89eebc2e63fd04beaf2b0b49e07c7df42ecddd70737f3"
+}

backend/.sqlx/query-951c053cf756f00e1da26b06edb3d0193a0ee707e6482a892db58915e0c8a27f.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*)\n                 FROM alerts",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "951c053cf756f00e1da26b06edb3d0193a0ee707e6482a892db58915e0c8a27f"
+}

backend/.sqlx/query-9d3556319411a27a875bf6cf0e5eda837cc63e4d8be912c0b5bfeea4a0c8db2e.json

@@ -28,7 +28,8 @@
                 "deploymentcallback",
                 "singlescriptflow",
                 "flowscript",
-                "flownode"
+                "flownode",
+                "appscript"
               ]
             }
           }

backend/.sqlx/query-a1f8667bfd5b000dd7ba384e78f2bd7fabb6b8055f4559f77e20eef7c2b1c902.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                      INSERT INTO metrics (id, value) \n                           VALUES ('no_uv_usage_py', ''::text::jsonb)\n                    ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "a1f8667bfd5b000dd7ba384e78f2bd7fabb6b8055f4559f77e20eef7c2b1c902"
+}

backend/.sqlx/query-aa98ab0e4b9a0eb41a804ab047a120444af65b1dc43a234821cde5bf6bf8b74f.json

@@ -1,27 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        WITH existing AS (\n            SELECT id FROM flow_node\n            WHERE hash = $1 AND path = $2 AND workspace_id = $3 AND code = $4 AND lock = $5 AND flow = $6\n            LIMIT 1\n        ),\n        inserted AS (\n            INSERT INTO flow_node (hash, path, workspace_id, code, lock, flow)\n            VALUES ($1, $2, $3, $4, $5, $6)\n            ON CONFLICT DO NOTHING\n            RETURNING id\n        )\n        SELECT id FROM existing\n        UNION ALL\n        SELECT id FROM inserted\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Text",
-        "Text",
-        "Text",
-        "Text",
-        "Jsonb"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "aa98ab0e4b9a0eb41a804ab047a120444af65b1dc43a234821cde5bf6bf8b74f"
-}

backend/.sqlx/query-b9ed42d4b795942251baafd016b4361e75257c0e5faf8795274ec86236a27413.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*)\n                 FROM alerts\n                 WHERE workspace_id = $1 AND COALESCE(acknowledged_workspace, false) = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "b9ed42d4b795942251baafd016b4361e75257c0e5faf8795274ec86236a27413"
+}

backend/.sqlx/query-cd4067e68b375461a495f402d05976da6c6e331d5748bf6f8d59f9f75c027fe8.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE alerts\n         SET\n           acknowledged = true,\n           acknowledged_workspace = CASE\n             WHEN $3 THEN\n               CASE\n                 WHEN $2::text IS NOT NULL AND workspace_id = $2 THEN true\n                 ELSE acknowledged_workspace\n               END\n             ELSE true\n           END\n         WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int4",
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "cd4067e68b375461a495f402d05976da6c6e331d5748bf6f8d59f9f75c027fe8"
+}

backend/.sqlx/query-d4878143442a303e624ab78300464a77334a0aad0cbf219250e4e811b1d16052.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                      INSERT INTO metrics (id, value) \n                           VALUES ('no_uv_usage_ansible', $1)\n                    ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "d4878143442a303e624ab78300464a77334a0aad0cbf219250e4e811b1d16052"
+}

backend/.sqlx/query-d6615719bf8db4b333ed55c9a3c160ad1962668fc3305d8e80ae91ef73614a80.json

@@ -5,7 +5,7 @@
     "columns": [
       {
         "ordinal": 0,
-        "name": "bool",
+        "name": "?column?",
         "type_info": "Bool"
       }
     ],

backend/.sqlx/query-dc32e9e81eab9cda88875020acc414271b96d251bcf54c153c45370d917eea9d.json

@@ -1,27 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        WITH existing AS (\n            SELECT id FROM flow_node\n            WHERE hash = $1 AND path = $2 AND workspace_id = $3\n                AND (code IS NOT DISTINCT FROM $4)\n                AND (lock IS NOT DISTINCT FROM $5)\n                AND (flow IS NOT DISTINCT FROM $6)\n            LIMIT 1\n        ),\n        inserted AS (\n            INSERT INTO flow_node (hash, path, workspace_id, code, lock, flow)\n            VALUES ($1, $2, $3, $4, $5, $6)\n            ON CONFLICT DO NOTHING\n            RETURNING id\n        )\n        SELECT id FROM existing\n        UNION ALL\n        SELECT id FROM inserted\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Text",
-        "Text",
-        "Text",
-        "Text",
-        "Jsonb"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "dc32e9e81eab9cda88875020acc414271b96d251bcf54c153c45370d917eea9d"
-}

backend/.sqlx/query-ea9bbb972217bab4d7e8f4c08e331899161e80c239d56eb657d73bbf4272939b.json

@@ -1,10 +1,15 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT value FROM app_version WHERE id = $1",
+  "query": "SELECT app_id, value FROM app_version WHERE id = $1",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
+        "name": "app_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
         "name": "value",
         "type_info": "Json"
       }
@@ -15,8 +20,9 @@
       ]
     },
     "nullable": [
+      false,
       false
     ]
   },
-  "hash": "29fce7e56bb4a874b4c1e3a6454273203aab7344abd03df4d86e4c5f5b9a394a"
+  "hash": "ea9bbb972217bab4d7e8f4c08e331899161e80c239d56eb657d73bbf4272939b"
 }

backend/.sqlx/query-eb125df0f64c0caa07f50dc82e8ae9c6cd2872c7afe96d41bed731c5041ab671.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT \n            MAX (created_at) as last_deploy, \n          COUNT (*) as deploys_count \n           FROM metrics \n          WHERE id = 'no_uv_usage_ansible'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "last_deploy",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "deploys_count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "eb125df0f64c0caa07f50dc82e8ae9c6cd2872c7afe96d41bed731c5041ab671"
+}

backend/.sqlx/query-ee16199b4af456198fae062e948914fca6fc0a8787e4f8d520766b1c89f23602.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO app_version_lite (id, value) VALUES ($1, $2)\n             ON CONFLICT (id) DO UPDATE SET value = EXCLUDED.value",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ee16199b4af456198fae062e948914fca6fc0a8787e4f8d520766b1c89f23602"
+}

backend/.sqlx/query-f9fc0084fe086ef80005bb64a8bb6b493e53583017c18e2ab44f44125c52d548.json

@@ -48,7 +48,8 @@
                 "deploymentcallback",
                 "singlescriptflow",
                 "flowscript",
-                "flownode"
+                "flownode",
+                "appscript"
               ]
             }
           }

backend/.sqlx/query-fb1399c1dc171ec6bb24fee3477a1d606d9725e20e9c2d76a0887fadfd87f8df.json

@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM app WHERE custom_path = $1 AND ($2::TEXT IS NULL OR workspace_id = $2) AND NOT (path = $3 AND workspace_id = $4))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "fb1399c1dc171ec6bb24fee3477a1d606d9725e20e9c2d76a0887fadfd87f8df"
+}

backend/.sqlx/query-ffa86babfcab107caffb8dda31a66b142fa628b8983b966357deb3d5e0a1df3c.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT lock, code AS \"code!: String\" FROM flow_node WHERE id = $1",
+  "query": "SELECT lock, code FROM app_script WHERE id = $1 LIMIT 1",
   "describe": {
     "columns": [
       {
@@ -10,7 +10,7 @@
       },
       {
         "ordinal": 1,
-        "name": "code!: String",
+        "name": "code",
         "type_info": "Text"
       }
     ],
@@ -21,8 +21,8 @@
     },
     "nullable": [
       true,
-      true
+      false
     ]
   },
-  "hash": "15a5db0202c61ed187d9594311cb32cbde4240e143df1c980843dcdfeef3499e"
+  "hash": "ffa86babfcab107caffb8dda31a66b142fa628b8983b966357deb3d5e0a1df3c"
 }

backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.434.0"
+version = "1.437.1"
 authors.workspace = true
 edition.workspace = true
 
@@ -29,7 +29,7 @@ members = [
 ]
 
 [workspace.package]
-version = "1.434.0"
+version = "1.437.1"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -63,6 +63,10 @@ tantivy = ["dep:windmill-indexer", "windmill-api/tantivy"]
 sqlx = ["windmill-worker/sqlx"]
 deno_core = ["windmill-worker/deno_core", "dep:deno_core"]
 kafka = ["windmill-api/kafka"]
+otel = ["windmill-common/otel", "windmill-worker/otel"]
+dind = ["windmill-worker/dind"]
+php = ["windmill-worker/php"]
+mysql = ["windmill-worker/mysql"]
 
 [dependencies]
 anyhow.workspace = true
@@ -95,7 +99,6 @@ deno_core = { workspace = true, optional = true }
 object_store = { workspace = true, optional = true }
 quote.workspace = true
 
-
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
 tikv-jemallocator = { optional = true, workspace = true }
 tikv-jemalloc-sys = { optional = true, workspace = true }
@@ -137,7 +140,7 @@ windmill-api-client = { path = "./windmill-api-client" }
 axum = { version = "^0.7", features = ["multipart"] }
 headers = "^0"
 hyper = { version = "^1", features = ["full"] }
-tokio = { version = "^1", features = ["full", "tracing"] }
+tokio = { version = "^1.42.0", features = ["full", "tracing"] }
 tower = "^0"
 tower-http = { version = "^0.6", features = ["trace", "cors"] }
 tower-cookies = "^0.10"
@@ -182,15 +185,16 @@ itertools = "^0"
 regex = "^1"
 semver = "^1"
 
-deno_fetch = "0.195.0"
-deno_tls = "0.158.0"
-deno_console = "0.171.0"
-deno_url = "0.171.0"
-deno_webidl = "0.171.0"
-deno_web = "0.202.0"
-deno_net = "0.163.0"
-deno_core = "0.311.0"
-deno_ast = { version = "=0.42.2", features = ["transpiling"] }
+deno_fetch = "0.203.0"
+deno_tls = "0.166.0"
+deno_console = "0.179.0"
+deno_url = "0.179.0"
+deno_webidl = "0.179.0"
+deno_web = "0.210.0"
+deno_net = "0.171.0"
+deno_core = "0.321.0"
+deno_ast = { version = "=0.43.3", features = ["transpiling"] }
+deno_permissions = "0.39.0"
 
 swc_common = "=0.37.5"
 swc_ecma_parser = "=0.149.1"
@@ -279,11 +283,23 @@ tar = "^0"
 http = "^1"
 async-stream = "^0"
 
+opentelemetry = "0.27.0"
+tracing-opentelemetry = "0.28.0"
+opentelemetry_sdk = { version = "*", features = ["rt-tokio"] }
+opentelemetry-otlp = { version = "0.27.0", features = ["grpc-tonic", "tls"] }
+opentelemetry-appender-tracing = "0.27.0"
+opentelemetry-semantic-conventions = { version = "*", features = ["semconv_experimental"] }
+
+bollard = "0.18.1"
+
+tonic = { version = "^0", features = ["tls-native-roots"] }
+
 tikv-jemallocator = { version = "0.5" }
 tikv-jemalloc-sys  = { version = "^0.5" }
 tikv-jemalloc-ctl = { version = "^0.5" }
 
 triomphe = "^0"
+pin-project-lite = "^0"
 
 tantivy = "0.22.0"
 

backend/ee-repo-ref.txt

@@ -1 +1 @@
-aefbc1e2188fea312996fcfc30a29d8fb5315316
+271c210ddbbdcad0f4d6c007e650eceda5ddfa64

backend/migrations/20241202095902_app_script.down.sql

@@ -0,0 +1,3 @@
+-- Add down migration script here
+DROP TABLE IF EXISTS app_version_lite;
+DROP TABLE IF EXISTS app_script;

backend/migrations/20241202095902_app_script.up.sql

@@ -0,0 +1,26 @@
+-- Add up migration script here
+ALTER TYPE JOB_KIND ADD VALUE IF NOT EXISTS 'appscript';
+
+-- Same as `app_version` but with a "lite" value (w/ `inlineScript.{code,lock}`).
+CREATE TABLE app_version_lite (
+    id BIGSERIAL PRIMARY KEY,
+    value JSONB,
+    FOREIGN KEY (id) REFERENCES app_version (id) ON DELETE CASCADE
+);
+
+GRANT ALL ON app_version_lite TO windmill_user;
+GRANT ALL ON app_version_lite TO windmill_admin;
+
+-- App `inlineScript`.
+CREATE TABLE app_script (
+    id BIGSERIAL PRIMARY KEY,
+    app BIGSERIAL NOT NULL,
+    hash CHAR(64) NOT NULL UNIQUE, -- sha256 of `app`, `lock`, `code`.
+    lock TEXT,
+    code TEXT NOT NULL,
+    code_sha256 CHAR(64) NOT NULL, -- used to retrieve the policy.
+    FOREIGN KEY (app) REFERENCES app (id) ON DELETE CASCADE
+);
+
+GRANT ALL ON app_script TO windmill_user;
+GRANT ALL ON app_script TO windmill_admin;

backend/migrations/20241202134622_app_custom_path.down.sql

@@ -0,0 +1,2 @@
+-- Add down migration script here
+ALTER TABLE app DROP COLUMN custom_path;

backend/migrations/20241202134622_app_custom_path.up.sql

@@ -0,0 +1,2 @@
+-- Add up migration script here
+ALTER TABLE app ADD COLUMN custom_path TEXT CHECK (custom_path ~ '^[\w-]+(\/[\w-]+)*$');

backend/migrations/20241204154025_grant_all_concurrency_key.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20241204154025_grant_all_concurrency_key.up.sql

@@ -0,0 +1,3 @@
+-- Add up migration script here
+GRANT ALL ON concurrency_key TO windmill_admin;
+GRANT ALL ON concurrency_key TO windmill_user;

backend/migrations/20241205135747_fix_flow_node_uniqueness.down.sql

@@ -0,0 +1,2 @@
+-- Add down migration script here
+ALTER TABLE flow_node DROP COLUMN hash_v2;

backend/migrations/20241205135747_fix_flow_node_uniqueness.up.sql

@@ -0,0 +1,4 @@
+-- Add up migration script here
+CREATE SEQUENCE IF NOT EXISTS flow_node_hash_seq;
+ALTER TABLE flow_node ALTER COLUMN hash DROP NOT NULL;
+ALTER TABLE flow_node ADD COLUMN hash_v2 CHAR(64) NOT NULL UNIQUE DEFAULT to_hex(nextval('flow_node_hash_seq'));

backend/migrations/20241206075559_flow_node_unique_2.down.sql

@@ -0,0 +1,3 @@
+-- Add down migration script here
+ALTER TABLE flow_node DROP CONSTRAINT IF EXISTS flow_node_unique_2;
+ALTER TABLE flow_node ADD CONSTRAINT flow_node_hash_v2_key UNIQUE (hash_v2);

backend/migrations/20241206075559_flow_node_unique_2.up.sql

@@ -0,0 +1,3 @@
+-- Add up migration script here
+ALTER TABLE flow_node ADD CONSTRAINT flow_node_unique_2 UNIQUE (path, workspace_id, hash_v2);
+ALTER TABLE flow_node DROP CONSTRAINT IF EXISTS flow_node_hash_v2_key;

backend/migrations/20241210184049_drop_app_lite.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20241210184049_drop_app_lite.up.sql

@@ -0,0 +1,2 @@
+-- Add up migration script here
+delete from app_version_lite;

backend/oauth_connect.json

@@ -172,5 +172,13 @@
       "user-library-read"
     ]
   },
+  "xero": {
+    "auth_url": "https://login.xero.com/identity/connect/authorize",
+    "token_url": "https://identity.xero.com/connect/token",
+    "scopes": [
+      "offline_access",
+      "accounting.transactions"
+    ]
+  },
   "snowflake_oauth": {}
 }

backend/parsers/windmill-parser-bash/src/lib.rs

@@ -9,7 +9,7 @@ use regex_lite::Regex;
 
 use serde_json::json;
 
-use std::collections::HashMap;
+use std::{collections::HashMap, str::FromStr};
 use windmill_parser::{Arg, MainArgSignature, Typ};
 
 pub fn parse_bash_sig(code: &str) -> anyhow::Result<MainArgSignature> {
@@ -84,36 +84,94 @@ fn parse_bash_file(code: &str) -> anyhow::Result<Option<Vec<Arg>>> {
     Ok(Some(args))
 }
 
+enum ParserState {
+    Normal,
+    InSingleQuote,
+    InDoubleQuote,
+}
+fn split_pwsh_args(code: &str) -> Vec<&str> {
+    let mut chars = code.char_indices().peekable();
+    let mut state = ParserState::Normal;
+    let mut splits = vec![];
+    let mut last_idx = 0;
+    while let Some((idx, char)) = chars.next() {
+        match (&state, char) {
+            (ParserState::Normal, '\'') => {
+                state = ParserState::InSingleQuote;
+            }
+            (ParserState::Normal, '"') => {
+                state = ParserState::InDoubleQuote;
+            }
+            (ParserState::InSingleQuote, '\'') => {
+                state = ParserState::Normal;
+            }
+            (ParserState::InDoubleQuote, '"') => {
+                state = ParserState::Normal;
+            }
+            (ParserState::Normal, ',') => {
+                splits.push(&code[last_idx..idx]);
+                last_idx = idx + 1; // skip the comma
+            }
+            _ => {}
+        }
+    }
+
+    if last_idx < code.len() {
+        splits.push(&code[last_idx..]);
+    }
+
+    splits
+}
+
 fn parse_powershell_file(code: &str) -> anyhow::Result<Option<Vec<Arg>>> {
     let param_wrapper = RE_POWERSHELL_PARAM.captures(code);
     let mut args = vec![];
     if let Some(param_wrapper) = param_wrapper {
         let param_wrapper = param_wrapper.get(1).unwrap().as_str();
-        for cap in RE_POWERSHELL_ARGS.captures_iter(param_wrapper) {
-            let typ = cap
-                .get(1)
-                .map(|x| x.as_str().to_string())
-                .unwrap_or("string".to_string());
-            let name = cap.get(2).unwrap().as_str().to_string();
-            let default = cap
-                .get(3)
-                .or(cap.get(4))
-                .map(|x| json!(x.as_str().to_string()));
+        let params = split_pwsh_args(param_wrapper);
+        for param in params {
+            if let Some(cap) = RE_POWERSHELL_ARGS.captures(param) {
+                let typ = cap.get(1).map(|x| x.as_str().to_string());
+                let name = cap.get(2).unwrap().as_str().to_string();
 
-            args.push(Arg {
-                name: name,
-                typ: match typ.as_str() {
-                    "string" => Typ::Str(None),
-                    "int" | "long" => Typ::Int,
-                    "decimal" | "double" | "single" => Typ::Float,
-                    "datetime" | "DateTime" => Typ::Datetime,
-                    _ => Typ::Str(None),
-                },
-                default: default.clone(),
-                otyp: None,
-                has_default: default.is_some(),
-                oidx: None,
-            });
+                let mut parsed_typ = if let Some(typ) = typ {
+                    match typ.as_str() {
+                        "string" => Some(Typ::Str(None)),
+                        "int" | "long" => Some(Typ::Int),
+                        "decimal" | "double" | "single" => Some(Typ::Float),
+                        "datetime" | "DateTime" => Some(Typ::Datetime),
+                        _ => None,
+                    }
+                } else {
+                    None
+                };
+
+                let default = if let Some(x) = cap.get(3) {
+                    Some(json!(x.as_str().to_string()))
+                } else if let Some(x) = cap.get(4) {
+                    if parsed_typ.is_none() {
+                        if x.as_str().parse::<i64>().is_ok() {
+                            parsed_typ = Some(Typ::Int);
+                        } else if x.as_str().parse::<f64>().is_ok() {
+                            parsed_typ = Some(Typ::Float);
+                        }
+                    }
+                    serde_json::Number::from_str(x.as_str())
+                        .ok()
+                        .map(serde_json::Value::Number)
+                } else {
+                    None
+                };
+
+                args.push(Arg {
+                    name: name,
+                    typ: parsed_typ.unwrap_or(Typ::Str(None)),
+                    default: default.clone(),
+                    otyp: None,
+                    has_default: default.is_some(),
+                    oidx: None,
+                });
+            }
         }
     }
     Ok(Some(args))
@@ -192,4 +250,77 @@ non_required="${5:-}"
 
         Ok(())
     }
+
+    #[test]
+    fn test_parse_powershell_sig() -> anyhow::Result<()> {
+        let code = r#"param($Msg, [string]$Msg2, $Dflt = "default value, with comma", [int]$Nb = 3 , $Nb2 = 5.0, $Nb3 = 5, $Wahoo = $env:WAHOO)"#;
+        assert_eq!(
+            parse_powershell_sig(code)?,
+            MainArgSignature {
+                star_args: false,
+                star_kwargs: false,
+                args: vec![
+                    Arg {
+                        otyp: None,
+                        name: "Msg".to_string(),
+                        typ: Typ::Str(None),
+                        default: None,
+                        has_default: false,
+                        oidx: None
+                    },
+                    Arg {
+                        otyp: None,
+                        name: "Msg2".to_string(),
+                        typ: Typ::Str(None),
+                        default: None,
+                        has_default: false,
+                        oidx: None
+                    },
+                    Arg {
+                        otyp: None,
+                        name: "Dflt".to_string(),
+                        typ: Typ::Str(None),
+                        default: Some(json!("default value, with comma")),
+                        has_default: true,
+                        oidx: None
+                    },
+                    Arg {
+                        otyp: None,
+                        name: "Nb".to_string(),
+                        typ: Typ::Int,
+                        default: Some(json!(3)),
+                        has_default: true,
+                        oidx: None
+                    },
+                    Arg {
+                        otyp: None,
+                        name: "Nb2".to_string(),
+                        typ: Typ::Float,
+                        default: Some(json!(5.0)),
+                        has_default: true,
+                        oidx: None
+                    },
+                    Arg {
+                        otyp: None,
+                        name: "Nb3".to_string(),
+                        typ: Typ::Int,
+                        default: Some(json!(5)),
+                        has_default: true,
+                        oidx: None
+                    },
+                    Arg {
+                        otyp: None,
+                        name: "Wahoo".to_string(),
+                        typ: Typ::Str(None),
+                        default: None,
+                        has_default: false,
+                        oidx: None
+                    }
+                ],
+                no_main_func: None,
+                has_preprocessor: None
+            }
+        );
+        Ok(())
+    }
 }

backend/src/main.rs

@@ -8,7 +8,7 @@
 
 use anyhow::Context;
 use monitor::{
-    reload_delete_logs_periodically_setting, reload_indexer_config,
+    load_base_url, load_otel, reload_delete_logs_periodically_setting, reload_indexer_config,
     reload_timeout_wait_result_setting, send_current_log_file_to_object_store,
     send_logs_to_object_store,
 };
@@ -37,7 +37,7 @@ use windmill_common::{
         EXPOSE_METRICS_SETTING, EXTRA_PIP_INDEX_URL_SETTING, HUB_BASE_URL_SETTING, INDEXER_SETTING,
         JOB_DEFAULT_TIMEOUT_SECS_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING,
         LICENSE_KEY_SETTING, MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPM_CONFIG_REGISTRY_SETTING,
-        OAUTH_SETTING, PIP_INDEX_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING,
+        OAUTH_SETTING, OTEL_SETTING, PIP_INDEX_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING,
         REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING,
         SAML_METADATA_SETTING, SCIM_TOKEN_SETTING, SMTP_SETTING, TIMEOUT_WAIT_RESULT_SETTING,
     },
@@ -221,11 +221,66 @@ async fn windmill_main() -> anyhow::Result<()> {
 
     let hostname = hostname();
 
-    #[cfg(not(feature = "flamegraph"))]
-    let _guard = windmill_common::tracing_init::initialize_tracing(&hostname);
+    let mut enable_standalone_indexer: bool = false;
+
+    let mode = std::env::var("MODE")
+        .map(|x| x.to_lowercase())
+        .map(|x| {
+            if &x == "server" {
+                println!("Binary is in 'server' mode");
+                Mode::Server
+            } else if &x == "worker" {
+                tracing::info!("Binary is in 'worker' mode");
+                #[cfg(windows)]
+                {
+                    println!("It is highly recommended to use the agent mode instead on windows (MODE=agent) and to pass a BASE_INTERNAL_URL");
+                }
+                Mode::Worker
+            } else if &x == "agent" {
+                println!("Binary is in 'agent' mode");
+                if std::env::var("BASE_INTERNAL_URL").is_err() {
+                    panic!("BASE_INTERNAL_URL is required in agent mode")
+                }
+                if std::env::var("JOB_TOKEN").is_err() {
+                    println!("JOB_TOKEN is not passed, hence workers will still need to create permissions for each job and the DATABASE_URL needs to be of a role that can INSERT into the job_perms table")
+                }
+
+                #[cfg(not(feature = "enterprise"))]
+                {
+                    panic!("Agent mode is only available in the EE, ignoring...");
+                }
+                #[cfg(feature = "enterprise")]
+                Mode::Agent
+            } else if &x == "indexer" {
+                tracing::info!("Binary is in 'indexer' mode");
+                #[cfg(not(feature = "tantivy"))]
+                {
+                    eprintln!("Cannot start the indexer because tantivy is not included in this binary/image. Make sure you are using the EE image if you want to access the full text search features.");
+                    panic!("Indexer mode requires compiling with the tantivy feature flag.");
+                }
+                #[cfg(feature = "tantivy")]
+                Mode::Indexer
+            } else if &x == "standalone+search"{
+                    enable_standalone_indexer = true;
+                    println!("Binary is in 'standalone' mode with search enabled");
+                    Mode::Standalone
+            }
+            else {
+                if &x != "standalone" {
+                    eprintln!("mode not recognized, defaulting to standalone: {x}");
+                } else {
+                    println!("Binary is in 'standalone' mode");
+                }
+                Mode::Standalone
+            }
+        })
+        .unwrap_or_else(|_| {
+            tracing::info!("Mode not specified, defaulting to standalone");
+            Mode::Standalone
+        });
 
     #[cfg(all(not(target_env = "msvc"), feature = "jemalloc"))]
-    tracing::info!("jemalloc enabled");
+    println!("jemalloc enabled");
 
     #[cfg(feature = "flamegraph")]
     let _guard = windmill_common::tracing_init::setup_flamegraph();
@@ -236,13 +291,13 @@ async fn windmill_main() -> anyhow::Result<()> {
         "cache" => {
             #[cfg(feature = "embedding")]
             {
-                tracing::info!("Caching embedding model...");
+                println!("Caching embedding model...");
                 windmill_api::embeddings::ModelInstance::load_model_files().await?;
-                tracing::info!("Cached embedding model");
+                println!("Cached embedding model");
             }
             #[cfg(not(feature = "embedding"))]
             {
-                tracing::warn!("Embeddings are not enabled, ignoring...");
+                println!("Embeddings are not enabled, ignoring...");
             }
 
             cache_hub_scripts(std::env::args().nth(2)).await?;
@@ -256,64 +311,6 @@ async fn windmill_main() -> anyhow::Result<()> {
         _ => {}
     }
 
-    let mut enable_standalone_indexer: bool = false;
-
-    let mode = std::env::var("MODE")
-        .map(|x| x.to_lowercase())
-        .map(|x| {
-            if &x == "server" {
-                tracing::info!("Binary is in 'server' mode");
-                Mode::Server
-            } else if &x == "worker" {
-                tracing::info!("Binary is in 'worker' mode");
-                #[cfg(windows)]
-                {
-                    tracing::warn!("It is highly recommended to use the agent mode instead on windows (MODE=agent) and to pass a BASE_INTERNAL_URL");
-                }
-                Mode::Worker
-            } else if &x == "agent" {
-                tracing::info!("Binary is in 'agent' mode");
-                if std::env::var("BASE_INTERNAL_URL").is_err() {
-                    panic!("BASE_INTERNAL_URL is required in agent mode")
-                }
-                if std::env::var("JOB_TOKEN").is_err() {
-                    tracing::warn!("JOB_TOKEN is not passed, hence workers will still need to create permissions for each job and the DATABASE_URL needs to be of a role that can INSERT into the job_perms table")
-                }
-
-                #[cfg(not(feature = "enterprise"))]
-                {
-                    panic!("Agent mode is only available in the EE, ignoring...");
-                }
-                #[cfg(feature = "enterprise")]
-                Mode::Agent
-            } else if &x == "indexer" {
-                tracing::info!("Binary is in 'indexer' mode");
-                #[cfg(not(feature = "tantivy"))]
-                {
-                    tracing::error!("Cannot start the indexer because tantivy is not included in this binary/image. Make sure you are using the EE image if you want to access the full text search features.");
-                    panic!("Indexer mode requires compiling with the tantivy feature flag.");
-                }
-                #[cfg(feature = "tantivy")]
-                Mode::Indexer
-            } else if &x == "standalone+search"{
-                    enable_standalone_indexer = true;
-                    tracing::info!("Binary is in 'standalone' mode with search enabled");
-                    Mode::Standalone
-            }
-            else {
-                if &x != "standalone" {
-                    tracing::error!("mode not recognized, defaulting to standalone: {x}");
-                } else {
-                    tracing::info!("Binary is in 'standalone' mode");
-                }
-                Mode::Standalone
-            }
-        })
-        .unwrap_or_else(|_| {
-            tracing::info!("Mode not specified, defaulting to standalone");
-            Mode::Standalone
-        });
-
     #[allow(unused_mut)]
     let mut num_workers = if mode == Mode::Server || mode == Mode::Indexer {
         0
@@ -325,7 +322,7 @@ async fn windmill_main() -> anyhow::Result<()> {
     };
 
     if num_workers > 1 {
-        tracing::warn!(
+        println!(
             "We STRONGLY recommend using at most 1 worker per container, use at your own risks"
         );
     }
@@ -347,10 +344,26 @@ async fn windmill_main() -> anyhow::Result<()> {
         IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1))
     };
 
-    tracing::info!("Connecting to database...");
+    println!("Connecting to database...");
     let db = windmill_common::connect_db(server_mode, indexer_mode).await?;
+
+    load_otel(&db).await;
+
     tracing::info!("Database connected");
 
+    let environment = load_base_url(&db)
+        .await
+        .unwrap_or_else(|_| "local".to_string())
+        .trim_start_matches("https://")
+        .trim_start_matches("http://")
+        .split(".")
+        .next()
+        .unwrap_or_else(|| "local")
+        .to_string();
+
+    #[cfg(not(feature = "flamegraph"))]
+    let _guard = windmill_common::tracing_init::initialize_tracing(&hostname, &mode, &environment);
+
     let num_version = sqlx::query_scalar!("SELECT version()").fetch_one(&db).await;
 
     tracing::info!(
@@ -776,6 +789,15 @@ Windmill Community Edition {GIT_VERSION}
                                                         tracing::error!(error = %e, "Could not reload debug metrics setting");
                                                     }
                                                 },
+                                                OTEL_SETTING => {
+                                                    tracing::info!("OTEL setting changed, restarting");
+                                                    // we wait a bit randomly to avoid having all servers and workers shutdown at same time
+                                                    let rd_delay = rand::thread_rng().gen_range(0..4);
+                                                    tokio::time::sleep(Duration::from_secs(rd_delay)).await;
+                                                    if let Err(e) = tx.send(()) {
+                                                        tracing::error!(error = %e, "Could not send killpill");
+                                                    }
+                                                },
                                                 REQUEST_SIZE_LIMIT_SETTING => {
                                                     if server_mode {
                                                         tracing::info!("Request limit size change detected, killing server expecting to be restarted");

backend/src/monitor.rs

@@ -12,7 +12,7 @@ use std::{
 
 use chrono::{NaiveDateTime, Utc};
 use futures::{stream::FuturesUnordered, StreamExt};
-use serde::de::DeserializeOwned;
+use serde::{de::DeserializeOwned, Deserializer};
 use sqlx::{Pool, Postgres};
 use tokio::{
     join,
@@ -40,7 +40,7 @@ use windmill_common::{
         EXTRA_PIP_INDEX_URL_SETTING, HUB_BASE_URL_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING,
         JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING,
         MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPM_CONFIG_REGISTRY_SETTING, OAUTH_SETTING,
-        PIP_INDEX_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING,
+        OTEL_SETTING, PIP_INDEX_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING,
         REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING,
         SAML_METADATA_SETTING, SCIM_TOKEN_SETTING, TIMEOUT_WAIT_RESULT_SETTING,
     },
@@ -58,7 +58,8 @@ use windmill_common::{
     },
     BASE_URL, CRITICAL_ALERT_MUTE_UI_ENABLED, CRITICAL_ERROR_CHANNELS, DB, DEFAULT_HUB_BASE_URL,
     HUB_BASE_URL, JOB_RETENTION_SECS, METRICS_DEBUG_ENABLED, METRICS_ENABLED,
-    MONITOR_LOGS_ON_OBJECT_STORE, SERVICE_LOG_RETENTION_SECS,
+    MONITOR_LOGS_ON_OBJECT_STORE, OTEL_LOGS_ENABLED, OTEL_METRICS_ENABLED, OTEL_TRACING_ENABLED,
+    SERVICE_LOG_RETENTION_SECS,
 };
 use windmill_queue::cancel_job;
 use windmill_worker::{
@@ -85,12 +86,12 @@ lazy_static::lazy_static! {
     static ref ZOMBIE_JOB_TIMEOUT: String = std::env::var("ZOMBIE_JOB_TIMEOUT")
     .ok()
     .and_then(|x| x.parse::<String>().ok())
-    .unwrap_or_else(|| "30".to_string());
+    .unwrap_or_else(|| "60".to_string());
 
     static ref FLOW_ZOMBIE_TRANSITION_TIMEOUT: String = std::env::var("FLOW_ZOMBIE_TRANSITION_TIMEOUT")
     .ok()
     .and_then(|x| x.parse::<String>().ok())
-    .unwrap_or_else(|| "30".to_string());
+    .unwrap_or_else(|| "60".to_string());
 
 
     pub static ref RESTART_ZOMBIE_JOBS: bool = std::env::var("RESTART_ZOMBIE_JOBS")
@@ -199,6 +200,65 @@ pub async fn load_metrics_enabled(db: &DB) -> error::Result<()> {
     Ok(())
 }
 
+fn empty_string_as_none<'de, D>(deserializer: D) -> Result<Option<String>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let option = <Option<String> as serde::Deserialize>::deserialize(deserializer)?;
+    Ok(option.filter(|s| !s.is_empty()))
+}
+
+#[derive(serde::Deserialize)]
+struct OtelSetting {
+    metrics_enabled: Option<bool>,
+    logs_enabled: Option<bool>,
+    tracing_enabled: Option<bool>,
+    #[serde(default, deserialize_with = "empty_string_as_none")]
+    otel_exporter_otlp_endpoint: Option<String>,
+    #[serde(default, deserialize_with = "empty_string_as_none")]
+    otel_exporter_otlp_headers: Option<String>,
+    #[serde(default, deserialize_with = "empty_string_as_none")]
+    otel_exporter_otlp_protocol: Option<String>,
+    #[serde(default, deserialize_with = "empty_string_as_none")]
+    otel_exporter_otlp_compression: Option<String>,
+}
+
+pub async fn load_otel(db: &DB) {
+    let otel = load_value_from_global_settings(db, OTEL_SETTING).await;
+    if let Ok(v) = otel {
+        if let Some(v) = v {
+            let deser = serde_json::from_value::<OtelSetting>(v);
+            if let Ok(o) = deser {
+                let metrics_enabled = o.metrics_enabled.unwrap_or(false);
+                let logs_enabled = o.logs_enabled.unwrap_or(false);
+                let tracing_enabled = o.tracing_enabled.unwrap_or(false);
+
+                OTEL_METRICS_ENABLED.store(metrics_enabled, Ordering::Relaxed);
+                OTEL_LOGS_ENABLED.store(logs_enabled, Ordering::Relaxed);
+                OTEL_TRACING_ENABLED.store(tracing_enabled, Ordering::Relaxed);
+                if let Some(endpoint) = o.otel_exporter_otlp_endpoint.as_ref() {
+                    std::env::set_var("OTEL_EXPORTER_OTLP_ENDPOINT", endpoint);
+                }
+                if let Some(headers) = o.otel_exporter_otlp_headers.as_ref() {
+                    std::env::set_var("OTEL_EXPORTER_OTLP_HEADERS", headers);
+                }
+                if let Some(protocol) = o.otel_exporter_otlp_protocol {
+                    std::env::set_var("OTEL_EXPORTER_OTLP_PROTOCOL", protocol);
+                }
+                if let Some(compression) = o.otel_exporter_otlp_compression {
+                    std::env::set_var("OTEL_EXPORTER_OTLP_COMPRESSION", compression);
+                }
+                println!("OTEL settings loaded: tracing ({tracing_enabled}), logs ({logs_enabled}), metrics ({metrics_enabled}), endpoint ({:?}), headers defined: ({})",
+                o.otel_exporter_otlp_endpoint, o.otel_exporter_otlp_headers.is_some());
+            } else {
+                tracing::error!("Error deserializing otel settings");
+            }
+        }
+    } else {
+        tracing::error!("Error loading otel settings: {}", otel.unwrap_err());
+    }
+}
+
 pub async fn load_tag_per_workspace_enabled(db: &DB) -> error::Result<()> {
     let metrics_enabled =
         load_value_from_global_settings(db, DEFAULT_TAGS_PER_WORKSPACE_SETTING).await;
@@ -1337,7 +1397,7 @@ pub async fn reload_worker_config(
     }
 }
 
-pub async fn reload_base_url_setting(db: &DB) -> error::Result<()> {
+pub async fn load_base_url(db: &DB) -> error::Result<String> {
     let q_base_url = load_value_from_global_settings(db, BASE_URL_SETTING).await?;
 
     let std_base_url = std::env::var("BASE_URL")
@@ -1361,6 +1421,14 @@ pub async fn reload_base_url_setting(db: &DB) -> error::Result<()> {
         std_base_url
     };
 
+    {
+        let mut l = BASE_URL.write().await;
+        *l = base_url.clone();
+    }
+    Ok(base_url)
+}
+
+pub async fn reload_base_url_setting(db: &DB) -> error::Result<()> {
     let q_oauth = load_value_from_global_settings(db, OAUTH_SETTING).await?;
 
     let oauths = if let Some(q) = q_oauth {
@@ -1374,6 +1442,7 @@ pub async fn reload_base_url_setting(db: &DB) -> error::Result<()> {
         None
     };
 
+    let base_url = load_base_url(db).await?;
     let is_secure = base_url.starts_with("https://");
 
     {
@@ -1383,11 +1452,6 @@ pub async fn reload_base_url_setting(db: &DB) -> error::Result<()> {
         .unwrap();
     }
 
-    {
-        let mut l = BASE_URL.write().await;
-        *l = base_url
-    }
-
     {
         let mut l = IS_SECURE.write().await;
         *l = is_secure;

backend/tests/worker.rs

@@ -77,7 +77,11 @@ async fn initialize_tracing() {
 
     static ONCE: Once = Once::new();
     ONCE.call_once(|| {
-        let _ = windmill_common::tracing_init::initialize_tracing("test");
+        let _ = windmill_common::tracing_init::initialize_tracing(
+            "test",
+            &windmill_common::utils::Mode::Standalone,
+            "test",
+        );
     });
 }
 

backend/windmill-api/openapi-deref.yaml

@@ -8709,6 +8709,9 @@ paths:
                         - identity
                         - deploymentcallback
                         - singlescriptflow
+                        - flowscript
+                        - flownode
+                        - appscript
                     schedule_path:
                       type: string
                     permissioned_as:
@@ -9267,6 +9270,9 @@ paths:
                         - identity
                         - deploymentcallback
                         - singlescriptflow
+                        - flowscript
+                        - flownode
+                        - appscript
                     schedule_path:
                       type: string
                     permissioned_as:

backend/windmill-api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.434.0
+  version: 1.437.1
   title: Windmill API
 
   contact:
@@ -872,9 +872,20 @@ paths:
           content:
             application/json:
               schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/CriticalAlert'
+                type: object
+                properties:
+                  alerts:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/CriticalAlert'
+                  total_rows:
+                    type: integer
+                    description: Total number of rows matching the query.
+                    example: 100
+                  total_pages:
+                    type: integer
+                    description: Total number of pages based on the page size.
+                    example: 10
 
   /settings/critical_alerts/{id}/acknowledge:
     post:
@@ -2757,9 +2768,20 @@ paths:
           content:
             application/json:
               schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/CriticalAlert'
+                type: object
+                properties:
+                  alerts:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/CriticalAlert'
+                  total_rows:
+                    type: integer
+                    description: Total number of rows matching the query.
+                    example: 100
+                  total_pages:
+                    type: integer
+                    description: Total number of pages based on the page size.
+                    example: 10
 
   /w/{workspace}/workspaces/critical_alerts/{id}/acknowledge:
     post:
@@ -3733,6 +3755,27 @@ paths:
                 required:
                   - app
 
+  /apps_u/public_app_by_custom_path/{custom_path}:
+    get:
+      summary: get public app by custom path
+      operationId: getPublicAppByCustomPath
+      tags:
+        - app
+      parameters:
+        - $ref: "#/components/parameters/CustomPath"
+      responses:
+        "200":
+          description: app details
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - $ref: "#/components/schemas/AppWithLastVersion"
+                  - type: object
+                    properties:
+                      workspace_id:
+                        type: string
+
   /scripts/hub/get/{path}:
     get:
       summary: get hub script content by path
@@ -5371,6 +5414,8 @@ paths:
                   type: boolean
                 deployment_message:
                   type: string
+                custom_path:
+                  type: string
               required:
                 - path
                 - value
@@ -5422,6 +5467,23 @@ paths:
               schema:
                 $ref: "#/components/schemas/AppWithLastVersion"
 
+  /w/{workspace}/apps/get/lite/{path}:
+    get:
+      summary: get app lite by path
+      operationId: getAppLiteByPath
+      tags:
+        - app
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/ScriptPath"
+      responses:
+        "200":
+          description: app lite details
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AppWithLastVersion"
+
   /w/{workspace}/apps/get/draft/{path}:
     get:
       summary: get app by path with draft
@@ -5696,6 +5758,8 @@ paths:
                   $ref: "#/components/schemas/Policy"
                 deployment_message:
                   type: string
+                custom_path:
+                  type: string
       responses:
         "200":
           description: app updated
@@ -5704,6 +5768,23 @@ paths:
               schema:
                 type: string
 
+  /w/{workspace}/apps/custom_path_exists/{custom_path}:
+    get:
+      summary: check if custom path exists
+      operationId: customPathExists
+      tags:
+        - app
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/CustomPath"
+      responses:
+        "200":
+          description: custom path exists
+          content:
+            application/json:
+              schema:
+                type: boolean
+
   /w/{workspace}/apps_u/execute_component/{path}:
     post:
       summary: executeComponent
@@ -5727,6 +5808,8 @@ paths:
                 #flow: flow/<path>
                 path:
                   type: string
+                version:
+                  type: integer
                 args: {}
                 raw_code:
                   type: object
@@ -5744,6 +5827,8 @@ paths:
                   required:
                     - content
                     - language
+                id:
+                  type: integer
                 force_viewer_static_fields:
                   type: object
                 force_viewer_one_of_fields:
@@ -6852,6 +6937,43 @@ paths:
                   - resume
                   - cancel
 
+  /w/{workspace}/jobs/slack_approval/{id}/{resume_id}:
+    get:
+      summary: get interactive slack approval payload given the job_id, resume_id and a nonce to resume a flow
+      operationId: getSlackApprovalPayload
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/JobId"
+        - name: resume_id
+          in: path
+          required: true
+          schema:
+            type: integer
+        - name: approver
+          in: query
+          schema:
+            type: string
+        - name: message
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Blocks array for posting interactive slack approval
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  blocks:
+                    type: array
+                    items:
+                      type: object
+                required:
+                  - blocks
+
   /w/{workspace}/jobs_u/resume/{id}/{resume_id}/{signature}:
     get:
       summary: resume a job for a suspended flow
@@ -10222,6 +10344,12 @@ components:
       required: true
       schema:
         type: string
+    CustomPath:
+      name: custom_path
+      in: path
+      required: true
+      schema:
+        type: string
     PathId:
       name: id
       in: path
@@ -10892,6 +11020,8 @@ components:
               "deploymentcallback",
               "singlescriptflow",
               "flowscript",
+              "flownode",
+              "appscript",
             ]
         schedule_path:
           type: string
@@ -11012,6 +11142,8 @@ components:
               "deploymentcallback",
               "singlescriptflow",
               "flowscript",
+              "flownode",
+              "appscript",
             ]
         schedule_path:
           type: string
@@ -11121,6 +11253,8 @@ components:
           type: string
         is_admin:
           type: boolean
+        name:
+          type: string
         is_super_admin:
           type: boolean
         created_at:
@@ -12860,6 +12994,8 @@ components:
             draft_only:
               type: boolean
             draft: {}
+            custom_path:
+              type: string
 
     AppHistory:
       type: object

backend/windmill-api/src/apps.rs

@@ -1,4 +1,4 @@
-use std::collections::HashMap;
+use std::{collections::HashMap, sync::Arc};
 
 /*
  * Author: Ruben Fiszel
@@ -31,6 +31,7 @@ use axum::{
     routing::{delete, get, post},
     Router,
 };
+use futures::future::{FutureExt, TryFutureExt};
 use hyper::StatusCode;
 #[cfg(feature = "parquet")]
 use itertools::Itertools;
@@ -50,16 +51,18 @@ use windmill_audit::ActionKind;
 #[cfg(feature = "parquet")]
 use windmill_common::s3_helpers::build_object_store_client;
 use windmill_common::{
-    apps::ListAppQuery,
+    apps::{AppScriptId, ListAppQuery},
+    cache::{self, future::FutureCachedExt},
     db::UserDB,
     error::{to_anyhow, Error, JsonResult, Result},
     jobs::{get_payload_tag_from_prefixed_path, JobPayload, RawCode},
     users::username_to_permissioned_as,
     utils::{
-        http_get_from_hub, not_found_if_none, paginate, query_elems_from_hub, Pagination, StripPath,
+        http_get_from_hub, not_found_if_none, paginate, query_elems_from_hub, require_admin,
+        Pagination, StripPath,
     },
     variables::{build_crypt, build_crypt_with_key_suffix},
-    worker::to_raw_value,
+    worker::{to_raw_value, CLOUD_HOSTED},
     HUB_BASE_URL,
 };
 
@@ -71,6 +74,7 @@ pub fn workspaced_service() -> Router {
         .route("/list", get(list_apps))
         .route("/list_search", get(list_search_apps))
         .route("/get/p/*path", get(get_app))
+        .route("/get/lite/*path", get(get_app_lite))
         .route("/get/draft/*path", get(get_app_w_draft))
         .route("/secret_of/*path", get(get_secret_id))
         .route("/get/v/*id", get(get_app_by_id))
@@ -81,6 +85,7 @@ pub fn workspaced_service() -> Router {
         .route("/history/p/*path", get(get_app_history))
         .route("/get_latest_version/*path", get(get_latest_version))
         .route("/history_update/a/:id/v/:version", post(update_app_history))
+        .route("/custom_path_exists/*custom_path", get(custom_path_exists))
 }
 
 pub fn unauthed_service() -> Router {
@@ -90,13 +95,17 @@ pub fn unauthed_service() -> Router {
         .route("/public_app/:secret", get(get_public_app_by_secret))
         .route("/public_resource/*path", get(get_public_resource))
 }
-
 pub fn global_service() -> Router {
     Router::new()
         .route("/hub/list", get(list_hub_apps))
         .route("/hub/get/:id", get(get_hub_app_by_id))
 }
 
+#[cfg(not(feature = "enterprise"))]
+pub fn global_unauthed_service() -> Router {
+    Router::new()
+}
+
 #[derive(FromRow, Deserialize, Serialize)]
 pub struct ListableApp {
     pub id: i64,
@@ -147,21 +156,26 @@ pub struct AppWithLastVersionAndStarred {
     pub starred: Option<bool>,
 }
 
+#[cfg(feature = "enterprise")]
+#[derive(Serialize, FromRow)]
+pub struct AppWithLastVersionAndWorkspace {
+    #[sqlx(flatten)]
+    #[serde(flatten)]
+    pub app: AppWithLastVersion,
+    pub workspace_id: String,
+}
+
 #[derive(Serialize, Deserialize, FromRow)]
 pub struct AppWithLastVersionAndDraft {
-    pub id: i64,
-    pub path: String,
-    pub summary: String,
-    pub policy: sqlx::types::Json<Box<RawValue>>,
-    pub versions: Vec<i64>,
-    pub value: sqlx::types::Json<Box<RawValue>>,
-    pub created_by: String,
-    pub created_at: chrono::DateTime<chrono::Utc>,
-    pub extra_perms: serde_json::Value,
+    #[sqlx(flatten)]
+    #[serde(flatten)]
+    pub app: AppWithLastVersion,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub draft: Option<sqlx::types::Json<Box<RawValue>>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub draft_only: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub custom_path: Option<String>,
 }
 
 #[derive(Serialize)]
@@ -181,15 +195,16 @@ pub type StaticFields = HashMap<String, Box<RawValue>>;
 pub type OneOfFields = HashMap<String, Vec<Box<RawValue>>>;
 pub type AllowUserResources = Vec<String>;
 
-#[derive(Serialize, Deserialize, Debug, PartialEq, Clone)]
+#[derive(Serialize, Deserialize, Debug, PartialEq, Clone, Default)]
 #[serde(rename_all = "lowercase")]
 pub enum ExecutionMode {
+    #[default]
     Anonymous,
     Publisher,
     Viewer,
 }
 
-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, Default)]
 pub struct PolicyTriggerableInputs {
     static_inputs: StaticFields,
     one_of_inputs: OneOfFields,
@@ -205,7 +220,7 @@ pub struct S3Input {
     file_key_regex: String,
 }
 
-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, Default)]
 pub struct Policy {
     pub on_behalf_of: Option<String>,
     pub on_behalf_of_email: Option<String>,
@@ -229,6 +244,7 @@ pub struct CreateApp {
     pub policy: Policy,
     pub draft_only: Option<bool>,
     pub deployment_message: Option<String>,
+    pub custom_path: Option<String>,
 }
 
 #[derive(Deserialize)]
@@ -238,6 +254,7 @@ pub struct EditApp {
     pub value: Option<sqlx::types::Json<Box<RawValue>>>,
     pub policy: Option<Policy>,
     pub deployment_message: Option<String>,
+    pub custom_path: Option<String>,
 }
 
 #[derive(Serialize, FromRow)]
@@ -398,6 +415,33 @@ async fn get_app(
     Ok(Json(app))
 }
 
+async fn get_app_lite(
+    authed: ApiAuthed,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, path)): Path<(String, StripPath)>,
+) -> JsonResult<AppWithLastVersion> {
+    let path = path.to_path();
+    let mut tx = user_db.begin(&authed).await?;
+
+    let app_o = sqlx::query_as::<_, AppWithLastVersion>(
+        "SELECT app.id, app.path, app.summary, app.versions, app.policy,
+        app.extra_perms, coalesce(app_version_lite.value::json, app_version.value) as value, 
+        app_version.created_at, app_version.created_by, NULL as starred
+        FROM app, app_version
+        LEFT JOIN app_version_lite ON app_version_lite.id = app_version.id
+        WHERE app.path = $1 AND app.workspace_id = $2 AND app_version.id = app.versions[array_upper(app.versions, 1)]",
+    )
+    .bind(path.to_owned())
+    .bind(&w_id)
+    .fetch_optional(&mut *tx)
+    .await?;
+
+    tx.commit().await?;
+
+    let app = not_found_if_none(app_o, "App", path)?;
+    Ok(Json(app))
+}
+
 async fn get_app_w_draft(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
@@ -408,7 +452,7 @@ async fn get_app_w_draft(
 
     let app_o = sqlx::query_as::<_, AppWithLastVersionAndDraft>(
         r#"SELECT app.id, app.path, app.summary, app.versions, app.policy,
-        app.extra_perms, app_version.value, 
+        app.extra_perms, app_version.value, app.custom_path,
         app_version.created_at, app_version.created_by,
         app.draft_only, draft.value as "draft"
         from app
@@ -515,6 +559,21 @@ async fn update_app_history(
     return Ok(());
 }
 
+async fn custom_path_exists(
+    Extension(db): Extension<DB>,
+    Path((w_id, custom_path)): Path<(String, String)>,
+) -> JsonResult<bool> {
+    let exists =
+        sqlx::query_scalar!(
+            "SELECT EXISTS(SELECT 1 FROM app WHERE custom_path = $1 AND ($2::TEXT IS NULL OR workspace_id = $2))",
+            custom_path,
+            if *CLOUD_HOSTED { Some(&w_id) } else { None }
+        )
+        .fetch_one(&db)
+        .await?.unwrap_or(false);
+    Ok(Json(exists))
+}
+
 async fn get_app_by_id(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
@@ -555,8 +614,9 @@ async fn get_public_app_by_secret(
 
     let app_o = sqlx::query_as::<_, AppWithLastVersion>(
         "SELECT app.id, app.path, app.summary, app.versions, app.policy,
-        null as extra_perms, app_version.value, 
+        null as extra_perms, coalesce(app_version_lite.value::json, app_version.value::json) as value,
         app_version.created_at, app_version.created_by from app, app_version 
+        LEFT JOIN app_version_lite ON app_version_lite.id = app_version.id
         WHERE app.id = $1 AND app.workspace_id = $2 AND app_version.id = app.versions[array_upper(app.versions, 1)]")
         .bind(&id)
         .bind(&w_id)
@@ -680,6 +740,25 @@ async fn create_app(
         )));
     }
 
+    if let Some(custom_path) = &app.custom_path {
+        require_admin(authed.is_admin, &authed.username)?;
+
+        let exists = sqlx::query_scalar!(
+            "SELECT EXISTS(SELECT 1 FROM app WHERE custom_path = $1 AND ($2::TEXT IS NULL OR workspace_id = $2))",
+            custom_path,
+            if *CLOUD_HOSTED { Some(&w_id) } else { None }
+        )
+        .fetch_one(&mut *tx)
+        .await?.unwrap_or(false);
+
+        if exists {
+            return Err(Error::BadRequest(format!(
+                "App with custom path {} already exists",
+                custom_path
+            )));
+        }
+    }
+
     sqlx::query!(
         "DELETE FROM draft WHERE path = $1 AND workspace_id = $2 AND typ = 'app'",
         &app.path,
@@ -690,13 +769,16 @@ async fn create_app(
 
     let id = sqlx::query_scalar!(
         "INSERT INTO app
-            (workspace_id, path, summary, policy, versions, draft_only)
-            VALUES ($1, $2, $3, $4, '{}', $5) RETURNING id",
+            (workspace_id, path, summary, policy, versions, draft_only, custom_path)
+            VALUES ($1, $2, $3, $4, '{}', $5, $6) RETURNING id",
         w_id,
         app.path,
         app.summary,
         json!(app.policy),
         app.draft_only,
+        app.custom_path
+            .map(|s| if s.is_empty() { None } else { Some(s) })
+            .flatten()
     )
     .fetch_one(&mut *tx)
     .await?;
@@ -899,7 +981,11 @@ async fn update_app(
 
     let mut tx = user_db.clone().begin(&authed).await?;
 
-    let npath = if ns.policy.is_some() || ns.path.is_some() || ns.summary.is_some() {
+    let npath = if ns.policy.is_some()
+        || ns.path.is_some()
+        || ns.summary.is_some()
+        || ns.custom_path.is_some()
+    {
         let mut sqlb = SqlBuilder::update_table("app");
         sqlb.and_where_eq("path", "?".bind(&path));
         sqlb.and_where_eq("workspace_id", "?".bind(&w_id));
@@ -932,6 +1018,32 @@ async fn update_app(
             sqlb.set_str("summary", nsummary);
         }
 
+        if let Some(ncustom_path) = &ns.custom_path {
+            require_admin(authed.is_admin, &authed.username)?;
+
+            if ncustom_path.is_empty() {
+                sqlb.set("custom_path", "NULL");
+            } else {
+                let exists = sqlx::query_scalar!(
+                    "SELECT EXISTS(SELECT 1 FROM app WHERE custom_path = $1 AND ($2::TEXT IS NULL OR workspace_id = $2) AND NOT (path = $3 AND workspace_id = $4))",
+                    ncustom_path,
+                    if *CLOUD_HOSTED { Some(&w_id) } else { None },
+                    path,
+                    w_id
+                )
+                .fetch_one(&mut *tx)
+                .await?.unwrap_or(false);
+
+                if exists {
+                    return Err(Error::BadRequest(format!(
+                        "App with custom path {} already exists",
+                        ncustom_path
+                    )));
+                }
+                sqlb.set_str("custom_path", ncustom_path);
+            }
+        }
+
         if let Some(mut npolicy) = ns.policy {
             npolicy.on_behalf_of = Some(username_to_permissioned_as(&authed.username));
             npolicy.on_behalf_of_email = Some(authed.email.clone());
@@ -1067,6 +1179,10 @@ async fn update_app(
 
 #[derive(Debug, Deserialize, Clone)]
 pub struct ExecuteApp {
+    /// The app version to execute. Fallback to `path` if not provided.
+    pub version: Option<i64>,
+    /// The app script id (from the `app_script` table) to execute.
+    pub id: Option<i64>,
     pub args: HashMap<String, Box<RawValue>>,
     // - script: script/<path>
     // - flow: flow/<path>
@@ -1129,6 +1245,22 @@ async fn get_on_behalf_details_from_policy_and_authed(
     Ok((username, permissioned_as, email))
 }
 
+/// Convert the triggerables from the old format to the new format.
+fn empty_triggerables(mut policy: Policy) -> Policy {
+    use std::mem::take;
+    if let Some(triggerables) = take(&mut policy.triggerables) {
+        let mut triggerables_v2 = take(&mut policy.triggerables_v2).unwrap_or_default();
+        for (k, static_inputs) in triggerables.into_iter() {
+            triggerables_v2.insert(
+                k,
+                PolicyTriggerableInputs { static_inputs, ..Default::default() },
+            );
+        }
+        policy.triggerables_v2 = Some(triggerables_v2);
+    }
+    policy
+}
+
 async fn execute_component(
     OptAuthed(opt_authed): OptAuthed,
     Extension(db): Extension<DB>,
@@ -1151,99 +1283,129 @@ async fn execute_component(
     };
 
     let path = path.to_path();
+    let (arc_policy, policy): (Arc<Policy>, Policy);
+    let policy_triggerables_default = Default::default();
 
-    let policy = match payload.clone() {
+    // Two cases here:
+    // 1. The component is executed from the editor (i.e. in "preview" mode), then:
+    //    - The policy is set to default (in `Viewer` execution mode).
+    //    - The policy triggerables are built by the frontend and retrieved from the request
+    //      payload.
+    //    - In case of inline script, the `RawCode` from the request is pushed as is to the
+    //      job queue.
+    // 2. Otherwise (i.e. "run" mode):
+    //    - The policy and triggerables are fetched from the database.
+    //    - In case of inline script, if an entry exists in the `app_script` table, push
+    //      an `AppScript` job payload, as in (.1) otherwise.
+    let (policy, policy_triggerables) = match payload {
+        // 1. "preview" mode.
         ExecuteApp {
-            force_viewer_static_fields: Some(static_fields),
-            force_viewer_one_of_fields: Some(one_of_fields),
+            force_viewer_static_fields: Some(static_inputs),
+            force_viewer_one_of_fields: Some(one_of_inputs),
             force_viewer_allow_user_resources: Some(allow_user_resources),
             ..
-        } => {
-            let mut hm = HashMap::new();
-
-            if let Some(path) = payload.path.clone() {
-                hm.insert(
-                    format!("{}:{path}", payload.component),
-                    PolicyTriggerableInputs {
-                        static_inputs: static_fields,
-                        one_of_inputs: one_of_fields,
-                        allow_user_resources,
-                    },
-                );
-            } else {
-                hm.insert(
-                    format!(
-                        "{}:{}",
-                        payload.component,
-                        digest(payload.raw_code.clone().unwrap().content.as_str())
-                    ),
-                    PolicyTriggerableInputs {
-                        static_inputs: static_fields,
-                        one_of_inputs: one_of_fields,
-                        allow_user_resources,
-                    },
-                );
-            }
-            Policy {
-                execution_mode: ExecutionMode::Viewer,
-                triggerables: None,
-                triggerables_v2: Some(hm),
-                on_behalf_of: None,
-                on_behalf_of_email: None,
-                s3_inputs: None,
-            }
-        }
+        } => (
+            &Policy { execution_mode: ExecutionMode::Viewer, ..Default::default() },
+            &PolicyTriggerableInputs { static_inputs, one_of_inputs, allow_user_resources },
+        ),
+        // 2. "run" mode.
         _ => {
-            let policy_o = sqlx::query_scalar!(
-                "SELECT policy from app WHERE path = $1 AND workspace_id = $2",
+            // Policy is fetched from the database on app `path` and `workspace_id`.
+            let policy_fut = sqlx::query_scalar!(
+                "SELECT policy as \"policy: sqlx::types::Json<Box<RawValue>>\"
+                FROM app WHERE app.path = $1 AND app.workspace_id = $2 LIMIT 1",
                 path,
-                &w_id
+                &w_id,
             )
             .fetch_optional(&db)
-            .await?;
+            .map_err(Into::<Error>::into)
+            .map(|policy_o| Result::Ok(not_found_if_none(policy_o?, "App", path)?))
+            .map(|policy| Result::Ok(serde_json::from_str(policy?.get())?))
+            .map_ok(empty_triggerables);
 
-            let policy = not_found_if_none(policy_o, "App", path)?;
+            // 1. The app `version` is provided: cache the fetched policy.
+            // 2. Otherwise, always fetch the policy from the database.
+            let policy = if let Some(id) = payload.version {
+                let cache = cache::anon!({ u64 => Arc<Policy> } in "policy" <= 1000);
+                arc_policy = policy_fut
+                    .map_ok(Arc::new)
+                    .cached(cache, &(id as u64))
+                    .await?;
+                &*arc_policy
+            } else {
+                policy = policy_fut.await?;
+                &policy
+            };
 
-            serde_json::from_value::<Policy>(policy).map_err(to_anyhow)?
+            // Compute the path for the triggerables map:
+            // - flow: `flow/<payload.path>`
+            // - script: `script/<payload.path>`
+            // - inline script: `rawscript/<sha256(raw_code.content)>`
+            let path = match &payload {
+                // flow or script: just use the `payload.path`.
+                ExecuteApp { path: Some(path), .. } => path,
+                // inline script: without entry in the `app_script` table.
+                ExecuteApp { raw_code: Some(raw_code), id: None, .. } => &digest(&raw_code.content),
+                // inline script: with an entry in the `app_script` table.
+                ExecuteApp { raw_code: Some(_), id: Some(id), .. } => {
+                    let cache = cache::anon!({ u64 => Arc<String> } in "appscriptpath" <= 10000);
+                    // `id` is unique, cache the result.
+                    &*sqlx::query_scalar!(
+                        "SELECT format('rawscript/%s', code_sha256) as \"path!: String\"
+                        FROM app_script WHERE id = $1 LIMIT 1",
+                        id
+                    )
+                    .fetch_one(&db)
+                    .map_err(Into::<Error>::into)
+                    .map_ok(Arc::new)
+                    .cached(cache, &(*id as u64))
+                    .await?
+                }
+                _ => unreachable!(),
+            };
+
+            // Retrieve the triggerables from the policy on `path` or `<component>:<path>`.
+            let triggerables_v2 = policy
+                .triggerables_v2
+                .as_ref()
+                .ok_or_else(|| Error::BadRequest(format!("Policy is missing triggerables")))?;
+            let policy_triggerables = triggerables_v2
+                .get(path) // start with `path` in case we can avoid the next` format!`.
+                .or_else(|| triggerables_v2.get(&format!("{}:{}", payload.component, &path)))
+                .or(match policy.execution_mode {
+                    ExecutionMode::Viewer => Some(&policy_triggerables_default),
+                    _ => None,
+                })
+                .ok_or_else(|| Error::BadRequest(format!("Path {path} forbidden by policy")))?;
+
+            (policy, policy_triggerables)
         }
     };
 
     let (username, permissioned_as, email) =
         get_on_behalf_details_from_policy_and_authed(&policy, &opt_authed).await?;
 
-    let (job_payload, (args, job_id), tag) = match payload {
-        ExecuteApp { args, component, raw_code: Some(raw_code), path: None, .. } => {
-            let content = &raw_code.content;
-            let payload = JobPayload::Code(raw_code.clone());
-            let path = digest(content);
-            let args = build_args(
-                policy,
-                &component,
-                path,
-                args,
-                opt_authed.as_ref(),
-                &user_db,
-                &db,
-                &w_id,
-            )
-            .await?;
-            (payload, args, None)
-        }
-        ExecuteApp { args, component, raw_code: None, path: Some(path), .. } => {
-            let (payload, tag) = get_payload_tag_from_prefixed_path(&path, &db, &w_id).await?;
-            let args = build_args(
-                policy,
-                &component,
-                path.to_string(),
-                args,
-                opt_authed.as_ref(),
-                &user_db,
-                &db,
-                &w_id,
-            )
-            .await?;
-            (payload, args, tag)
-        }
+    let (args, job_id) = build_args(
+        policy,
+        policy_triggerables,
+        payload.args,
+        opt_authed.as_ref(),
+        &user_db,
+        &db,
+        &w_id,
+    )
+    .await?;
+
+    let (job_payload, tag) = match (payload.path, payload.raw_code, payload.id) {
+        // flow or script:
+        (Some(path), None, None) => get_payload_tag_from_prefixed_path(&path, &db, &w_id).await?,
+        // inline script: in "preview" mode or without entry in the `app_script` table.
+        (None, Some(raw_code), None) => (JobPayload::Code(raw_code), None),
+        // inline script: in "run" mode and with an entry in the `app_script` table.
+        (None, Some(RawCode { language, path, cache_ttl, .. }), Some(id)) => (
+            JobPayload::AppScript { id: AppScriptId(id), cache_ttl, language, path },
+            None,
+        ),
         _ => unreachable!(),
     };
     let tx = windmill_queue::PushIsolationLevel::IsolatedRoot(db.clone());
@@ -1578,9 +1740,12 @@ async fn exists_app(
 }
 
 async fn build_args(
-    policy: Policy,
-    component: &str,
-    path: String,
+    policy: &Policy,
+    PolicyTriggerableInputs {
+        static_inputs,
+        one_of_inputs,
+        allow_user_resources,
+    }: &PolicyTriggerableInputs,
     mut args: HashMap<String, Box<RawValue>>,
     authed: Option<&ApiAuthed>,
     user_db: &UserDB,
@@ -1588,54 +1753,6 @@ async fn build_args(
     w_id: &str,
 ) -> Result<(PushArgsOwned, Option<Uuid>)> {
     let mut job_id: Option<Uuid> = None;
-    let key = format!("{}:{}", component, &path);
-    let (static_inputs, one_of_inputs, allow_user_resources) = match policy {
-        Policy { triggerables_v2: Some(t), .. } => {
-            let PolicyTriggerableInputs { static_inputs, one_of_inputs, allow_user_resources } = t
-                .get(&key)
-                .or_else(|| t.get(&path))
-                .map(|x| x.clone())
-                .or_else(|| {
-                    if matches!(policy.execution_mode, ExecutionMode::Viewer) {
-                        Some(PolicyTriggerableInputs {
-                            static_inputs: HashMap::new(),
-                            one_of_inputs: HashMap::new(),
-                            allow_user_resources: Vec::new(),
-                        })
-                    } else {
-                        None
-                    }
-                })
-                .ok_or_else(|| {
-                    Error::BadRequest(format!("path {} is not allowed in the app policy", path))
-                })?;
-
-            (static_inputs, one_of_inputs, allow_user_resources)
-        }
-        Policy { triggerables: Some(t), .. } => {
-            let static_inputs = t
-                .get(&key)
-                .or_else(|| t.get(&path))
-                .map(|x| x.clone())
-                .or_else(|| {
-                    if matches!(policy.execution_mode, ExecutionMode::Viewer) {
-                        Some(HashMap::new())
-                    } else {
-                        None
-                    }
-                })
-                .ok_or_else(|| {
-                    Error::BadRequest(format!("path {} is not allowed in the app policy", path))
-                })?;
-
-            (static_inputs, HashMap::new(), Vec::new())
-        }
-        _ => Err(Error::BadRequest(format!(
-            "Policy is missing triggerables for {}",
-            key
-        )))?,
-    };
-
     let mut safe_args = HashMap::<String, Box<RawValue>>::new();
 
     // tracing::error!("{:?}", allow_user_resources);
@@ -1684,16 +1801,16 @@ async fn build_args(
     }
 
     for (k, v) in one_of_inputs {
-        if safe_args.contains_key(&k) {
+        if safe_args.contains_key(k) {
             continue;
         }
-        if let Some(arg_val) = args.get(&k) {
+        if let Some(arg_val) = args.get(k) {
             let arg_str = arg_val.get();
 
             let options_str_vec = v.iter().map(|x| x.get()).collect::<Vec<&str>>();
             if options_str_vec.contains(&arg_str) {
                 safe_args.insert(k.to_string(), arg_val.clone());
-                args.remove(&k);
+                args.remove(k);
                 continue;
             }
 
@@ -1704,7 +1821,7 @@ async fn build_args(
                     .all(|x| options_str_vec.contains(&x.get()))
                 {
                     safe_args.insert(k.to_string(), arg_val.clone());
-                    args.remove(&k);
+                    args.remove(k);
                     continue;
                 }
             }

backend/windmill-api/src/apps_ee.rs

@@ -0,0 +1,5 @@
+use axum::Router;
+
+pub fn global_unauthed_service() -> Router {
+    Router::new()
+}

backend/windmill-api/src/args.rs

@@ -0,0 +1,469 @@
+use std::collections::HashMap;
+
+#[cfg(feature = "parquet")]
+use crate::job_helpers_ee::get_workspace_s3_resource;
+use axum::{
+    extract::{FromRequest, FromRequestParts, Query, Request},
+    http::{HeaderMap, Uri},
+    response::{IntoResponse, Response},
+};
+use bytes::Bytes;
+use http::{header::CONTENT_TYPE, request::Parts};
+#[cfg(feature = "parquet")]
+use object_store::{Attribute, Attributes};
+use serde::Deserialize;
+use serde_json::value::RawValue;
+use sqlx::types::JsonRawValue;
+#[cfg(feature = "parquet")]
+use windmill_common::s3_helpers::build_object_store_client;
+use windmill_common::{error::Error, worker::to_raw_value, DB};
+use windmill_queue::PushArgsOwned;
+
+use crate::db::ApiAuthed;
+#[cfg(feature = "parquet")]
+use crate::job_helpers_ee::{get_random_file_name, upload_file_internal};
+
+pub struct WebhookArgs {
+    pub args: PushArgsOwned,
+    pub file_req: Option<Request>,
+}
+
+impl WebhookArgs {
+    #[cfg(not(feature = "parquet"))]
+    pub async fn to_push_args_owned(
+        self,
+        _authed: &ApiAuthed,
+        _db: &DB,
+        _w_id: &str,
+    ) -> Result<PushArgsOwned, Error> {
+        return Err(Error::BadRequest(format!(
+            "Uploading files requires the parquet feature"
+        )));
+    }
+
+    #[cfg(feature = "parquet")]
+    pub async fn to_push_args_owned(
+        mut self,
+        authed: &ApiAuthed,
+        db: &DB,
+        w_id: &str,
+    ) -> Result<PushArgsOwned, Error> {
+        if let Some(req) = self.file_req {
+            {
+                let (_, s3_resource) =
+                    get_workspace_s3_resource(authed, db, None, "", w_id, None).await?;
+
+                if let Some(s3_resource) = s3_resource {
+                    let s3_client = build_object_store_client(&s3_resource).await?;
+
+                    let content_type = req
+                        .headers()
+                        .get(CONTENT_TYPE)
+                        .map(|x| x.to_str().ok().map(|x| x.to_string()))
+                        .flatten();
+
+                    let file_extension = content_type
+                        .as_ref()
+                        .map(|mime_str| {
+                            mime_guess::get_mime_extensions_str(mime_str)
+                                .map(|x| x.first().map(|x| x.to_string()))
+                        })
+                        .flatten()
+                        .flatten();
+
+                    let file_key = get_random_file_name(file_extension);
+
+                    let options = Attributes::from_iter(vec![
+                        (
+                            Attribute::ContentType,
+                            content_type.unwrap_or("application/octet-stream".to_string()),
+                        ),
+                        (Attribute::ContentDisposition, "inline".to_string()),
+                    ])
+                    .into();
+
+                    upload_file_internal(s3_client, &file_key, req, options).await?;
+
+                    self.args.args.insert(
+                        "body".to_string(),
+                        to_raw_value(&serde_json::json!({
+                            "s3": &file_key
+                        })),
+                    );
+
+                    return Ok(self.args);
+                }
+            }
+
+            return Err(Error::BadRequest(format!(
+                "You need to connect your workspace to an S3 bucket to upload files"
+            )));
+        }
+
+        Ok(self.args)
+    }
+}
+
+#[derive(Deserialize)]
+pub struct RequestQuery {
+    pub raw: Option<bool>,
+    pub wrap_body: Option<bool>,
+    pub include_header: Option<String>,
+}
+
+#[axum::async_trait]
+impl<S> FromRequest<S, axum::body::Body> for WebhookArgs
+where
+    S: Send + Sync,
+{
+    type Rejection = Response;
+
+    async fn from_request(
+        req: Request<axum::body::Body>,
+        _state: &S,
+    ) -> Result<Self, Self::Rejection> {
+        let (content_type, mut extra, use_raw, wrap_body) = {
+            let headers_map = req.headers();
+            let content_type_header = headers_map.get(CONTENT_TYPE);
+            let content_type = content_type_header.and_then(|value| value.to_str().ok());
+            let uri = req.uri();
+            let query = Query::<RequestQuery>::try_from_uri(uri).unwrap().0;
+            let mut extra = build_extra(&headers_map, query.include_header);
+            let query_decode = DecodeQueries::from_uri(uri);
+            if let Some(DecodeQueries(queries)) = query_decode {
+                extra.extend(queries);
+            }
+            let raw = query.raw.as_ref().is_some_and(|x| *x);
+            let wrap_body = query.wrap_body.as_ref().is_some_and(|x| *x);
+            (content_type, extra, raw, wrap_body)
+        };
+
+        let no_content_type = content_type.is_none();
+        if no_content_type || content_type.unwrap().starts_with("application/json") {
+            let bytes = Bytes::from_request(req, _state)
+                .await
+                .map_err(IntoResponse::into_response)?;
+            if no_content_type && bytes.is_empty() {
+                if use_raw {
+                    extra.insert("raw_string".to_string(), to_raw_value(&"".to_string()));
+                }
+                let mut args = HashMap::new();
+                if wrap_body {
+                    args.insert("body".to_string(), to_raw_value(&serde_json::json!({})));
+                }
+                return Ok(Self {
+                    args: PushArgsOwned { extra: Some(extra), args: args },
+                    file_req: None,
+                });
+            }
+            let str = String::from_utf8(bytes.to_vec())
+                .map_err(|e| Error::BadRequest(format!("invalid utf8: {}", e)).into_response())?;
+
+            PushArgsOwned::from_json(extra, use_raw, wrap_body, str)
+                .await
+                .map(|args| Self { args, file_req: None })
+        } else if content_type
+            .unwrap()
+            .starts_with("application/cloudevents+json")
+        {
+            let bytes = Bytes::from_request(req, _state)
+                .await
+                .map_err(IntoResponse::into_response)?;
+            let str = String::from_utf8(bytes.to_vec())
+                .map_err(|e| Error::BadRequest(format!("invalid utf8: {}", e)).into_response())?;
+
+            PushArgsOwned::from_ce_json(extra, use_raw, str)
+                .await
+                .map(|args| Self { args, file_req: None })
+        } else if content_type
+            .unwrap()
+            .starts_with("application/cloudevents-batch+json")
+        {
+            Err(
+                Error::BadRequest(format!("Cloud events batching is not supported yet"))
+                    .into_response(),
+            )
+        } else if content_type.unwrap().starts_with("text/plain") {
+            let bytes = Bytes::from_request(req, _state)
+                .await
+                .map_err(IntoResponse::into_response)?;
+            let str = String::from_utf8(bytes.to_vec())
+                .map_err(|e| Error::BadRequest(format!("invalid utf8: {}", e)).into_response())?;
+            extra.insert("raw_string".to_string(), to_raw_value(&str));
+            Ok(Self {
+                args: PushArgsOwned { extra: Some(extra), args: HashMap::new() },
+                file_req: None,
+            })
+        } else if content_type
+            .unwrap()
+            .starts_with("application/x-www-form-urlencoded")
+        {
+            let bytes = Bytes::from_request(req, _state)
+                .await
+                .map_err(IntoResponse::into_response)?;
+
+            if use_raw {
+                let raw_string = String::from_utf8(bytes.to_vec()).map_err(|e| {
+                    Error::BadRequest(format!("invalid utf8: {}", e)).into_response()
+                })?;
+                extra.insert("raw_string".to_string(), to_raw_value(&raw_string));
+            }
+
+            let payload: HashMap<String, Option<String>> = serde_urlencoded::from_bytes(&bytes)
+                .map_err(|e| {
+                    Error::BadRequest(format!("invalid urlencoded data: {}", e)).into_response()
+                })?;
+            let payload = payload
+                .into_iter()
+                .map(|(k, v)| (k, to_raw_value(&v)))
+                .collect::<HashMap<_, _>>();
+
+            return Ok(Self {
+                args: PushArgsOwned { extra: Some(extra), args: payload },
+                file_req: None,
+            });
+        } else {
+            return Ok(Self {
+                args: PushArgsOwned { extra: None, args: HashMap::new() },
+                file_req: Some(req),
+            });
+
+            // Err(StatusCode::UNSUPPORTED_MEDIA_TYPE.into_response())
+        }
+    }
+}
+
+lazy_static::lazy_static! {
+    static ref INCLUDE_HEADERS: Vec<String> = std::env::var("INCLUDE_HEADERS")
+        .ok().map(|x| x
+        .split(',')
+        .map(|s| s.to_string())
+        .collect()).unwrap_or_default();
+}
+
+pub fn build_extra(
+    headers: &HeaderMap,
+    include_header: Option<String>,
+) -> HashMap<String, Box<RawValue>> {
+    let mut args = HashMap::new();
+    let whitelist = include_header
+        .map(|s| s.split(",").map(|s| s.to_string()).collect::<Vec<_>>())
+        .unwrap_or_default();
+
+    whitelist
+        .iter()
+        .chain(INCLUDE_HEADERS.iter())
+        .for_each(|h| {
+            if let Some(v) = headers.get(h) {
+                args.insert(
+                    h.to_string().to_lowercase().replace('-', "_"),
+                    to_raw_value(&v.to_str().unwrap().to_string()),
+                );
+            }
+        });
+    args
+}
+
+#[derive(Deserialize)]
+pub struct IncludeQuery {
+    pub include_query: Option<String>,
+}
+
+pub struct DecodeQueries(pub HashMap<String, Box<RawValue>>);
+
+#[axum::async_trait]
+impl<S> FromRequestParts<S> for DecodeQueries
+where
+    S: Send + Sync,
+{
+    type Rejection = Response;
+
+    async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
+        Ok(DecodeQueries::from_uri(&parts.uri).unwrap_or_else(|| DecodeQueries(HashMap::new())))
+    }
+}
+
+impl DecodeQueries {
+    pub fn from_uri(uri: &Uri) -> Option<Self> {
+        let query = uri.query();
+        if query.is_none() {
+            return None;
+        }
+        let query = query.unwrap();
+        let include_query = serde_urlencoded::from_str::<IncludeQuery>(query)
+            .map(|x| x.include_query)
+            .ok()
+            .flatten()
+            .unwrap_or_default();
+        let parse_query_args = include_query
+            .split(",")
+            .map(|s| s.to_string())
+            .collect::<Vec<_>>();
+        let mut args = HashMap::new();
+        if !parse_query_args.is_empty() {
+            let queries =
+                serde_urlencoded::from_str::<HashMap<String, String>>(query).unwrap_or_default();
+            parse_query_args.iter().for_each(|h| {
+                if let Some(v) = queries.get(h) {
+                    args.insert(h.to_string(), to_raw_value(v));
+                }
+            });
+        }
+        Some(DecodeQueries(args))
+    }
+}
+
+// impl<'c> PushArgs<'c> {
+//     pub fn insert<K: Into<String>, V: Into<Box<RawValue>>>(&mut self, k: K, v: V) {
+//         self.extra.insert(k.into(), v.into());
+//     }
+// }
+
+fn restructure_cloudevents_metadata(
+    mut p: HashMap<String, Box<RawValue>>,
+) -> Result<HashMap<String, Box<RawValue>>, Error> {
+    let data = p
+        .remove("data")
+        .unwrap_or_else(|| to_raw_value(&serde_json::Value::Null));
+    let str = data.to_string();
+
+    let wrap_body = str.len() > 0 && str.chars().next().unwrap() != '{';
+
+    if wrap_body {
+        let args = serde_json::from_str::<Option<Box<RawValue>>>(&str)
+            .map_err(|e| Error::BadRequest(format!("invalid json: {}", e)))?
+            .unwrap_or_else(|| to_raw_value(&serde_json::Value::Null));
+        let mut hm = HashMap::new();
+        hm.insert("body".to_string(), args);
+        hm.insert("WEBHOOK__METADATA__".to_string(), to_raw_value(&p));
+        Ok(hm)
+    } else {
+        let mut hm = serde_json::from_str::<Option<HashMap<String, Box<JsonRawValue>>>>(&str)
+            .map_err(|e| Error::BadRequest(format!("invalid json: {}", e)))?
+            .unwrap_or_else(HashMap::new);
+        hm.insert("WEBHOOK__METADATA__".to_string(), to_raw_value(&p));
+        Ok(hm)
+    }
+}
+
+trait PushArgsOwnedExt: Sized {
+    async fn from_json(
+        extra: HashMap<String, Box<RawValue>>,
+        use_raw: bool,
+        force_wrap_body: bool,
+        str: String,
+    ) -> Result<Self, Response>;
+
+    async fn from_ce_json(
+        extra: HashMap<String, Box<RawValue>>,
+        use_raw: bool,
+        str: String,
+    ) -> Result<Self, Response>;
+}
+
+impl PushArgsOwnedExt for PushArgsOwned {
+    async fn from_json(
+        mut extra: HashMap<String, Box<RawValue>>,
+        use_raw: bool,
+        force_wrap_body: bool,
+        str: String,
+    ) -> Result<Self, Response> {
+        if use_raw {
+            extra.insert("raw_string".to_string(), to_raw_value(&str));
+        }
+
+        let wrap_body = force_wrap_body || str.len() > 0 && str.chars().next().unwrap() != '{';
+
+        if wrap_body {
+            let args = serde_json::from_str::<Option<Box<RawValue>>>(&str)
+                .map_err(|e| Error::BadRequest(format!("invalid json: {}", e)).into_response())?
+                .unwrap_or_else(|| to_raw_value(&serde_json::Value::Null));
+            let mut hm = HashMap::new();
+            hm.insert("body".to_string(), args);
+            Ok(PushArgsOwned { extra: Some(extra), args: hm })
+        } else {
+            let hm = serde_json::from_str::<Option<HashMap<String, Box<JsonRawValue>>>>(&str)
+                .map_err(|e| Error::BadRequest(format!("invalid json: {}", e)).into_response())?
+                .unwrap_or_else(HashMap::new);
+            Ok(PushArgsOwned { extra: Some(extra), args: hm })
+        }
+    }
+
+    async fn from_ce_json(
+        mut extra: HashMap<String, Box<RawValue>>,
+        use_raw: bool,
+        str: String,
+    ) -> Result<Self, Response> {
+        if use_raw {
+            extra.insert("raw_string".to_string(), to_raw_value(&str));
+        }
+
+        let hm = serde_json::from_str::<HashMap<String, Box<RawValue>>>(&str).map_err(|e| {
+            Error::BadRequest(format!("invalid cloudevents+json: {}", e)).into_response()
+        })?;
+        let hm = restructure_cloudevents_metadata(hm).map_err(|e| e.into_response())?;
+        Ok(PushArgsOwned { extra: Some(extra), args: hm })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+
+    use super::*;
+
+    #[tokio::test]
+    async fn test_cloudevents_json_payload() {
+        let r1 = r#"
+        {
+            "specversion" : "1.0",
+            "type" : "com.example.someevent",
+            "source" : "/mycontext",
+            "subject": null,
+            "id" : "C234-1234-1234",
+            "time" : "2018-04-05T17:31:00Z",
+            "comexampleextension1" : "value",
+            "comexampleothervalue" : 5,
+            "datacontenttype" : "application/json",
+            "data" : {
+                "appinfoA" : "abc",
+                "appinfoB" : 123,
+                "appinfoC" : true
+            }
+        }
+        "#;
+        let r2 = r#"
+        {
+            "specversion" : "1.0",
+            "type" : "com.example.someevent",
+            "source" : "/mycontext",
+            "subject": null,
+            "id" : "C234-1234-1234",
+            "time" : "2018-04-05T17:31:00Z",
+            "comexampleextension1" : "value",
+            "comexampleothervalue" : 5,
+            "datacontenttype" : "application/json",
+            "data" : 1.5
+        }
+        "#;
+        let extra = HashMap::new();
+
+        let a1 = PushArgsOwned::from_ce_json(extra.clone(), false, r1.to_string())
+            .await
+            .expect("Failed to parse the cloudevent");
+        let a2 = PushArgsOwned::from_ce_json(extra.clone(), false, r2.to_string())
+            .await
+            .expect("Failed to parse the cloudevent");
+
+        a1.args.get("WEBHOOK__METADATA__").expect(
+            "CloudEvents should generate a neighboring `webhook-metadata` field in PushArgs",
+        );
+        assert_eq!(
+            a2.args
+                .get("body")
+                .expect("Cloud events with a data field with no wrapping curly brackets should be inside of a `body` field in PushArgs")
+                .to_string(),
+            "1.5"
+        );
+    }
+}

backend/windmill-api/src/capture.rs

@@ -18,9 +18,12 @@ use windmill_common::{
     error::{JsonResult, Result},
     utils::{not_found_if_none, StripPath},
 };
-use windmill_queue::{PushArgs, PushArgsOwned};
+use windmill_queue::PushArgs;
 
-use crate::db::{ApiAuthed, DB};
+use crate::{
+    args::WebhookArgs,
+    db::{ApiAuthed, DB},
+};
 
 const KEEP_LAST: i64 = 8;
 
@@ -86,8 +89,10 @@ pub async fn new_payload(
 pub async fn update_payload(
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
-    args: PushArgsOwned,
+    args: WebhookArgs,
 ) -> Result<StatusCode> {
+    let args = args.args;
+
     let mut tx = db.begin().await?;
 
     sqlx::query!(

backend/windmill-api/src/http_triggers.rs

@@ -1,12 +1,13 @@
 #[cfg(feature = "parquet")]
 use crate::job_helpers_ee::get_workspace_s3_resource;
 use crate::{
+    args::WebhookArgs,
     db::{ApiAuthed, DB},
     jobs::{
         run_flow_by_path_inner, run_script_by_path_inner, run_wait_result_flow_by_path_internal,
         run_wait_result_script_by_path_internal, RunJobQuery,
     },
-    users::{fetch_api_authed, OptAuthed},
+    users::{fetch_api_authed, AuthCache, OptTokened},
 };
 use axum::{
     extract::{Path, Query},
@@ -20,7 +21,7 @@ use http::{HeaderMap, StatusCode};
 use serde::{Deserialize, Serialize};
 use sql_builder::{bind::Bind, SqlBuilder};
 use sqlx::prelude::FromRow;
-use std::collections::HashMap;
+use std::{collections::HashMap, sync::Arc};
 use tower_http::cors::CorsLayer;
 use windmill_audit::{audit_ee::audit_log, ActionKind};
 #[cfg(feature = "parquet")]
@@ -32,7 +33,6 @@ use windmill_common::{
     utils::{not_found_if_none, paginate, require_admin, Pagination, StripPath},
     worker::{to_raw_value, CLOUD_HOSTED},
 };
-use windmill_queue::PushArgsOwned;
 
 lazy_static::lazy_static! {
     static ref ROUTE_PATH_KEY_RE: regex::Regex = regex::Regex::new(r"/:\w+").unwrap();
@@ -422,7 +422,8 @@ struct TriggerRoute {
 
 async fn get_http_route_trigger(
     route_path: &str,
-    opt_authed: Option<ApiAuthed>,
+    auth_cache: &Arc<AuthCache>,
+    token: Option<&String>,
     db: &DB,
     user_db: UserDB,
 ) -> error::Result<(TriggerRoute, String, HashMap<String, String>, ApiAuthed)> {
@@ -476,6 +477,13 @@ async fn get_http_route_trigger(
         .collect();
 
     let username_override = if trigger.requires_auth {
+        let opt_authed = if let Some(token) = token {
+            auth_cache
+                .get_authed(Some(trigger.workspace_id.clone()), token)
+                .await
+        } else {
+            None
+        };
         if let Some(authed) = opt_authed {
             // check that the user has access to the trigger
             let mut tx = user_db.begin(&authed).await?;
@@ -517,19 +525,35 @@ async fn get_http_route_trigger(
 async fn route_job(
     Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
+    Extension(auth_cache): Extension<Arc<AuthCache>>,
+    OptTokened { token }: OptTokened,
     Path(route_path): Path<StripPath>,
-    OptAuthed(opt_authed): OptAuthed,
     Query(query): Query<HashMap<String, String>>,
     method: http::Method,
     headers: HeaderMap,
-    mut args: PushArgsOwned,
+    args: WebhookArgs,
 ) -> impl IntoResponse {
     let route_path = route_path.to_path();
-    let (trigger, called_path, params, authed) =
-        match get_http_route_trigger(route_path, opt_authed, &db, user_db.clone()).await {
-            Ok(trigger) => trigger,
-            Err(e) => return e.into_response(),
-        };
+    let (trigger, called_path, params, authed) = match get_http_route_trigger(
+        route_path,
+        &auth_cache,
+        token.as_ref(),
+        &db,
+        user_db.clone(),
+    )
+    .await
+    {
+        Ok(trigger) => trigger,
+        Err(e) => return e.into_response(),
+    };
+
+    let mut args = match args
+        .to_push_args_owned(&authed, &db, &trigger.workspace_id)
+        .await
+    {
+        Ok(args) => args,
+        Err(e) => return e.into_response(),
+    };
 
     #[cfg(not(feature = "parquet"))]
     if trigger.static_asset_config.is_some() {
@@ -653,7 +677,7 @@ async fn route_job(
                 authed,
                 db,
                 user_db,
-                        trigger.workspace_id.clone(),
+                trigger.workspace_id.clone(),
                 StripPath(trigger.script_path.to_owned()),
                 run_query,
                 args,
@@ -667,7 +691,7 @@ async fn route_job(
                 run_query,
                 StripPath(trigger.script_path.to_owned()),
                 authed,
-                        user_db,
+                user_db,
                 args,
                 trigger.workspace_id.clone(),
                 label_prefix,
@@ -681,7 +705,7 @@ async fn route_job(
                 authed,
                 db,
                 user_db,
-                        trigger.workspace_id.clone(),
+                trigger.workspace_id.clone(),
                 StripPath(trigger.script_path.to_owned()),
                 run_query,
                 args,
@@ -695,7 +719,7 @@ async fn route_job(
                 run_query,
                 StripPath(trigger.script_path.to_owned()),
                 authed,
-                        user_db,
+                user_db,
                 trigger.workspace_id.clone(),
                 args,
                 label_prefix,

backend/windmill-api/src/jobs.rs

@@ -14,6 +14,7 @@ use serde_json::value::RawValue;
 use sqlx::Pool;
 use std::collections::HashMap;
 use std::ops::{Deref, DerefMut};
+use std::str::FromStr;
 #[cfg(feature = "prometheus")]
 use std::sync::atomic::Ordering;
 use tokio::io::AsyncReadExt;
@@ -36,6 +37,7 @@ use crate::db::ApiAuthed;
 use crate::users::get_scope_tags;
 use crate::utils::content_plain;
 use crate::{
+    args::{DecodeQueries, WebhookArgs},
     db::DB,
     users::{check_scopes, require_owner_of_path, OptAuthed},
     utils::require_super_admin,
@@ -83,7 +85,7 @@ use windmill_common::{METRICS_DEBUG_ENABLED, METRICS_ENABLED};
 use windmill_common::{get_latest_deployed_hash_for_path, BASE_URL};
 use windmill_queue::{
     cancel_job, get_queued_job, get_result_by_id_from_running_flow, job_is_complete, push,
-    DecodeQueries, PushArgs, PushArgsOwned, PushIsolationLevel,
+    PushArgs, PushArgsOwned, PushIsolationLevel,
 };
 
 #[cfg(feature = "prometheus")]
@@ -631,7 +633,10 @@ async fn get_flow_job_debug_info(
             }
         }
         for job_id in job_ids {
-            let job = GetQuery::new().with_auth(&opt_authed).fetch(&db, job_id, &w_id).await;
+            let job = GetQuery::new()
+                .with_auth(&opt_authed)
+                .fetch(&db, job_id, &w_id)
+                .await;
             if let Ok(job) = job {
                 jobs.insert(job.id().to_string(), job);
             }
@@ -832,7 +837,10 @@ impl<'a> GetQuery<'a> {
 
         self.check_auth(cjob.as_ref().map(|job| job.created_by.as_str()))?;
         if self.with_flow {
-            cjob = resolve_maybe_value(db, workspace_id, self.with_code, cjob, |job| job.raw_flow.as_mut()).await?;
+            cjob = resolve_maybe_value(db, workspace_id, self.with_code, cjob, |job| {
+                job.raw_flow.as_mut()
+            })
+            .await?;
         }
         if let Some(mut cjob) = cjob {
             cjob.inner = format_completed_job_result(cjob.inner);
@@ -842,14 +850,16 @@ impl<'a> GetQuery<'a> {
     }
 
     async fn fetch(self, db: &DB, job_id: Uuid, workspace_id: &str) -> error::Result<Job> {
-        let cjob = self.fetch_completed(db, job_id, workspace_id)
+        let cjob = self
+            .fetch_completed(db, job_id, workspace_id)
             .await?
             .map(Job::CompletedJob);
 
         match cjob {
             Some(cjob) => Ok(cjob),
             None => {
-                let job_maybe = self.fetch_queued(db, job_id, workspace_id)
+                let job_maybe = self
+                    .fetch_queued(db, job_id, workspace_id)
                     .await?
                     .map(Job::QueuedJob);
                 not_found_if_none(job_maybe, "Job", job_id.to_string())
@@ -2307,7 +2317,7 @@ fn create_signature(
 }
 
 #[allow(non_snake_case)]
-#[derive(Serialize)]
+#[derive(Serialize, Debug)]
 pub struct ResumeUrls {
     approvalPage: String,
     cancel: String,
@@ -2940,8 +2950,10 @@ pub async fn run_flow_by_path(
     Extension(user_db): Extension<UserDB>,
     Path((w_id, flow_path)): Path<(String, StripPath)>,
     Query(run_query): Query<RunJobQuery>,
-    args: PushArgsOwned,
+    args: WebhookArgs,
 ) -> error::Result<(StatusCode, String)> {
+    let args = args.to_push_args_owned(&authed, &db, &w_id).await?;
+
     run_flow_by_path_inner(authed, db, user_db, w_id, flow_path, run_query, args, None).await
 }
 
@@ -3116,8 +3128,9 @@ pub async fn run_script_by_path(
     Extension(user_db): Extension<UserDB>,
     Path((w_id, script_path)): Path<(String, StripPath)>,
     Query(run_query): Query<RunJobQuery>,
-    args: PushArgsOwned,
+    args: WebhookArgs,
 ) -> error::Result<(StatusCode, String)> {
+    let args = args.to_push_args_owned(&authed, &db, &w_id).await?;
     run_script_by_path_inner(
         authed,
         db,
@@ -3218,7 +3231,10 @@ pub async fn run_workflow_as_code(
         i += 1;
     }
 
-    let job = GetQuery::new().without_logs().fetch_queued(&db, job_id, &w_id).await?;
+    let job = GetQuery::new()
+        .without_logs()
+        .fetch_queued(&db, job_id, &w_id)
+        .await?;
 
     if *CLOUD_HOSTED {
         tracing::info!("workflow_as_code_tracing id {i} ");
@@ -3779,11 +3795,13 @@ pub async fn run_wait_result_script_by_path(
     Extension(db): Extension<DB>,
     Path((w_id, script_path)): Path<(String, StripPath)>,
     Query(run_query): Query<RunJobQuery>,
-    args: PushArgsOwned,
+    args: WebhookArgs,
 ) -> error::Result<Response> {
     #[cfg(feature = "enterprise")]
     check_license_key_valid().await?;
 
+    let args = args.to_push_args_owned(&authed, &db, &w_id).await?;
+
     run_wait_result_script_by_path_internal(
         db,
         run_query,
@@ -3861,11 +3879,13 @@ pub async fn run_wait_result_script_by_hash(
     Extension(db): Extension<DB>,
     Path((w_id, script_hash)): Path<(String, ScriptHash)>,
     Query(run_query): Query<RunJobQuery>,
-    args: PushArgsOwned,
+    args: WebhookArgs,
 ) -> error::Result<Response> {
     #[cfg(feature = "enterprise")]
     check_license_key_valid().await?;
 
+    let args = args.to_push_args_owned(&authed, &db, &w_id).await?;
+
     check_queue_too_long(&db, run_query.queue_limit).await?;
 
     let hash = script_hash.0;
@@ -3945,11 +3965,13 @@ pub async fn run_wait_result_flow_by_path(
     Extension(db): Extension<DB>,
     Path((w_id, flow_path)): Path<(String, StripPath)>,
     Query(run_query): Query<RunJobQuery>,
-    args: PushArgsOwned,
+    args: WebhookArgs,
 ) -> error::Result<Response> {
     #[cfg(feature = "enterprise")]
     check_license_key_valid().await?;
 
+    let args = args.to_push_args_owned(&authed, &db, &w_id).await?;
+
     run_wait_result_flow_by_path_internal(
         db, run_query, flow_path, authed, user_db, args, w_id, None,
     )
@@ -4692,12 +4714,12 @@ async fn run_preview_flow_job(
 pub async fn run_job_by_hash(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
-
     Extension(user_db): Extension<UserDB>,
     Path((w_id, script_hash)): Path<(String, ScriptHash)>,
     Query(run_query): Query<RunJobQuery>,
-    args: PushArgsOwned,
+    args: WebhookArgs,
 ) -> error::Result<(StatusCode, String)> {
+    let args = args.to_push_args_owned(&authed, &db, &w_id).await?;
     run_job_by_hash_inner(
         authed,
         db,
@@ -4747,6 +4769,7 @@ pub async fn run_job_by_hash_inner(
     let tag = run_query.tag.clone().or(tag);
 
     check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
+
     let tx = PushIsolationLevel::Isolated(user_db, authed.clone().into());
 
     let (uuid, tx) = push(
@@ -5485,3 +5508,553 @@ async fn delete_completed_job<'a>(
     let response = Json(cj).into_response();
     Ok(response)
 }
+
+use axum::extract::Form;
+use regex::Regex;
+use reqwest::Client;
+use serde_json::Value;
+
+#[derive(Deserialize, Debug)]
+pub struct SlackFormData {
+    payload: String,
+}
+
+#[derive(Deserialize, Debug)]
+struct Payload {
+    actions: Vec<Action>,
+    state: State,
+    response_url: Option<String>,
+    message: Message,
+}
+
+#[derive(Deserialize, Debug)]
+struct Message {
+    blocks: Option<Vec<Value>>,
+}
+
+#[derive(Deserialize, Debug)]
+struct Action {
+    value: String,
+}
+
+#[derive(Deserialize, Debug)]
+struct State {
+    values: HashMap<String, HashMap<String, ValueInput>>,
+}
+
+#[derive(Deserialize, Debug)]
+#[serde(tag = "type", rename_all = "snake_case")]
+enum ValueInput {
+    PlainTextInput { value: Option<Value> },
+    Datepicker { selected_date: Option<String> },
+    Timepicker { selected_time: Option<String> },
+    StaticSelect { selected_option: Option<SelectedOption> },
+    RadioButtons { selected_option: Option<SelectedOption> },
+    Checkboxes { selected_options: Option<Vec<SelectedOption>> },
+}
+
+#[derive(Deserialize, Debug)]
+struct SelectedOption {
+    value: String,
+}
+
+pub async fn slack_app_callback_handler(
+    authed: Option<ApiAuthed>,
+    Extension(db): Extension<DB>,
+    Form(form_data): Form<SlackFormData>,
+) -> error::Result<StatusCode> {
+    tracing::debug!("Form data: {:?}", form_data);
+    let payload: Payload = serde_json::from_str(&form_data.payload)?;
+
+    let action_value = payload.actions[0].value.clone();
+    let response_url = payload.response_url;
+
+    let re = Regex::new(r"/api/w/(?P<w_id>[^/]+)/jobs_u/(?P<action>resume|cancel)/(?P<job_id>[^/]+)/(?P<resume_id>[^/]+)/(?P<secret>[a-fA-F0-9]+)(?:\?approver=(?P<approver>[^&]+))?").unwrap();
+
+    if let Some(captures) = re.captures(&action_value) {
+        let w_id = captures.name("w_id").map_or("", |m| m.as_str());
+        let action = captures.name("action").map_or("", |m| m.as_str());
+        let job_id = captures.name("job_id").map_or("", |m| m.as_str());
+        let resume_id = captures.name("resume_id").map_or("", |m| m.as_str());
+        let secret = captures.name("secret").map_or("", |m| m.as_str());
+        let approver =
+            QueryApprover { approver: captures.name("approver").map(|m| m.as_str().to_string()) };
+
+        tracing::debug!("Request: {:?}", &form_data.payload.clone());
+
+        let state_values: HashMap<String, serde_json::Value> = payload
+        .state
+        .values
+        .iter()
+        .flat_map(|(_, inputs)| {
+            inputs.iter().filter_map(|(action_id, input)| {
+                if action_id.ends_with("_date") {
+                    let base_key = action_id.strip_suffix("_date").unwrap();
+                    let time_key = format!("{}_time", base_key);
+    
+                    // Check for Datepicker and Timepicker inputs specifically
+                    if let ValueInput::Datepicker { selected_date: Some(date) } = input {
+                        let matching_time = payload.state.values.values().flat_map(|inputs| {
+                            inputs.get(&time_key).and_then(|time_input| {
+                                if let ValueInput::Timepicker { selected_time: Some(time) } = time_input {
+                                    Some(time)
+                                } else {
+                                    None
+                                }
+                            })
+                        }).next();
+    
+                        if let Some(time) = matching_time {
+                            return Some((
+                                base_key.to_string(),
+                                serde_json::json!(format!("{}T{}:00.000Z", date, time)),
+                            ));
+                        }
+                    }
+                }
+    
+                // Process non-datetime inputs, including plain text or other types with `_date`
+                match input {
+                    ValueInput::PlainTextInput { value } => {
+                        value.as_ref().map(|v| (action_id.clone(), v.clone().into()))
+                    }
+                    ValueInput::StaticSelect { selected_option } => selected_option
+                        .as_ref()
+                        .map(|so| (action_id.clone(), serde_json::json!(so.value))),
+                    ValueInput::RadioButtons { selected_option } => selected_option
+                        .as_ref()
+                        .map(|so| (action_id.clone(), serde_json::json!(so.value))),
+                    ValueInput::Checkboxes { selected_options } => {
+                        selected_options.as_ref().map(|so| {
+                            (
+                                action_id.clone(),
+                                serde_json::json!(so
+                                    .iter()
+                                    .map(|option| option.value.clone())
+                                    .collect::<Vec<_>>()),
+                            )
+                        })
+                    }
+                    _ => None,
+                }
+            })
+        })
+        .collect();
+    
+
+        let state_json = serde_json::to_value(state_values)
+            .unwrap_or_else(|_| serde_json::json!({}));
+
+        tracing::debug!("W ID: {}", w_id);
+        tracing::debug!("Action: {}", action);
+        tracing::debug!("Job ID: {}", job_id);
+        tracing::debug!("Resume ID: {}", resume_id);
+        tracing::debug!("Secret: {}", secret);
+        tracing::debug!("Approver: {:?}", approver.approver);
+        tracing::debug!("State JSON: {:?}", state_json);
+
+        let res = resume_suspended_job_internal(
+            Some(state_json),
+            db,
+            w_id.to_string(),
+            Uuid::from_str(job_id).unwrap_or_default(),
+            resume_id.parse::<u32>().unwrap_or_default(),
+            approver,
+            secret.to_string(),
+            authed,
+            action == "resume",
+        )
+        .await;
+
+        tracing::debug!("Res: {:?}", res);
+
+        if let Some(url) = response_url {
+            let message = if action == "resume" {
+                "\n\n*Workflow has been resumed!*"
+            } else {
+                "\n\n*Workflow has been canceled!*"
+            };
+            let _ = post_slack_response(&url, message).await;
+        }
+    } else {
+        tracing::error!("Resume URL does not match the pattern.");
+    }
+
+    Ok(StatusCode::OK)
+}
+
+#[derive(Deserialize)]
+pub struct QueryMessage {
+    pub message: Option<String>,
+}
+
+pub async fn request_slack_approval(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path((w_id, job_id, resume_id)): Path<(String, Uuid, u32)>,
+    Query(approver): Query<QueryApprover>,
+    Query(message): Query<QueryMessage>,
+) -> windmill_common::error::JsonResult<serde_json::Value> {
+
+    let res = get_resume_urls(
+        authed,
+        axum::Extension(db.clone()),
+        Path((w_id, job_id, resume_id)),
+        axum::extract::Query(approver),
+    )
+    .await;
+
+    let schema: Option<ResumeFormRow> = sqlx::query_as!(
+        ResumeFormRow,
+        "SELECT
+            module.value->'suspend'->'resume_form' AS resume_form,
+            (module.value->'suspend'->>'hide_cancel')::boolean AS hide_cancel
+        FROM
+            job
+        LEFT JOIN
+            queue ON job.id = queue.parent_job
+        LEFT JOIN
+            jsonb_array_elements(job.raw_flow->'modules') AS module
+                ON module->>'id' = queue.flow_step_id
+        WHERE
+            queue.id = $1",
+        job_id
+    )
+    .fetch_optional(&db)
+    .await?;
+
+    tracing::debug!("schema: {:?}", schema);
+    tracing::debug!("job_id: {:?}", job_id);
+
+    let message_str = message.message.as_deref().unwrap_or("*A workflow has been suspended and is waiting for approval:*\n");
+
+    if let Some(resume_schema) = schema {
+        let hide_cancel = resume_schema.hide_cancel.unwrap_or(false);
+
+        let schema_obj = match resume_schema.resume_form {
+            Some(schema) => schema,
+            None => {
+                tracing::debug!("No suspend form found!");
+                return transform_schemas(message_str, None, &res.unwrap().0, None, hide_cancel)
+                    .await
+                    .map(Json);
+            }
+        };
+
+        let inner_schema = schema_obj
+            .get("schema")
+            .ok_or_else(|| Error::BadRequest("Schema object is missing the 'schema' field!".to_string()))?;
+
+        let order_value = inner_schema
+            .get("order")
+            .ok_or_else(|| Error::BadRequest("Schema does not contain order field!".to_string()))?;
+
+        let order: Vec<String> = serde_json::from_value(order_value.clone())
+            .map_err(|e| {
+                tracing::error!("Failed to deserialize order: {:?}", e);
+                Error::BadRequest("Failed to deserialize order!".to_string())
+            })?;
+
+        let properties_value = inner_schema
+            .get("properties")
+            .ok_or_else(|| Error::BadRequest("Schema does not contain properties field!".to_string()))?;
+        let properties: HashMap<String, ResumeFormField> = serde_json::from_value(properties_value.clone())
+            .map_err(|e| {
+                tracing::error!("Deserialization failed: {:?}", e);
+                Error::BadRequest("Failed to deserialize properties!".to_string())
+            })?;
+
+        let blocks = transform_schemas(message_str, Some(&properties), &res.unwrap().0, Some(&order), hide_cancel)
+            .await?;
+        Ok(Json(blocks))
+    } else {
+        Err(Error::BadRequest(
+            "Could not generate interactive Slack message!".to_string(),
+        ))
+    }
+}
+
+async fn post_slack_response(
+    response_url: &str,
+    message: &str,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let mut final_blocks = vec![serde_json::json!({
+        "type": "section",
+        "text": {
+            "type": "mrkdwn",
+            "text": message
+        }
+    })];
+
+    let payload = serde_json::json!({
+        "replace_original": "true",
+        "text": message,
+        "blocks": final_blocks
+    });
+
+    let client = Client::new();
+
+    let response = client
+        .post(response_url)
+        .header("Content-Type", "application/json")
+        .json(&payload)
+        .send()
+        .await?;
+
+    if response.status().is_success() {
+        tracing::debug!("Slack response to approval sent successfully!");
+    } else {
+        tracing::error!(
+            "Slack response to approval failed. Status: {}",
+            response.status()
+        );
+    }
+
+    Ok(())
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct ResumeSchema {
+    pub schema: Schema,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct ResumeFormRow {
+    pub resume_form: Option<serde_json::Value>,
+    pub hide_cancel: Option<bool>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct Schema {
+    pub order: Vec<String>,
+    pub required: Vec<String>,
+    pub properties: HashMap<String, ResumeFormField>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct ResumeFormField {
+    #[serde(rename = "type")]
+    pub r#type: String,
+    pub format: Option<String>,
+    pub default: Option<String>,
+    pub description: Option<String>,
+    pub title: Option<String>,
+    #[serde(rename = "enum")]
+    pub r#enum: Option<Vec<String>>,
+    #[serde(rename = "enumLabels")]
+    pub enum_labels: Option<HashMap<String, String>>,
+}
+
+async fn transform_schemas(
+    text: &str,
+    properties: Option<&HashMap<String, ResumeFormField>>,
+    urls: &ResumeUrls,
+    order: Option<&Vec<String>>,
+    hide_cancel: bool,
+) -> Result<serde_json::Value, Error> {
+    tracing::debug!("{:?}", urls);
+
+    let mut blocks = vec![serde_json::json!({
+        "type": "section",
+        "text": {
+            "type": "mrkdwn",
+            "text": format!("{}\n<{}|Flow suspension details>", text, urls.approvalPage),
+        }
+    })];
+
+    if let Some(properties) = properties {
+        if let Some(order) = order {
+            for key in order {
+                if let Some(schema) = properties.get(key) {
+                    let input_block = create_input_block(key, schema);
+                    match input_block {
+                        serde_json::Value::Array(arr) => blocks.extend(arr),
+                        _ => blocks.push(input_block),
+                    }
+                }
+            }
+        } else {
+            for (key, schema) in properties {
+                let input_block = create_input_block(key, schema);
+                match input_block {
+                    serde_json::Value::Array(arr) => blocks.extend(arr),
+                    _ => blocks.push(input_block),
+                }
+            }
+        }
+    }
+
+    blocks.push(create_action_buttons(urls, hide_cancel));
+
+    Ok(serde_json::Value::Array(blocks))
+}
+
+fn create_input_block(key: &str, schema: &ResumeFormField) -> serde_json::Value {
+    let placeholder = schema
+        .description
+        .as_deref()
+        .filter(|desc| !desc.is_empty())
+        .unwrap_or("Select an option");
+
+    // Handle date-time format
+    if schema.r#type == "string" && schema.format.as_deref() == Some("date-time") {
+        let now = chrono::Local::now();
+        let current_date = now.format("%Y-%m-%d").to_string();
+        let current_time = now.format("%H:%M").to_string();
+
+        let (default_date, default_time) = if let Some(default) = &schema.default {
+            if let Ok(parsed_date) = chrono::DateTime::parse_from_rfc3339(default) {
+                (
+                    parsed_date.format("%Y-%m-%d").to_string(),
+                    parsed_date.format("%H:%M").to_string(),
+                )
+            } else {
+                (current_date.clone(), current_time.clone())
+            }
+        } else {
+            (current_date.clone(), current_time.clone())
+        };
+
+        return serde_json::json!([
+                {
+                    "type": "input",
+                    "element": {
+                        "type": "datepicker",
+                        "initial_date": &default_date,
+                        "placeholder": {
+                            "type": "plain_text",
+                            "text": "Select a date",
+                            "emoji": true
+                        },
+                        "action_id": format!("{}_date", key)
+                    },
+                    "label": {
+                        "type": "plain_text",
+                        "text": schema.title.as_deref().unwrap_or(key),
+                        "emoji": true
+                    }
+                },
+                {
+                    "type": "input",
+                    "element": {
+                        "type": "timepicker",
+                        "initial_time": &default_time,
+                        "placeholder": {
+                            "type": "plain_text",
+                            "text": "Select time",
+                            "emoji": true
+                        },
+                        "action_id": format!("{}_time", key)
+                    },
+                    "label": {
+                        "type": "plain_text",
+                        "text": " ",
+                        "emoji": true
+                    }
+                }
+            ]);
+    }
+
+    // Handle enum type
+    if let Some(enums) = &schema.r#enum {
+
+        let initial_option = schema.default.as_ref().and_then(|default_value| {
+            enums.iter().find(|enum_value| enum_value == &default_value).map(|enum_value| {
+                serde_json::json!({
+                    "text": {
+                        "type": "plain_text",
+                        "text": schema.enum_labels.as_ref()
+                            .and_then(|labels| labels.get(enum_value))
+                            .unwrap_or(enum_value),
+                        "emoji": true
+                    },
+                    "value": enum_value
+                })
+            })
+        });
+
+        let mut element = serde_json::json!({
+            "type": "static_select",
+            "placeholder": {
+                "type": "plain_text",
+                "text": placeholder,
+                "emoji": true,
+            },
+            "options": enums.iter().map(|enum_value| {
+                serde_json::json!({
+                    "text": {
+                        "type": "plain_text",
+                        "text": schema.enum_labels.as_ref()
+                            .and_then(|labels| labels.get(enum_value))
+                            .unwrap_or(enum_value),
+                        "emoji": true
+                    },
+                    "value": enum_value
+                })
+            }).collect::<Vec<_>>(),
+            "action_id": key
+        });
+
+        if let Some(option) = initial_option {
+            element["initial_option"] = option;
+        }
+    
+        serde_json::json!({
+            "type": "input",
+            "element": element,
+            "label": {
+                "type": "plain_text",
+                "text": schema.title.as_deref().unwrap_or(key),
+                "emoji": true
+            }
+        })
+    } else {
+        // Handle other types
+        serde_json::json!({
+            "type": "input",
+            "element": {
+                "type": "plain_text_input",
+                "action_id": key,
+                "initial_value": schema.default.as_deref().unwrap_or("")
+            },
+            "label": {
+                "type": "plain_text",
+                "text": schema.title.as_deref().unwrap_or(key),
+                "emoji": true
+            }
+        })
+    }
+}
+
+fn create_action_buttons(urls: &ResumeUrls, hide_cancel: bool) -> serde_json::Value {
+    let mut elements = vec![
+        serde_json::json!({
+            "type": "button",
+            "text": {
+                "type": "plain_text",
+                "text": "Continue"
+            },
+            "style": "primary",
+            "action_id": "resume_action",
+            "value": urls.resume
+        })
+    ];
+
+    if !hide_cancel {
+        elements.push(serde_json::json!({
+            "type": "button",
+            "text": {
+                "type": "plain_text",
+                "text": "Abort"
+            },
+            "style": "danger",
+            "action_id": "cancel_action",
+            "value": urls.cancel
+        }));
+    }
+
+    serde_json::json!({
+        "type": "actions",
+        "elements": elements
+    })
+}

backend/windmill-api/src/lib.rs

@@ -23,7 +23,7 @@ use crate::{
 use anyhow::Context;
 use argon2::Argon2;
 use axum::extract::DefaultBodyLimit;
-use axum::{middleware::from_extractor, routing::get, Extension, Router};
+use axum::{middleware::from_extractor, routing::get, routing::post, Extension, Router};
 use db::DB;
 use http::HeaderValue;
 use reqwest::Client;
@@ -46,6 +46,7 @@ use windmill_common::error::AppError;
 
 mod ai;
 mod apps;
+mod args;
 mod audit;
 mod capture;
 mod concurrency_groups;
@@ -64,6 +65,8 @@ mod indexer_ee;
 mod inputs;
 mod integration;
 
+#[cfg(feature = "enterprise")]
+mod apps_ee;
 #[cfg(feature = "parquet")]
 mod job_helpers_ee;
 pub mod job_metrics;
@@ -343,6 +346,17 @@ pub async fn run_server(
                 )
                 .nest("/concurrency_groups", concurrency_groups::global_service())
                 .nest("/scripts_u", scripts::global_unauthed_service())
+                .nest("/apps_u", {
+                    #[cfg(feature = "enterprise")]
+                    {
+                        apps_ee::global_unauthed_service()
+                    }
+
+                    #[cfg(not(feature = "enterprise"))]
+                    {
+                        Router::new()
+                    }
+                })
                 .nest(
                     "/w/:workspace_id/apps_u",
                     apps::unauthed_service()
@@ -353,6 +367,8 @@ pub async fn run_server(
                     "/w/:workspace_id/jobs_u",
                     jobs::workspace_unauthed_service().layer(cors.clone()),
                 )
+                .route("/slack", post(jobs::slack_app_callback_handler))
+                .route("/w/:workspace_id/jobs/slack_approval/:job_id/:resume_id", get(jobs::request_slack_approval))
                 .nest(
                     "/w/:workspace_id/resources_u",
                     resources::public_service().layer(cors.clone()),

backend/windmill-api/src/scripts.rs

@@ -1439,14 +1439,27 @@ async fn delete_script_by_path(
         require_admin(authed.is_admin, &authed.username)?;
     }
 
-    let script = sqlx::query_scalar!(
-        "DELETE FROM script WHERE path = $1 AND workspace_id = $2 RETURNING path",
-        path,
-        w_id
-    )
-    .fetch_one(&db)
-    .await
-    .map_err(|e| Error::InternalErr(format!("deleting script by path {w_id}: {e:#}")))?;
+    let script = if !draft_only {
+        require_admin(authed.is_admin, &authed.username)?;
+        sqlx::query_scalar!(
+            "DELETE FROM script WHERE path = $1 AND workspace_id = $2 RETURNING path",
+            path,
+            w_id
+        )
+        .fetch_one(&db)
+        .await
+        .map_err(|e| Error::InternalErr(format!("deleting script by path {w_id}: {e:#}")))?
+    } else {
+        // If the script is draft only, we can delete it without admin permissions but we still need write permissions
+        sqlx::query_scalar!(
+            "DELETE FROM script WHERE path = $1 AND workspace_id = $2 RETURNING path",
+            path,
+            w_id
+        )
+        .fetch_one(&mut *tx)
+        .await
+        .map_err(|e| Error::InternalErr(format!("deleting script by path {w_id}: {e:#}")))?
+    };
 
     sqlx::query!(
         "DELETE FROM draft WHERE path = $1 AND workspace_id = $2 AND typ = 'script'",

backend/windmill-api/src/settings.rs

@@ -448,7 +448,7 @@ pub async fn get_critical_alerts(
     Extension(db): Extension<DB>,
     authed: ApiAuthed,
     Query(params): Query<crate::utils::AlertQueryParams>,
-) -> JsonResult<Vec<crate::utils::CriticalAlert>> {
+) -> JsonResult<serde_json::Value> {
     require_devops_role(&db, &authed.email).await?;
 
     crate::utils::get_critical_alerts(db, params, None).await

backend/windmill-api/src/tracing_init.rs

@@ -29,11 +29,13 @@ impl<B> OnResponse<B> for MyOnResponse {
         _span: &tracing::Span,
     ) {
         if *LOG_REQUESTS {
-            tracing::info!(
-                latency = latency.as_millis(),
-                status = response.status().as_u16(),
-                "response"
-            )
+            let latency = latency.as_millis();
+            let status = response.status().as_u16();
+            if response.status().is_success() {
+                tracing::info!(latency = latency, status = status, "response")
+            } else {
+                tracing::error!(latency = latency, status = status, "response")
+            }
         }
     }
 }
@@ -67,7 +69,7 @@ impl<B> MakeSpan<B> for MyMakeSpan {
             uri = %request.uri(),
             username = field::Empty,
             workspace_id = field::Empty,
-            trace_id = tracing_id,
+            traceId = tracing_id,
             email = field::Empty,
         )
     }

backend/windmill-api/src/users.rs

@@ -513,6 +513,10 @@ pub struct Tokened {
     pub token: String,
 }
 
+pub struct OptTokened {
+    pub token: Option<String>,
+}
+
 struct BruteForceCounter {
     counter: AtomicU64,
     last_reset: AtomicI64,
@@ -570,6 +574,30 @@ where
     }
 }
 
+#[async_trait]
+impl<S> FromRequestParts<S> for OptTokened
+where
+    S: Send + Sync,
+{
+    type Rejection = (StatusCode, String);
+
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &S,
+    ) -> std::result::Result<Self, Self::Rejection> {
+        if parts.method == http::Method::OPTIONS {
+            return Ok(OptTokened { token: None });
+        };
+        let already_tokened = parts.extensions.get::<Tokened>();
+        if let Some(tokened) = already_tokened {
+            Ok(OptTokened { token: Some(tokened.token.clone()) })
+        } else {
+            let token_o = extract_token(parts, state).await;
+            Ok(OptTokened { token: token_o })
+        }
+    }
+}
+
 pub async fn maybe_refresh_folders(
     path: &str,
     w_id: &str,
@@ -819,6 +847,7 @@ pub struct UserInfo {
     pub folders_read: Vec<String>,
     pub folders: Vec<String>,
     pub folders_owners: Vec<String>,
+    pub name: Option<String>,
 }
 
 #[derive(FromRow, Serialize)]
@@ -1190,6 +1219,7 @@ async fn whoami(
             workspace_id: w_id,
             email: email.clone(),
             username: email,
+            name: None,
             is_admin,
             is_super_admin: is_admin,
             created_at: chrono::Utc::now(),
@@ -1278,22 +1308,30 @@ async fn get_usage(
     Ok(usage.to_string())
 }
 
+#[derive(FromRow, Serialize)]
+pub struct User2 {
+    pub workspace_id: String,
+    pub email: String,
+    pub username: String,
+    pub is_admin: bool,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub operator: bool,
+    pub disabled: bool,
+    pub role: Option<String>,
+    pub super_admin: bool,
+    pub name: Option<String>,
+}
+
 async fn get_user(w_id: &str, username: &str, db: &DB) -> Result<Option<UserInfo>> {
     let user = sqlx::query_as!(
-        User,
-        "SELECT * FROM usr where username = $1 AND workspace_id = $2",
+        User2,
+        "SELECT usr.*, password.super_admin, password.name FROM usr LEFT JOIN password ON usr.email = password.email Where usr.username = $1 AND workspace_id = $2
+        ",
         username,
         w_id
     )
     .fetch_optional(db)
     .await?;
-    let is_super_admin = sqlx::query_scalar!(
-        "SELECT super_admin FROM password WHERE email = $1",
-        user.as_ref().map(|x| &x.email)
-    )
-    .fetch_optional(db)
-    .await?
-    .unwrap_or(false);
     let groups = get_groups_for_user(
         &w_id,
         username,
@@ -1311,8 +1349,9 @@ async fn get_user(w_id: &str, username: &str, db: &DB) -> Result<Option<UserInfo
         workspace_id: usr.workspace_id,
         email: usr.email,
         username: usr.username,
+        name: usr.name,
         is_admin: usr.is_admin,
-        is_super_admin,
+        is_super_admin: usr.super_admin,
         created_at: usr.created_at,
         operator: usr.operator,
         disabled: usr.disabled,

backend/windmill-api/src/utils.rs

@@ -10,6 +10,7 @@ use axum::{body::Body, response::Response};
 use regex::Regex;
 use serde::Deserialize;
 use sqlx::{Postgres, Transaction};
+use windmill_common::worker::CLOUD_HOSTED;
 use windmill_common::{
     auth::{is_devops_email, is_super_admin_email},
     error::{self, Error},
@@ -206,11 +207,55 @@ pub async fn get_critical_alerts(
     db: DB,
     params: AlertQueryParams,
     workspace_id: Option<String>,
-) -> JsonResult<Vec<CriticalAlert>> {
+) -> JsonResult<serde_json::Value> {
+    // Returning total rows and total pages
     let page = params.page.unwrap_or(1).max(1);
     let page_size = params.page_size.unwrap_or(10).min(100) as i64;
     let offset = ((page - 1) * page_size as i32) as i64;
 
+    // Count total rows
+    let total_rows = if let Some(workspace_id) = &workspace_id {
+        if params.acknowledged.is_none() {
+            sqlx::query_scalar!(
+                "SELECT COUNT(*)
+                 FROM alerts
+                 WHERE workspace_id = $1",
+                workspace_id
+            )
+            .fetch_one(&db)
+            .await?
+        } else {
+            sqlx::query_scalar!(
+                "SELECT COUNT(*)
+                 FROM alerts
+                 WHERE workspace_id = $1 AND COALESCE(acknowledged_workspace, false) = $2",
+                workspace_id,
+                params.acknowledged
+            )
+            .fetch_one(&db)
+            .await?
+        }
+    } else {
+        if params.acknowledged.is_none() {
+            sqlx::query_scalar!(
+                "SELECT COUNT(*)
+                 FROM alerts"
+            )
+            .fetch_one(&db)
+            .await?
+        } else {
+            sqlx::query_scalar!(
+                "SELECT COUNT(*)
+                 FROM alerts
+                 WHERE COALESCE(acknowledged, false) = $1",
+                params.acknowledged
+            )
+            .fetch_one(&db)
+            .await?
+        }
+    };
+
+    // Fetch paginated rows
     let alerts = if let Some(workspace_id) = workspace_id {
         // `workspace_id` is provided => workspace admin
         if params.acknowledged.is_none() {
@@ -278,7 +323,14 @@ pub async fn get_critical_alerts(
         }
     };
 
-    Ok(Json(alerts))
+    let total_rows = total_rows.unwrap_or(0);
+    let total_pages = ((total_rows as f64) / (page_size as f64)).ceil() as i64;
+
+    Ok(Json(serde_json::json!({
+        "alerts": alerts,
+        "total_rows": total_rows,
+        "total_pages": total_pages
+    })))
 }
 
 #[cfg(feature = "enterprise")]
@@ -292,12 +344,17 @@ pub async fn acknowledge_critical_alert(
          SET
            acknowledged = true,
            acknowledged_workspace = CASE
-             WHEN $2::text IS NOT NULL AND workspace_id = $2 THEN true
-             ELSE acknowledged_workspace
+             WHEN $3 THEN
+               CASE
+                 WHEN $2::text IS NOT NULL AND workspace_id = $2 THEN true
+                 ELSE acknowledged_workspace
+               END
+             ELSE true
            END
          WHERE id = $1",
         id,
-        workspace_id
+        workspace_id,
+        *CLOUD_HOSTED
     )
     .execute(&db)
     .await?;
@@ -320,12 +377,17 @@ pub async fn acknowledge_all_critical_alerts(
          SET
            acknowledged = true,
            acknowledged_workspace = CASE
-             WHEN $1::text IS NOT NULL THEN true
-             ELSE acknowledged_workspace
+             WHEN $2 THEN
+               CASE
+                 WHEN $1::text IS NOT NULL THEN true
+                 ELSE acknowledged_workspace
+               END
+             ELSE true
            END
          WHERE ($1::text IS NOT NULL AND workspace_id = $1)
             OR ($1::text IS NULL)",
-        workspace_id
+        workspace_id,
+        *CLOUD_HOSTED
     )
     .execute(&db)
     .await?;

backend/windmill-api/src/workspaces.rs

@@ -3111,7 +3111,7 @@ pub async fn get_critical_alerts(
     Path(w_id): Path<String>,
     authed: ApiAuthed,
     Query(params): Query<crate::utils::AlertQueryParams>,
-) -> JsonResult<Vec<crate::utils::CriticalAlert>> {
+) -> JsonResult<serde_json::Value> {
     require_admin_or_devops(authed.is_admin, &authed.username, &authed.email, &db).await?;
 
     crate::utils::get_critical_alerts(db, params, Some(w_id)).await

backend/windmill-common/Cargo.toml

@@ -13,6 +13,8 @@ flamegraph = ["dep:tracing-flame"]
 loki = ["dep:tracing-loki"]
 benchmark = []
 parquet = ["dep:object_store", "dep:aws-config", "dep:aws-sdk-sts"]
+otel = ["dep:opentelemetry-semantic-conventions", "dep:opentelemetry-otlp", "dep:opentelemetry_sdk", 
+    "dep:opentelemetry", "dep:tracing-opentelemetry", "dep:opentelemetry-appender-tracing", "dep:tonic"]
 
 [lib]
 name = "windmill_common"
@@ -62,6 +64,15 @@ windmill-macros.workspace = true
 semver.workspace = true
 croner = "2.0.6"
 quick_cache.workspace = true
+pin-project-lite.workspace = true
+
+opentelemetry-semantic-conventions = { workspace = true, optional = true }
+opentelemetry-otlp = { workspace = true, optional = true }
+opentelemetry_sdk = { workspace = true, optional = true }
+opentelemetry = { workspace = true, optional = true }
+tracing-opentelemetry = { workspace = true, optional = true }
+opentelemetry-appender-tracing = { workspace = true, optional = true }
+tonic = { workspace = true, optional = true }
 
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
 tikv-jemalloc-ctl = { optional = true, workspace = true }

backend/windmill-common/src/apps.rs

@@ -6,7 +6,18 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
+
+/// Id in the `app_script` table.
+#[derive(Serialize, Deserialize, Debug, Copy, Clone, Hash, Eq, PartialEq)]
+#[serde(transparent)]
+pub struct AppScriptId(pub i64);
+
+impl Into<u64> for AppScriptId {
+    fn into(self) -> u64 {
+        self.0 as u64
+    }
+}
 
 #[derive(Deserialize)]
 pub struct ListAppQuery {

backend/windmill-common/src/cache.rs

@@ -1,25 +1,149 @@
 use crate::error;
 
+use std::future::Future;
+use std::hash::Hash;
 use std::path::{Path, PathBuf};
 
-use quick_cache::sync::Cache;
+use quick_cache::Equivalent;
+use serde::{Deserialize, Serialize};
 use sqlx::PgExecutor;
 
+pub use const_format::concatcp;
+pub use lazy_static::lazy_static;
+pub use quick_cache::sync::Cache;
+
 /// Cache directory for windmill server/worker(s).
 pub const CACHE_DIR: &str = "/tmp/windmill/cache/";
 
+/// A file-system backed concurrent cache.
+pub struct FsBackedCache<Key, Val> {
+    cache: Cache<Key, Val>,
+    root: &'static str,
+}
+
+impl<Key: Eq + Hash, Val: Clone + fs::Bundle> FsBackedCache<Key, Val> {
+    /// Create a new file-system backed cache with `items_capacity` capacity.
+    /// The cache will be stored in the `root` directory.
+    pub fn new(root: &'static str, items_capacity: usize) -> Self {
+        Self { cache: Cache::new(items_capacity), root }
+    }
+
+    /// Gets or inserts an item in the cache with key `key`.
+    pub async fn get_or_insert_async<'a, Q, F>(&'a self, key: &Q, with: F) -> error::Result<Val>
+    where
+        Q: Hash + Equivalent<Key> + ToOwned<Owned = Key> + Copy + Into<u64>,
+        F: Future<Output = error::Result<Val>>,
+    {
+        self.cache
+            .get_or_insert_async(
+                key,
+                fs::import_or_insert_with(self.root, (*key).into(), with),
+            )
+            .await
+    }
+}
+
+/// Like [`lazy_static`]`, but for file-system backed caches.
+///
+/// # Example
+/// ```rust
+/// use windmill_common::make_static;
+///
+/// make_static! {
+///     /// String cache with a maximum capacity of 1000 items stored in the
+///     /// "subdirectory" directory.
+///    static ref CACHE: { u64 => String } in "subdirectory" <= 1000;
+///    /// Another cache.
+///    static ref ANOTHER_CACHE: { u64 => Vec<String> } in "another" <= 100;
+/// }
+/// ```
+#[macro_export]
+macro_rules! make_static {
+    { $( $(#[$attr:meta])* static ref $name:ident: { $Key:ty => $Val:ty } in $root:literal <= $cap:literal; )+ } => {
+        $crate::cache::lazy_static! {
+            $(
+                $(#[$attr])*
+                static ref $name: $crate::cache::FsBackedCache<$Key, $Val> =
+                    $crate::cache::FsBackedCache::new(
+                        $crate::cache::concatcp!($crate::cache::CACHE_DIR, $root),
+                        $cap
+                    );
+            )+
+        }
+    };
+}
+
+// re-export:
+pub use make_static;
+
+/// Create an anonymous file-system backed cache for one-time use.
+///
+/// # Example
+/// ```rust
+/// use windmill_common::anon;
+/// let cache = anon!({ u64 => String } in "subdirectory" <= 1000);
+/// ```
+#[macro_export]
+macro_rules! anon {
+    ({ $Key:ty => $Val:ty } in $root:literal <= $cap:literal) => {{
+        $crate::cache::make_static! {
+            static ref __ANON__: { $Key => $Val } in $root <= $cap;
+        }
+
+        &__ANON__
+    }};
+}
+
+// re-export:
+pub use anon;
+
+pub mod future {
+    use super::*;
+
+    /// Extension trait for futures that can be cached.
+    pub trait FutureCachedExt<Val: Clone + fs::Bundle>:
+        Future<Output = error::Result<Val>> + Sized
+    {
+        /// Get or insert the future result in the cache.
+        ///
+        /// # Example
+        /// ```rust
+        /// use windmill_common::cache::{self, future::FutureCachedExt};
+        ///
+        /// async {
+        ///     let result = std::future::ready(Ok(42))
+        ///         .cached(cache::anon!({ u64 => u64 } in "test" <= 1), &42)
+        ///         .await;
+        ///
+        ///     assert_eq!(result.unwrap(), 42);
+        /// };
+        /// ```
+        fn cached<Key: Eq + Hash, Q>(
+            self,
+            cache: &FsBackedCache<Key, Val>,
+            key: &Q,
+        ) -> impl Future<Output = error::Result<Val>>
+        where
+            Q: Hash + Equivalent<Key> + ToOwned<Owned = Key> + Copy + Into<u64>,
+        {
+            cache.get_or_insert_async(key, self)
+        }
+    }
+
+    impl<Val: Clone + fs::Bundle, F: Future<Output = error::Result<Val>> + Sized>
+        FutureCachedExt<Val> for F
+    {
+    }
+}
+
 pub mod flow {
     use super::*;
     use crate::flows::{FlowNodeId, FlowValue};
 
-    /// Cache directory for windmill server/worker(s) flow nodes.
-    pub const CACHE_DIR: &str = const_format::concatcp!(super::CACHE_DIR, "flow");
-
-    lazy_static::lazy_static! {
+    make_static! {
         /// Flow node cache.
-        /// FIXME: This should be a static but [`Cache`] does not have a const constructor.
         /// FIXME: Use `Arc<Val>` for cheap cloning.
-        static ref CACHE: Cache<FlowNodeId, Val> = Cache::new(1000);
+        static ref CACHE: { FlowNodeId => Val } in "flow" <= 1000;
     }
 
     /// Flow node cache value.
@@ -34,24 +158,36 @@ pub mod flow {
     /// If not present, import from the file-system cache or fetch it from the database and write
     /// it to the file system and cache.
     /// This should be preferred over fetching the database directly.
-    pub async fn fetch_script(e: impl PgExecutor<'_>, node: FlowNodeId)
-        -> error::Result<(Option<String>, String)>
-    {
-        fetch(e, node).await.and_then(|Val { lock, code, .. }| Ok((lock, code.ok_or_else(|| {
-            error::Error::InternalErr(format!("Flow node ({:x}) isn't a script node.", node.0))
-        })?)))
+    pub async fn fetch_script(
+        e: impl PgExecutor<'_>,
+        node: FlowNodeId,
+    ) -> error::Result<(Option<String>, String)> {
+        fetch(e, node).await.and_then(|Val { lock, code, .. }| {
+            Ok((
+                lock,
+                code.ok_or_else(|| {
+                    error::Error::InternalErr(format!(
+                        "Flow node ({:x}) isn't a script node.",
+                        node.0
+                    ))
+                })?,
+            ))
+        })
     }
 
     /// Fetch the flow node flow value referenced by `node` from the cache.
     /// If not present, import from the file-system cache or fetch it from the database and write
     /// it to the file system and cache.
     /// This should be preferred over fetching the database directly.
-    pub async fn fetch_flow(e: impl PgExecutor<'_>, node: FlowNodeId)
-        -> error::Result<FlowValue>
-    {
-        fetch(e, node).await.and_then(|Val { flow, .. }| flow.ok_or_else(|| {
-            error::Error::InternalErr(format!("Flow node ({:x}) isn't a flow value node.", node.0))
-        }))
+    pub async fn fetch_flow(e: impl PgExecutor<'_>, node: FlowNodeId) -> error::Result<FlowValue> {
+        fetch(e, node).await.and_then(|Val { flow, .. }| {
+            flow.ok_or_else(|| {
+                error::Error::InternalErr(format!(
+                    "Flow node ({:x}) isn't a flow value node.",
+                    node.0
+                ))
+            })
+        })
     }
 
     /// Fetch the flow node referenced by `node` from the cache.
@@ -62,9 +198,8 @@ pub mod flow {
         // If not present, `get_or_insert_async` will lock the key until the future completes,
         // so only one thread will be able to fetch the data from the database and write it to
         // the file system and cache, hence no race on the file system.
-        CACHE.get_or_insert_async(
-            &node,
-            fs::import_or_insert_with(CACHE_DIR, node.0 as u64, async {
+        CACHE
+            .get_or_insert_async(&node, async {
                 sqlx::query!(
                     "SELECT \
                         lock AS \"lock: String\", \
@@ -76,18 +211,24 @@ pub mod flow {
                 .fetch_one(e)
                 .await
                 .map_err(Into::into)
-                .and_then(|r| Ok(Val {
-                    lock: r.lock.and_then(|x| if x.is_empty() { None } else { Some(x) }),
-                    code: r.code,
-                    flow: match r.flow {
-                        None => None,
-                        Some(flow) => serde_json::from_str(&flow).map_err(|err| {
-                            error::Error::InternalErr(format!("Unable to parse flow value: {err:?}"))
-                        })?,
-                    }
-                }))
+                .and_then(|r| {
+                    Ok(Val {
+                        lock: r
+                            .lock
+                            .and_then(|x| if x.is_empty() { None } else { Some(x) }),
+                        code: r.code,
+                        flow: match r.flow {
+                            None => None,
+                            Some(flow) => serde_json::from_str(&flow).map_err(|err| {
+                                error::Error::InternalErr(format!(
+                                    "Unable to parse flow value: {err:?}"
+                                ))
+                            })?,
+                        },
+                    })
+                })
             })
-        ).await
+            .await
     }
 
     // ----------------------------------------------------------------------------------------------
@@ -130,7 +271,11 @@ pub mod flow {
             match item {
                 Item::Lock => Ok(self.lock.as_ref().map(|s| s.as_bytes().to_vec())),
                 Item::Code => Ok(self.code.as_ref().map(|s| s.as_bytes().to_vec())),
-                Item::Flow => Ok(self.flow.as_ref().map(|f| serde_json::to_vec(f)).transpose()?),
+                Item::Flow => Ok(self
+                    .flow
+                    .as_ref()
+                    .map(|f| serde_json::to_vec(f))
+                    .transpose()?),
             }
         }
     }
@@ -140,14 +285,10 @@ pub mod script {
     use super::*;
     use crate::scripts::{ScriptHash, ScriptLang};
 
-    /// Cache directory for windmill server/worker(s) scripts.
-    pub const CACHE_DIR: &str = const_format::concatcp!(super::CACHE_DIR, "script");
-
-    lazy_static::lazy_static! {
+    make_static! {
         /// Scripts cache.
-        /// FIXME: This should be a static but [`Cache`] does not have a const constructor.
         /// FIXME: Use `Arc<Val>` for cheap cloning.
-        static ref CACHE: Cache<ScriptHash, Val> = Cache::new(1000);
+        static ref CACHE: { ScriptHash => Val } in "script" <= 1000;
     }
 
     /// Script cache value.
@@ -164,15 +305,16 @@ pub mod script {
     /// If not present, import from the file-system cache or fetch it from the database and write
     /// it to the file system and cache.
     /// This should be preferred over fetching the database directly.
-    pub async fn fetch(e: impl PgExecutor<'_>, hash: ScriptHash, workspace_id: &str)
-        -> error::Result<Val>
-    {
+    pub async fn fetch(
+        e: impl PgExecutor<'_>,
+        hash: ScriptHash,
+        workspace_id: &str,
+    ) -> error::Result<Val> {
         // If not present, `get_or_insert_async` will lock the key until the future completes,
         // so only one thread will be able to fetch the data from the database and write it to
         // the file system and cache, hence no race on the file system.
-        CACHE.get_or_insert_async(
-            &hash,
-            fs::import_or_insert_with(CACHE_DIR, hash.0 as u64, async {
+        CACHE
+            .get_or_insert_async(&hash, async {
                 sqlx::query!(
                     "SELECT \
                         lock AS \"lock: String\", \
@@ -188,15 +330,16 @@ pub mod script {
                 .await
                 .map_err(Into::into)
                 .map(|r| Val {
-                    lock: r.lock.and_then(|x| if x.is_empty() { None } else { Some(x) }),
+                    lock: r
+                        .lock
+                        .and_then(|x| if x.is_empty() { None } else { Some(x) }),
                     code: r.code,
                     language: r.language,
                     envs: r.envs,
                     codebase: r.codebase,
                 })
             })
-        )
-        .await
+            .await
     }
 
     // ----------------------------------------------------------------------------------------------
@@ -230,7 +373,104 @@ pub mod script {
             match item {
                 Item::Lock => self.lock = Some(String::from_utf8(data)?),
                 Item::Code => self.code = String::from_utf8(data)?,
-                Item::Info => (self.language, self.envs, self.codebase) = serde_json::from_slice(&data)?,
+                Item::Info => {
+                    (self.language, self.envs, self.codebase) = serde_json::from_slice(&data)?
+                }
+            }
+            Ok(())
+        }
+
+        fn export(&self, item: Self::Item) -> error::Result<Option<Vec<u8>>> {
+            match item {
+                Item::Lock => Ok(self.lock.as_ref().map(|s| s.as_bytes().to_vec())),
+                Item::Code => Ok(Some(self.code.as_bytes().to_vec())),
+                Item::Info => Ok(Some(serde_json::to_vec(&(
+                    &self.language,
+                    &self.envs,
+                    &self.codebase,
+                ))?)),
+            }
+        }
+    }
+}
+
+pub mod app {
+    use super::*;
+    use crate::apps::AppScriptId;
+
+    make_static! {
+        /// App scripts cache.
+        /// FIXME: Use `Arc<Val>` for cheap cloning.
+        static ref CACHE: { AppScriptId => Val } in "app" <= 1000;
+    }
+
+    /// App app script cache value.
+    #[derive(Debug, Clone, Default)]
+    pub struct Val {
+        pub lock: Option<String>,
+        pub code: String,
+    }
+
+    /// Fetch the app script referenced by `id` from the cache.
+    /// If not present, import from the file-system cache or fetch it from the database and write
+    /// it to the file system and cache.
+    /// This should be preferred over fetching the database directly.
+    pub async fn fetch_script(
+        e: impl PgExecutor<'_>,
+        id: AppScriptId,
+    ) -> error::Result<(Option<String>, String)> {
+        // If not present, `get_or_insert_async` will lock the key until the future completes,
+        // so only one thread will be able to fetch the data from the database and write it to
+        // the file system and cache, hence no race on the file system.
+        CACHE
+            .get_or_insert_async(&id, async {
+                sqlx::query!(
+                    "SELECT lock, code FROM app_script WHERE id = $1 LIMIT 1",
+                    id.0,
+                )
+                .fetch_one(e)
+                .await
+                .map_err(Into::into)
+                .map(|r| Val {
+                    lock: r
+                        .lock
+                        .and_then(|x| if x.is_empty() { None } else { Some(x) }),
+                    code: r.code,
+                })
+            })
+            .await
+            .map(|Val { lock, code }| (lock, code))
+    }
+
+    // ----------------------------------------------------------------------------------------------
+    // impl `fs::Bundle` for `Val`.
+
+    #[derive(Copy, Clone)]
+    pub enum Item {
+        Lock,
+        Code,
+    }
+
+    impl fs::Item for Item {
+        fn path(&self, root: &Path) -> PathBuf {
+            match self {
+                Item::Lock => root.join("lock.txt"),
+                Item::Code => root.join("code.txt"),
+            }
+        }
+    }
+
+    impl fs::Bundle for Val {
+        type Item = Item;
+
+        fn items() -> &'static [Self::Item] {
+            &[Item::Lock, Item::Code]
+        }
+
+        fn import(&mut self, item: Self::Item, data: Vec<u8>) -> error::Result<()> {
+            match item {
+                Item::Lock => self.lock = Some(String::from_utf8(data)?),
+                Item::Code => self.code = String::from_utf8(data)?,
             }
             Ok(())
         }
@@ -239,7 +479,6 @@ pub mod script {
             match item {
                 Item::Lock => Ok(self.lock.as_ref().map(|s| s.as_bytes().to_vec())),
                 Item::Code => Ok(Some(self.code.as_bytes().to_vec())),
-                Item::Info => Ok(Some(serde_json::to_vec(&(&self.language, &self.envs, &self.codebase))?)),
             }
         }
     }
@@ -248,8 +487,6 @@ pub mod script {
 mod fs {
     use super::*;
 
-    use std::future::Future;
-
     use std::fs::{self, OpenOptions};
     use std::io::{Read, Write};
 
@@ -272,8 +509,7 @@ mod fs {
     }
 
     /// Import or insert a bundle within the given combination of `{root}/{key}/`.
-    pub async fn import_or_insert_with<T, F>(root: &str, key: u64, f: F)
-        -> error::Result<T>
+    pub async fn import_or_insert_with<T, F>(root: &str, key: u64, f: F) -> error::Result<T>
     where
         T: Bundle,
         F: Future<Output = error::Result<T>>,
@@ -287,8 +523,9 @@ mod fs {
                 let mut data = T::default();
                 for item in T::items() {
                     let mut buf = vec![];
-                    let Ok(mut file) = OpenOptions::new().read(true).open(item.path(&path))
-                    else { continue };
+                    let Ok(mut file) = OpenOptions::new().read(true).open(item.path(&path)) else {
+                        continue;
+                    };
                     file.read_to_end(&mut buf)?;
                     data.import(*item, buf)?;
                 }
@@ -299,7 +536,7 @@ mod fs {
                 Ok(data) => return Ok(data),
                 Err(err) => tracing::warn!(
                     "Failed to import from file-system, fetch source..: {path:?}: {err:?}"
-                )
+                ),
             }
         }
         // Cache path doesn't exist or import failed, generate the content.
@@ -308,9 +545,13 @@ mod fs {
             fs::create_dir_all(&path)?;
             // Write the generated data to the file.
             for item in T::items() {
-                let Some(buf) = data.export(*item)?
-                else { continue };
-                let mut file = OpenOptions::new().write(true).create(true).open(item.path(&path))?;
+                let Some(buf) = data.export(*item)? else {
+                    continue;
+                };
+                let mut file = OpenOptions::new()
+                    .write(true)
+                    .create(true)
+                    .open(item.path(&path))?;
                 file.write_all(&buf)?;
             }
             tracing::debug!("Exported to file-system: {:?}", path);
@@ -324,4 +565,29 @@ mod fs {
         }
         Ok(data)
     }
+
+    // Auto-implement `Bundle` for all `serde` serializable types.
+
+    impl Item for () {
+        fn path(&self, root: &Path) -> PathBuf {
+            root.join("self.json")
+        }
+    }
+
+    impl<T: for<'de> Deserialize<'de> + Serialize + Default> Bundle for T {
+        type Item = ();
+
+        fn items() -> &'static [Self::Item] {
+            &[()]
+        }
+
+        fn import(&mut self, _: Self::Item, data: Vec<u8>) -> error::Result<()> {
+            *self = serde_json::from_slice(&data)?;
+            Ok(())
+        }
+
+        fn export(&self, _: Self::Item) -> error::Result<Option<Vec<u8>>> {
+            Ok(Some(serde_json::to_vec(self)?))
+        }
+    }
 }

backend/windmill-common/src/db.rs

@@ -80,14 +80,14 @@ impl UserDB {
         let mut folders_read = folders_read.clone();
         folders_read.extend(folders_write.clone());
 
-        tracing::debug!(
-            "Setting role to {} {:?} {:?} {:?} {:?}",
-            user,
-            authed.username(),
-            authed.groups(),
-            folders_read,
-            folders_write
-        );
+        // tracing::debug!(
+        //     "Setting role to {} {:?} {:?} {:?} {:?}",
+        //     user,
+        //     authed.username(),
+        //     authed.groups(),
+        //     folders_read,
+        //     folders_write
+        // );
 
         let mut tx = self.db.begin().await?;
 

backend/windmill-common/src/flow_status.rs

@@ -17,7 +17,7 @@ use crate::flows::FlowValue;
 const MINUTES: Duration = Duration::from_secs(60);
 const HOURS: Duration = MINUTES.saturating_mul(60);
 
-pub const MAX_RETRY_ATTEMPTS: u16 = 1000;
+pub const MAX_RETRY_ATTEMPTS: u32 = u32::MAX;
 pub const MAX_RETRY_INTERVAL: Duration = HOURS.saturating_mul(6);
 
 pub fn is_retry_default(v: &RetryStatus) -> bool {
@@ -48,7 +48,7 @@ pub struct FlowStatus {
 #[derive(Serialize, Deserialize, Debug, Clone, Default)]
 #[serde(default)]
 pub struct RetryStatus {
-    pub fail_count: u16,
+    pub fail_count: u32,
     pub failed_jobs: Vec<Uuid>,
 }
 

backend/windmill-common/src/flows.rs

@@ -147,7 +147,7 @@ impl Retry {
     /// Takes the number of previous retries and returns the interval until the next retry if any.
     ///
     /// May return [`Duration::ZERO`] to retry immediately.
-    pub fn interval(&self, previous_attempts: u16, silent: bool) -> Option<Duration> {
+    pub fn interval(&self, previous_attempts: u32, silent: bool) -> Option<Duration> {
         let Self { constant, exponential } = self;
 
         if previous_attempts < constant.attempts {
@@ -178,7 +178,7 @@ impl Retry {
         self.constant.attempts != 0 || self.exponential.attempts != 0
     }
 
-    pub fn max_attempts(&self) -> u16 {
+    pub fn max_attempts(&self) -> u32 {
         self.constant
             .attempts
             .saturating_add(self.exponential.attempts)
@@ -194,7 +194,7 @@ impl Retry {
 #[derive(Deserialize, Serialize, Debug, Clone, Default, PartialEq)]
 #[serde(default)]
 pub struct ConstantDelay {
-    pub attempts: u16,
+    pub attempts: u32,
     pub seconds: u16,
 }
 
@@ -202,7 +202,7 @@ pub struct ConstantDelay {
 #[derive(Deserialize, Serialize, Debug, Clone, PartialEq)]
 #[serde(default)]
 pub struct ExponentialDelay {
-    pub attempts: u16,
+    pub attempts: u32,
     pub multiplier: u16,
     pub seconds: u16,
     pub random_factor: Option<i8>, // percentage, defaults to 0 for no jitter
@@ -407,6 +407,12 @@ pub enum InputTransform {
 #[serde(transparent)]
 pub struct FlowNodeId(pub i64);
 
+impl Into<u64> for FlowNodeId {
+    fn into(self) -> u64 {
+        self.0 as u64
+    }
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct Branch {
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -713,10 +719,14 @@ pub async fn resolve_maybe_value<T>(
     workspace_id: &str,
     with_code: bool,
     maybe: Option<T>,
-    value_mut: impl FnOnce(&mut T) -> Option<&mut Json<Box<JsonRawValue>>>
+    value_mut: impl FnOnce(&mut T) -> Option<&mut Json<Box<JsonRawValue>>>,
 ) -> Result<Option<T>, Error> {
-    let Some(mut container) = maybe else { return Ok(None); };
-    let Some(value) = value_mut(&mut container) else { return Ok(Some(container)); };
+    let Some(mut container) = maybe else {
+        return Ok(None);
+    };
+    let Some(value) = value_mut(&mut container) else {
+        return Ok(Some(container));
+    };
     resolve_value(e, workspace_id, &mut value.0, with_code).await?;
     Ok(Some(container))
 }
@@ -728,8 +738,9 @@ pub async fn resolve_value(
     value: &mut Box<JsonRawValue>,
     with_code: bool,
 ) -> Result<(), Error> {
-    let mut val = serde_json::from_str::<FlowValue>(value.get())
-        .map_err(|err| Error::InternalErr(format!("resolve: Failed to parse flow value: {}", err)))?;
+    let mut val = serde_json::from_str::<FlowValue>(value.get()).map_err(|err| {
+        Error::InternalErr(format!("resolve: Failed to parse flow value: {}", err))
+    })?;
     for module in &mut val.modules {
         resolve_module(e, workspace_id, &mut module.value, with_code).await?;
     }
@@ -746,16 +757,29 @@ pub async fn resolve_module(
 ) -> Result<(), Error> {
     use FlowModuleValue::*;
 
-    let mut val = serde_json::from_str::<FlowModuleValue>(value.get())
-        .map_err(|err| Error::InternalErr(format!("resolve: Failed to parse flow module value: {}", err)))?;
+    let mut val = serde_json::from_str::<FlowModuleValue>(value.get()).map_err(|err| {
+        Error::InternalErr(format!(
+            "resolve: Failed to parse flow module value: {}",
+            err
+        ))
+    })?;
     match &mut val {
         FlowScript { .. } => {
             // In order to avoid an unnecessary `.clone()` of `val`, take ownership of it's content
             // using `std::mem::replace`.
             let FlowScript {
-                input_transforms, id, tag, language,
-                custom_concurrency_key, concurrent_limit, concurrency_time_window_s, is_trigger
-            } = std::mem::replace(&mut val, Identity) else { unreachable!() };
+                input_transforms,
+                id,
+                tag,
+                language,
+                custom_concurrency_key,
+                concurrent_limit,
+                concurrency_time_window_s,
+                is_trigger,
+            } = std::mem::replace(&mut val, Identity)
+            else {
+                unreachable!()
+            };
             // Load script lock file and code content.
             let (lock, content) = if !with_code {
                 (Some("...".to_string()), "...".to_string())
@@ -763,22 +787,44 @@ pub async fn resolve_module(
                 cache::flow::fetch_script(e, id).await?
             };
             val = RawScript {
-                input_transforms, content, lock, path: None, tag, language, custom_concurrency_key,
-                concurrent_limit, concurrency_time_window_s, is_trigger
+                input_transforms,
+                content,
+                lock,
+                path: None,
+                tag,
+                language,
+                custom_concurrency_key,
+                concurrent_limit,
+                concurrency_time_window_s,
+                is_trigger,
             };
-        },
-        ForloopFlow { modules, modules_node, .. } | WhileloopFlow { modules, modules_node, .. }  => {
+        }
+        ForloopFlow { modules, modules_node, .. } | WhileloopFlow { modules, modules_node, .. } => {
             resolve_modules(e, workspace_id, modules, modules_node.take(), with_code).await?;
-        },
+        }
         BranchOne { branches, default, default_node } => {
             resolve_modules(e, workspace_id, default, default_node.take(), with_code).await?;
             for branch in branches {
-                resolve_modules(e, workspace_id, &mut branch.modules, branch.modules_node.take(), with_code).await?;
+                resolve_modules(
+                    e,
+                    workspace_id,
+                    &mut branch.modules,
+                    branch.modules_node.take(),
+                    with_code,
+                )
+                .await?;
             }
-        },
+        }
         BranchAll { branches, .. } => {
             for branch in branches {
-                resolve_modules(e, workspace_id, &mut branch.modules, branch.modules_node.take(), with_code).await?;
+                resolve_modules(
+                    e,
+                    workspace_id,
+                    &mut branch.modules,
+                    branch.modules_node.take(),
+                    with_code,
+                )
+                .await?;
             }
         }
         _ => {}
@@ -801,7 +847,13 @@ pub async fn resolve_modules(
             .map(|flow| flow.modules)?;
     }
     for module in modules.iter_mut() {
-        Box::pin(resolve_module(e, workspace_id, &mut module.value, with_code)).await?;
+        Box::pin(resolve_module(
+            e,
+            workspace_id,
+            &mut module.value,
+            with_code,
+        ))
+        .await?;
     }
     Ok(())
 }

backend/windmill-common/src/global_settings.rs

@@ -35,8 +35,9 @@ pub const CRITICAL_ALERT_MUTE_UI_SETTING: &str = "critical_alert_mute_ui";
 pub const DEV_INSTANCE_SETTING: &str = "dev_instance";
 pub const JWT_SECRET_SETTING: &str = "jwt_secret";
 pub const EMAIL_DOMAIN_SETTING: &str = "email_domain";
+pub const OTEL_SETTING: &str = "otel";
 
-pub const ENV_SETTINGS: [&str; 51] = [
+pub const ENV_SETTINGS: [&str; 54] = [
     "DISABLE_NSJAIL",
     "MODE",
     "NUM_WORKERS",
@@ -88,4 +89,7 @@ pub const ENV_SETTINGS: [&str; 51] = [
     "WORKER_GROUP",
     "SAML_METADATA",
     "INSTANCE_IS_DEV",
+    "OTEL_METRICS",
+    "OTEL_TRACING",
+    "OTEL_LOGS",
 ];

backend/windmill-common/src/job_metrics.rs

@@ -1,4 +1,4 @@
-use crate::{db::DB, error};
+use crate::{db::DB, error, utils::WarnAfterExt};
 
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;
@@ -90,6 +90,7 @@ pub async fn register_metric_for_job(
     .bind(timeseries_int)
     .bind(timeseries_float)
     .execute(db)
+    .warn_after_seconds(1)
     .await?;
 
     Ok(metric_id)

backend/windmill-common/src/jobs.rs

@@ -14,6 +14,7 @@ pub const ENTRYPOINT_OVERRIDE: &str = "_ENTRYPOINT_OVERRIDE";
 pub const PREPROCESSOR_FAKE_ENTRYPOINT: &str = "__WM_PREPROCESSOR";
 
 use crate::{
+    apps::AppScriptId,
     error::{self, to_anyhow, Error},
     flow_status::{FlowStatus, RestartedFrom},
     flows::{FlowNodeId, FlowValue, Retry},
@@ -41,6 +42,7 @@ pub enum JobKind {
     DeploymentCallback,
     FlowScript,
     FlowNode,
+    AppScript,
 }
 
 #[derive(sqlx::FromRow, Debug, Serialize, Clone)]
@@ -278,6 +280,12 @@ pub enum JobPayload {
         id: FlowNodeId, // flow_node(id).
         path: String, // flow node inner path (e.g. `outer/branchall-42`).
     },
+    AppScript {
+        id: AppScriptId, // app_script(id).
+        path: Option<String>,
+        language: ScriptLang,
+        cache_ttl: Option<i32>,
+    },
     Code(RawCode),
     Dependencies {
         path: String,

backend/windmill-common/src/lib.rs

@@ -36,20 +36,20 @@ pub mod job_s3_helpers_ee;
 pub mod jobs;
 pub mod more_serde;
 pub mod oauth2;
+pub mod otel_ee;
 pub mod queue;
 pub mod s3_helpers;
 pub mod schedule;
 pub mod scripts;
 pub mod server;
 pub mod stats_ee;
+pub mod tracing_init;
 pub mod users;
 pub mod utils;
 pub mod variables;
 pub mod worker;
 pub mod workspaces;
 
-pub mod tracing_init;
-
 pub const DEFAULT_MAX_CONNECTIONS_SERVER: u32 = 50;
 pub const DEFAULT_MAX_CONNECTIONS_WORKER: u32 = 5;
 pub const DEFAULT_MAX_CONNECTIONS_INDEXER: u32 = 5;
@@ -87,6 +87,12 @@ lazy_static::lazy_static! {
     .unwrap_or_else(|| SocketAddr::from(([0, 0, 0, 0], *METRICS_PORT)));
 
     pub static ref METRICS_ENABLED: AtomicBool = AtomicBool::new(std::env::var("METRICS_PORT").is_ok() || std::env::var("METRICS_ADDR").is_ok());
+
+    pub static ref OTEL_METRICS_ENABLED: AtomicBool = AtomicBool::new(std::env::var("OTEL_METRICS").is_ok());
+    pub static ref OTEL_TRACING_ENABLED: AtomicBool = AtomicBool::new(std::env::var("OTEL_TRACING").is_ok());
+    pub static ref OTEL_LOGS_ENABLED: AtomicBool = AtomicBool::new(std::env::var("OTEL_LOGS").is_ok());
+
+
     pub static ref METRICS_DEBUG_ENABLED: AtomicBool = AtomicBool::new(false);
 
     pub static ref CRITICAL_ALERT_MUTE_UI_ENABLED: AtomicBool = AtomicBool::new(false);

backend/windmill-common/src/otel_ee.rs

@@ -0,0 +1,58 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+use crate::{jobs::QueuedJob, utils::Mode};
+use uuid::Uuid;
+
+pub fn set_span_parent(_span: &tracing::Span, _rj: &Uuid) {}
+
+#[cfg(not(all(feature = "otel", feature = "enterprise")))]
+pub(crate) type OtelProvider = Option<()>;
+
+#[cfg(all(feature = "otel", feature = "enterprise"))]
+pub(crate) type OtelProvider = Option<opentelemetry_sdk::metrics::SdkMeterProvider>;
+
+#[cfg(not(feature = "otel"))]
+pub fn otel_ctx() -> () {}
+
+#[cfg(feature = "otel")]
+#[inline(always)]
+pub fn otel_ctx() -> opentelemetry::Context {
+    opentelemetry::Context::current()
+}
+
+#[cfg(not(feature = "otel"))]
+impl<T: Sized> FutureExt for T {}
+
+#[cfg(not(feature = "otel"))]
+pub trait FutureExt: Sized {
+    fn with_context(self, _otel_cx: ()) -> Self {
+        self
+    }
+}
+
+use tracing_subscriber::EnvFilter;
+
+pub(crate) fn init_logs_bridge(_mode: &Mode, _hostname: &str, _env: &str) -> Option<EnvFilter> {
+    None
+}
+
+#[cfg(all(feature = "otel", feature = "enterprise"))]
+pub(crate) fn init_otlp_tracer(
+    _mode: &Mode,
+    _hostname: &str,
+    _env: &str,
+) -> Option<opentelemetry_sdk::trace::Tracer> {
+    None
+}
+
+pub(crate) fn init_meter_provider(_mode: &Mode, _hostname: &str, _env: &str) -> OtelProvider {
+    None
+}
+
+pub fn add_root_flow_job_to_otlp(_queued_job: &QueuedJob, _success: bool) {}

backend/windmill-common/src/s3_helpers.rs

@@ -122,7 +122,7 @@ pub struct S3Object {
 
 #[cfg(feature = "parquet")]
 pub async fn get_etag_or_empty(
-    object_store_resource: &mut ObjectStoreResource,
+    object_store_resource: &ObjectStoreResource,
     s3_object: S3Object,
 ) -> Option<String> {
     let object_store_client = build_object_store_client(object_store_resource).await;

backend/windmill-common/src/scripts.rs

@@ -75,6 +75,12 @@ impl ScriptLang {
 #[sqlx(transparent)]
 pub struct ScriptHash(pub i64);
 
+impl Into<u64> for ScriptHash {
+    fn into(self) -> u64 {
+        self.0 as u64
+    }
+}
+
 #[derive(PartialEq, sqlx::Type)]
 #[sqlx(transparent, no_pg_array)]
 pub struct ScriptHashes(pub Vec<i64>);