make drawer triggerable

* add tracing to get of authed client

* fix: make disabled items not selectable with arrow keys

* Invert showing EE message only when not in EE

* Makea component for the Run Search part of the Search modal

* Make the button to load more jobs

* Add pagination for job search

* fix missing bind to the openModal bool

* Turn off spinner when aborting search results

* fix typo in openapi.yaml

* Update ee repo ref

* Remove unused imports and vars

---------

Co-authored-by: Ruben Fiszel <ruben@windmill.dev>

.aiderignore

@@ -0,0 +1,3 @@
+/*
+!/backend/
+!/frontend/

.cursor/rules/svelte5-best-practices.mdc

@@ -5,7 +5,7 @@ alwaysApply: false
 ---
 # Svelte 5 Best Practices
 
-This guide outlines best practices for developing with Svelte 5, incorporating the new Runes API and other modern Svelte features. They should be applied on every new files created, but not on existing svelte 4 files unless specifically asked to.
+This guide outlines best practices for developing with Svelte 5, incorporating the new Runes API and other modern Svelte features. These rules MUST NOT be applied on svelte 4 files unless explicitly asked to do so.
 
 ## Reactivity with Runes
 

.cursor/rules/windmill-overview.mdc

@@ -0,0 +1,76 @@
+---
+description: 
+globs: 
+alwaysApply: false
+---
+# Windmill Overview
+
+Windmill is an open-source developer platform for building internal tools, API integrations, background jobs, workflows, and user interfaces. It offers a unified system where scripts are automatically turned into sharable UIs and can be composed into flows or embedded in custom applications.
+
+## Core Capabilities
+
+- **Script Development and Execution**: Write and run scripts in Python, TypeScript/JavaScript (Deno/Bun), Go, Bash, SQL, and other languages
+- **Workflow Orchestration**: Compose scripts into multi-step flows with conditional logic, loops, and error handling
+- **UI Generation**: Automatically generate UIs from scripts or build custom applications with a low-code editor
+- **Job Scheduling**: Trigger scripts and flows on schedules, webhooks, or external events
+- **Resource Management**: Securely store and use credentials, databases, and other connections
+
+## Platform Architecture
+
+The Windmill platform consists of several key components:
+
+- **Frontend UI**: Web-based interface for script and flow development, app building, and result visualization
+- **API Server**: Central API that handles authentication, resource management, and job coordination
+- **Workers**: Execute scripts in their respective environments with proper sandboxing
+- **Database**: PostgreSQL database for storage of scripts, flows, resources, job results, and more
+- **Job Queue**: Queue system for managing job execution, implemented in PostgreSQL
+- **Client Libraries**: Libraries for interacting with Windmill from Python, TypeScript, or command line
+
+# Windmill Backend Architecture
+
+The Windmill backend is written in Rust and consists of several services working together. These services are designed for horizontal scaling with stateless API servers and workers that can be deployed across multiple machines.
+
+## Key Components
+
+- **API Server (`windmill-api`)**: Handles HTTP requests, authentication, and resource management
+- **Queue Manager (`windmill-queue`)**: Manages the job queue in PostgreSQL
+- **Worker System (`windmill-worker`)**: Executes jobs in sandboxed environments
+- **Common Utilities (`windmill-common`)**: Shared code used by multiple services
+- **Git Sync (`windmill-git-sync`)**: Synchronizes scripts with Git repositories
+
+## Job Execution System
+
+The job execution process follows these steps:
+
+1. The API server receives a request to run a script or flow and creates a job record in the database
+2. The job is added to the queue system in PostgreSQL
+3. Workers continuously poll the queue for jobs matching their capabilities
+4. When a job is picked up, it's routed to the appropriate language executor
+5. The script is executed in a sandboxed environment using NSJAIL for security
+6. Results are processed and stored in the database
+7. For flows, each step creates a new job that goes through the same process
+
+Windmill supports worker tags and groups to route jobs to workers with specific capabilities or resource access.
+
+# Windmill Frontend Architecture
+
+The Windmill frontend is built with Svelte and provides several key interfaces for interacting with the platform.
+
+## Key Components
+
+- **Script Builder**: Code editor with language support, schema inference, and dependency management
+- **Flow Builder**: Visual editor for creating multi-step workflows with branching and looping
+- **App Editor**: Grid-based editor for building custom UIs that integrate scripts and flows
+- **Schema Form System**: Generates form interfaces from script parameters automatically
+- **Result Viewer**: Visualizes job results, logs, and execution status
+
+The frontend uses the Monaco editor (same as VS Code) for code editing, with specialized language support for all supported script languages.
+
+## UI Framework
+
+The frontend is built with Svelte, providing a reactive and component-based architecture. Key frontend technologies include:
+
+- **Svelte/SvelteKit**: Core framework for UI components and routing
+- **Monaco Editor**: Code editing experience similar to VS Code
+- **Schema Form**: Automatic UI generation from TypeScript/JSON schemas
+- **Tailwind CSS**: Utility-first CSS framework for styling

.github/workflows/aider-after-review.yaml

@@ -0,0 +1,93 @@
+name: Aider Auto-fix PR Review Change Requests
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  check-membership:
+    if: github.event.review.state == 'changes_requested' && contains(github.event.pull_request.title, '[Aider PR]')
+    runs-on: ubicloud-standard-2
+    outputs:
+      is_member: ${{ steps.check-membership.outputs.is_member }}
+    steps:
+      - name: Check organization membership
+        id: check-membership
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          REVIEWER: ${{ github.event.review.user.login }}
+          ORG_ACCESS_TOKEN: ${{ secrets.ORG_ACCESS_TOKEN }}
+        run: |
+          ORG="windmill-labs"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            -H "Authorization: token $ORG_ACCESS_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "https://api.github.com/orgs/$ORG/members/$REVIEWER")
+
+          if [ "$STATUS" -eq 204 ]; then
+            echo "is_member=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_member=false" >> $GITHUB_OUTPUT
+          fi
+
+  check-and-prepare:
+    needs: check-membership
+    if: github.event.review.state == 'changes_requested' && contains(github.event.pull_request.title, '[Aider PR]') && needs.check-membership.outputs.is_member == 'true'
+    runs-on: ubicloud-standard-2
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      prompt_content: ${{ steps.prepare_prompt.outputs.prompt_content }}
+    env:
+      GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      WINDMILL_TOKEN: ${{ secrets.WINDMILL_TOKEN }}
+
+    steps:
+      - name: Acknowledge Request
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: |
+          echo "Commenting on PR #${{ github.event.pull_request.number }} to acknowledge the /aider command."
+          gh pr comment ${{ github.event.pull_request.number }} --body "🤖 Aider is starting to work on your request. Please be patient, this might take a few minutes." --repo $GITHUB_REPOSITORY
+
+      - name: Prepare prompt for Aider
+        id: prepare_prompt
+        shell: bash
+        env:
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REVIEW_BODY: ${{ github.event.review.body }}
+        run: |
+          REVIEW_BODY_ESCAPED="${REVIEW_BODY//\\/\\\\}"
+          REVIEW_BODY_ESCAPED="${REVIEW_BODY_ESCAPED//\"/\\\"}"
+
+          ALL_REVIEW_COMMENTS=$(gh api \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            /repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/comments)
+
+          FORMATTED_COMMENTS=$(jq -r '[.[] | {diff_hunk: .diff_hunk, path: .path, body: .body}]' <<< "$ALL_REVIEW_COMMENTS")
+
+          BASE_PROMPT="Fix the following issues in the PR based on the review feedback. The review body is prepended with REVIEW. The review comments are prepended with REVIEW_COMMENTS. The review body and comments are separated by a blank line."
+
+          COMPLETE_PROMPT="${BASE_PROMPT}"$'\n'"REVIEW:"$'\n'"${REVIEW_BODY_ESCAPED}"$'\n'"REVIEW_COMMENTS:"$'\n'"${FORMATTED_COMMENTS}"
+
+          echo "prompt_content<<EOF" >> $GITHUB_OUTPUT
+          echo "$COMPLETE_PROMPT" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+  run-aider:
+    needs: [check-membership, check-and-prepare]
+    if: github.event.review.state == 'changes_requested' && contains(github.event.pull_request.title, '[Aider PR]') && needs.check-membership.outputs.is_member == 'true'
+    uses: ./.github/workflows/aider-common.yml
+    with:
+      needs_processing: false
+      base_prompt: ${{ needs.check-and-prepare.outputs.prompt_content }}
+    secrets: inherit

.github/workflows/aider-common.yml

@@ -0,0 +1,480 @@
+name: Aider Common Steps
+
+on:
+  workflow_call:
+    inputs:
+      issue_title:
+        description: "Title of the issue or PR"
+        required: false
+        type: string
+      issue_body:
+        description: "Body of the issue or PR"
+        required: false
+        type: string
+      instruction:
+        description: "Instruction for Aider"
+        required: false
+        type: string
+      issue_id:
+        description: "ID of the issue or PR"
+        required: false
+        type: string
+      needs_processing:
+        description: "Whether the issue needs to be processed by the external API"
+        required: false
+        type: boolean
+        default: true
+      base_prompt:
+        description: "Base prompt for Aider"
+        required: false
+        type: string
+        default: "Try to fix the following issue based on the instruction given by the user. The issue is prepended with the word ISSUE. The instruction is prepended with the word INSTRUCTION. The issue and instruction are separated by a blank line."
+      probe_prompt:
+        description: "Prompt for probe-chat"
+        required: false
+        type: string
+        default: 'I''m giving you a request that needs to be implemented. Your role is ONLY to give me the files that are relevant to the request and nothing else. The request is prepended with the word REQUEST. REQUEST: $FINAL_PROMPT. Give me all the files relevant to this request. Your output MUST be a single json array that can be parsed with programatic json parsing, with the relevant files. Files can be rust or typescript or javascript files. DO NOT INCLUDE ANY OTHER TEXT IN YOUR OUTPUT. ONLY THE JSON ARRAY. Example of output: ["file1.py", "file2.py"]'
+    outputs:
+      files_to_edit:
+        description: "Files identified by probe-chat for editing"
+        value: ${{ jobs.common-steps.outputs.files_to_edit }}
+      final_prompt:
+        description: "Final prompt for Aider"
+        value: ${{ jobs.common-steps.outputs.final_prompt }}
+      pr_branch_name:
+        description: "Name of the branch used for PR"
+        value: ${{ jobs.common-steps.outputs.pr_branch_name }}
+      changes_applied_message:
+        description: "Message indicating changes were applied"
+        value: ${{ jobs.common-steps.outputs.changes_applied_message }}
+      changes_applied:
+        description: "Boolean indicating if changes were successfully applied"
+        value: ${{ jobs.common-steps.outputs.changes_applied }}
+
+jobs:
+  common-steps:
+    runs-on: ubicloud-standard-8
+    outputs:
+      files_to_edit: ${{ steps.probe_files.outputs.files_to_edit }}
+      final_prompt: ${{ steps.create_prompt.outputs.final_prompt }}
+      pr_branch_name: ${{ steps.commit_and_push.outputs.PR_BRANCH_NAME }}
+      changes_applied_message: ${{ steps.commit_and_push.outputs.CHANGES_APPLIED_MESSAGE }}
+      changes_applied: ${{ steps.commit_and_push.outputs.CHANGES_APPLIED }}
+    env:
+      GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      WINDMILL_TOKEN: ${{ secrets.WINDMILL_TOKEN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Checkout PR Branch
+        id: checkout_pr
+        if: (github.event_name == 'issue_comment' && github.event.issue.pull_request) || (github.event_name == 'pull_request_review')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "Issue comment trigger: Checking out PR branch..."
+          PR_NUMBER=""
+          if [ -n "${{ github.event.issue.number }}" ]; then
+            PR_NUMBER="${{ github.event.issue.number }}"
+          elif [ -n "${{ github.event.pull_request.number }}" ]; then
+            PR_NUMBER="${{ github.event.pull_request.number }}"
+          else
+            echo "::error::Could not determine PR number."
+            exit 1
+          fi
+          PR_HEAD_REF=$(gh pr view $PR_NUMBER --json headRefName -q .headRefName --repo $GITHUB_REPOSITORY)
+          if [[ -z "$PR_HEAD_REF" || "$PR_HEAD_REF" == "null" ]]; then
+             echo "::error::Could not determine PR head branch for PR #$PR_NUMBER via gh CLI."
+             exit 1
+          fi
+          echo "Checking out PR head branch: $PR_HEAD_REF for PR #$PR_NUMBER"
+          git fetch origin "refs/heads/${PR_HEAD_REF}:refs/remotes/origin/${PR_HEAD_REF}" --no-tags
+          git checkout "$PR_HEAD_REF"
+          echo "Successfully checked out branch $(git rev-parse --abbrev-ref HEAD)"
+          echo "PR_BRANCH=$PR_HEAD_REF" >> $GITHUB_OUTPUT
+
+      - name: Configure Git User
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Cache Python dependencies
+        uses: actions/cache@v3
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt', '**/setup.py') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Cache Aider installation
+        id: cache-aider
+        uses: actions/cache@v3
+        with:
+          path: ~/.local/bin/aider
+          key: ${{ runner.os }}-aider-install-${{ hashFiles('**/requirements.txt', '**/setup.py') }}
+          restore-keys: |
+            ${{ runner.os }}-aider-install-
+
+      - name: Install Aider and Dependencies
+        run: |
+          if [ -f ~/.local/bin/aider ] && [ -x ~/.local/bin/aider ]; then
+            echo "Using cached Aider installation"
+            export PATH="$HOME/.local/bin:$PATH"
+          else
+            echo "Installing Aider..."
+            python -m pip install aider-install; aider-install
+          fi
+          pip install -U google-generativeai
+          sudo apt-get update && sudo apt-get install -y jq
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Create Prompt for Aider
+        id: create_prompt
+        shell: bash
+        env:
+          BASE_PROMPT_ENV: ${{ inputs.base_prompt }}
+          ISSUE_TITLE_ENV: ${{ inputs.issue_title }}
+          ISSUE_BODY_ENV: ${{ inputs.issue_body }}
+          INSTRUCTION_ENV: ${{ inputs.instruction }}
+          NEEDS_PROCESSING_ENV: ${{ inputs.needs_processing }}
+          WINDMILL_TOKEN: ${{ secrets.WINDMILL_TOKEN }}
+        run: |
+          set -e
+          FINAL_PROMPT_CONTENT=""
+
+          if [[ "$ISSUE_TITLE_ENV" != "" && "$ISSUE_BODY_ENV" != "" ]]; then
+            echo "Processing issue with title: $ISSUE_TITLE_ENV"
+            if [[ "$NEEDS_PROCESSING_ENV" == "true" ]]; then
+              echo "Needs processing is true. Calling Windmill API..."
+              JSON_PAYLOAD=$(jq -n \
+                --arg title "$ISSUE_TITLE_ENV" \
+                --arg body "$ISSUE_BODY_ENV" \
+                '{"body":{"issue_title":$title,"issue_body":$body}}')
+
+              echo "Windmill JSON Payload: $JSON_PAYLOAD"
+
+              API_RESULT_FILE=$(mktemp)
+              HTTP_CODE=$(curl -s -o "$API_RESULT_FILE" -w "%{http_code}" \
+                -X POST "https://app.windmill.dev/api/w/windmill-labs/jobs/run_wait_result/p/f/ai/quiet_script" \
+                -H "Content-Type: application/json" \
+                -H "Authorization: Bearer $WINDMILL_TOKEN" \
+                --data-binary "$JSON_PAYLOAD" \
+                --max-time 90)
+
+              BODY_CONTENT=$(cat "$API_RESULT_FILE")
+              rm -f "$API_RESULT_FILE" # Clean up temp file
+
+              echo "Windmill API HTTP Code: $HTTP_CODE"
+              if [[ "$HTTP_CODE" -eq 200 ]]; then
+                PROCESSED_ISSUE_PROMPT=$(echo "$BODY_CONTENT" | jq -r '.effective_body // empty')
+                if [[ -z "$PROCESSED_ISSUE_PROMPT" || "$PROCESSED_ISSUE_PROMPT" == "null" ]]; then
+                  echo "::warning::Windmill API returned 200 but effective_body was empty or null."
+                  EFFECTIVE_ISSUE_CONTENT_FOR_PROMPT="$ISSUE_BODY_ENV"
+                else
+                  echo "Successfully processed issue via Windmill API."
+                  EFFECTIVE_ISSUE_CONTENT_FOR_PROMPT="$PROCESSED_ISSUE_PROMPT"
+                fi
+                FINAL_PROMPT_CONTENT=$(printf "%s\nISSUE:\n%s\nINSTRUCTION:\n%s" \
+                  "$BASE_PROMPT_ENV" "$EFFECTIVE_ISSUE_CONTENT_FOR_PROMPT" "$INSTRUCTION_ENV")
+              else
+                echo "::error::Windmill API call failed (HTTP $HTTP_CODE). Using raw issue content for prompt."
+                FINAL_PROMPT_CONTENT=$(printf "%s\nISSUE:\n%s\nINSTRUCTION:\n%s" \
+                  "$BASE_PROMPT_ENV" "$ISSUE_BODY_ENV" "$INSTRUCTION_ENV")
+              fi
+            else
+              echo "Needs processing is false. Using raw issue content for prompt."
+              FINAL_PROMPT_CONTENT=$(printf "%s\nISSUE:\n%s\nINSTRUCTION:\n%s" \
+                "$BASE_PROMPT_ENV" "$ISSUE_BODY_ENV" "$INSTRUCTION_ENV")
+            fi
+          else
+            echo "No issue title or body given. Using base prompt."
+            FINAL_PROMPT_CONTENT="$BASE_PROMPT_ENV"
+          fi
+
+          echo "Final prompt: $FINAL_PROMPT_CONTENT"
+          echo "final_prompt<<EOF_AIDER_PROMPT" >> "$GITHUB_OUTPUT"
+          echo "$FINAL_PROMPT_CONTENT" >> "$GITHUB_OUTPUT"
+          echo "EOF_AIDER_PROMPT" >> "$GITHUB_OUTPUT"
+
+      - name: Probe Chat for Relevant Files
+        id: probe_files
+        shell: bash
+        env:
+          FINAL_PROMPT: ${{ steps.create_prompt.outputs.final_prompt }}
+        run: |
+          echo "Running probe-chat to find relevant files..."
+
+          # escape the final prompt
+          printf -v MESSAGE_FOR_PROBE 'I'\''m giving you a request that needs to be implemented. Your role is ONLY to give me the files that are relevant to the request and nothing else. The request is prepended with the word REQUEST.\nREQUEST: %s. Give me all the files relevant to this request. Your output MUST be a single json array that can be parsed with programatic json parsing, with the relevant files. Files can be rust or typescript or javascript files. DO NOT INCLUDE ANY OTHER TEXT IN YOUR OUTPUT. ONLY THE JSON ARRAY. Example of output: ["file1.py", "file2.py"]' "$FINAL_PROMPT"
+
+          set -o pipefail
+          PROBE_OUTPUT=$(npx --yes @buger/probe-chat@latest --max-iterations 50 --model-name gemini-2.5-pro-preview-05-06 --message "$MESSAGE_FOR_PROBE") || {
+            echo "::error::probe-chat command failed. Output:"
+            echo "$PROBE_OUTPUT"
+            exit 1
+          }
+          set +o pipefail
+          echo "Probe-chat raw output:"
+          echo "$PROBE_OUTPUT"
+
+          JSON_FILES=$(echo "$PROBE_OUTPUT" | sed -n '/^\s*\[/,$p' | sed '/^\s*\]/q')
+          echo "Extracted JSON block:"
+          echo "$JSON_FILES"
+
+          FILES_LIST=$(echo "$JSON_FILES" | jq -e -r '[.[] | select(type == "string" and . != "" and . != null and (endswith("/") | not))] | join(" ")' || echo "")
+
+          if [[ -z "$FILES_LIST" ]]; then
+             echo "::warning::probe-chat did not identify any relevant files."
+          fi
+
+          echo "Formatted files list for aider: $FILES_LIST"
+          echo "files_to_edit=$FILES_LIST" >> $GITHUB_OUTPUT
+
+      - name: Cache Aider tags
+        uses: actions/cache@v3
+        with:
+          path: .aider.tags.cache.v4
+          key: ${{ runner.os }}-aider-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-aider-
+
+      - name: Run Aider
+        id: run_aider
+        shell: bash
+        env:
+          FILES_TO_EDIT: ${{ steps.probe_files.outputs.files_to_edit }}
+          FINAL_PROMPT: ${{ steps.create_prompt.outputs.final_prompt }}
+        run: |
+
+          echo "$FINAL_PROMPT" > .aider_final_prompt.txt
+          echo "FILES_TO_EDIT: $FILES_TO_EDIT"
+
+          aider \
+            --read .cursor/rules/rust-best-practices.mdc \
+            --read .cursor/rules/svelte5-best-practices.mdc \
+            --read .cursor/rules/windmill-overview.mdc \
+            $FILES_TO_EDIT \
+            --model gemini/gemini-2.5-pro-preview-05-06 \
+            --message-file .aider_final_prompt.txt \
+            --yes \
+            --no-check-update \
+            --auto-commits \
+            --no-analytics \
+            --no-gitignore \
+            | tee .aider_output.txt || true
+
+          echo "Aider command completed. Output saved to .aider_output.txt"
+
+      - name: Cache Node.js dependencies
+        uses: actions/cache@v3
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json', '**/yarn.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Commit and Push Changes
+        id: commit_and_push
+        env:
+          ISSUE_ID: ${{ inputs.issue_id }}
+        run: |
+          if [[ "$ISSUE_ID" != "" ]]; then
+            BRANCH_NAME="aider-fix-issue-${ISSUE_ID}"
+
+            # Check if branch exists remotely
+            if git ls-remote --heads origin $BRANCH_NAME | grep -q $BRANCH_NAME; then
+              echo "Branch $BRANCH_NAME already exists remotely, fetching it"
+              git fetch origin $BRANCH_NAME
+              git checkout $BRANCH_NAME
+              git pull origin $BRANCH_NAME
+            else
+              echo "Creating new branch $BRANCH_NAME"
+              git checkout -b $BRANCH_NAME
+            fi
+
+            echo "Created/checked out branch $BRANCH_NAME for issue #${ISSUE_ID}"
+            git push origin $BRANCH_NAME
+            echo "Pushed to branch $BRANCH_NAME"
+            echo "PR_BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_OUTPUT
+            echo "CHANGES_APPLIED_MESSAGE=Aider changes pushed to branch $BRANCH_NAME." >> $GITHUB_OUTPUT
+          else
+            # We're in a pull_request_review event
+            PR_NUMBER="${{ github.event.pull_request.number }}"
+            PR_HEAD_REF="${{ github.event.pull_request.head.ref }}"
+            
+            echo "Handling pull_request_review for PR #$PR_NUMBER on branch $PR_HEAD_REF"
+            
+            # Ensure we're on the correct branch
+            git config pull.rebase true
+            git fetch origin $PR_HEAD_REF
+            git checkout $PR_HEAD_REF
+            git pull origin $PR_HEAD_REF
+            
+            echo "Attempting to push changes to PR branch $PR_HEAD_REF for PR #$PR_NUMBER"
+            if git push origin $PR_HEAD_REF; then
+              echo "Push to $PR_HEAD_REF successful (or no new changes to push)."
+              echo "CHANGES_APPLIED_MESSAGE=Aider changes (if any) pushed to PR branch $PR_HEAD_REF." >> $GITHUB_OUTPUT
+              echo "PR_BRANCH_NAME=$PR_HEAD_REF" >> $GITHUB_OUTPUT
+              echo "CHANGES_APPLIED=true" >> $GITHUB_OUTPUT
+            else
+              echo "::warning::Push to PR branch $PR_HEAD_REF failed."
+              echo "CHANGES_APPLIED_MESSAGE=Aider ran, but failed to push changes to PR branch $PR_HEAD_REF." >> $GITHUB_OUTPUT
+              echo "CHANGES_APPLIED=false" >> $GITHUB_OUTPUT
+            fi
+          fi
+
+      - name: Create Pull Request
+        if: always() && (github.event_name == 'issue_comment' || github.event_name == 'repository_dispatch') && !github.event.issue.pull_request && steps.commit_and_push.outputs.PR_BRANCH_NAME != ''
+        id: create_pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_BRANCH: ${{ steps.commit_and_push.outputs.PR_BRANCH_NAME }}
+          ISSUE_NUM: ${{ inputs.issue_id }}
+          ISSUE_TITLE: ${{ inputs.issue_title }}
+        run: |
+          # Debug: Check latest commit and branch status
+          echo "Checking latest commit on branch $PR_BRANCH"
+          git log -1 --pretty=format:"%h - %an, %ar : %s"
+          echo "Changes not yet committed:"
+          git status --porcelain
+          # Check if there are any changes to commit
+          if [[ -n $(git status --porcelain) ]]; then
+            echo "Found uncommitted changes, committing them"
+            git add .
+            git commit -m "Aider changes for issue #${ISSUE_NUM}"
+            git push origin $PR_BRANCH
+          fi
+
+          # Create PR description in a temporary file to avoid command line length limits and ensure it stays under 40k chars
+          cat > /tmp/pr-description.md << EOL | head -c 40000
+          This PR was created automatically by Aider to fix issue #${ISSUE_NUM}.
+
+          ## Aider Output
+          \`\`\`
+          $(cat .aider_output.txt || echo "No output available")
+          \`\`\`
+          EOL
+
+          # Create PR using the file for the body content, handle errors gracefully
+          set +e  # Don't exit on error
+          gh pr create \
+            --title "[Aider PR] Fix: ${ISSUE_TITLE}" \
+            --body-file /tmp/pr-description.md \
+            --head "$PR_BRANCH" \
+            --base main
+          PR_CREATE_EXIT_CODE=$?
+          set -e  # Re-enable exit on error
+
+          if [ $PR_CREATE_EXIT_CODE -eq 0 ]; then
+            echo "PR created successfully"
+            PR_URL=$(gh pr view $PR_BRANCH --json url --jq .url)
+            echo "PR_URL=$PR_URL" >> $GITHUB_OUTPUT
+            echo "PR_CREATED=true" >> $GITHUB_OUTPUT
+          else
+            echo "Warning: Failed to create PR. Exit code: $PR_CREATE_EXIT_CODE"
+            echo "PR_CREATED=false" >> $GITHUB_OUTPUT
+            # Continue workflow despite PR creation failure
+          fi
+
+      - name: Comment on PR with Aider Output
+        if: always() && github.event_name == 'pull_request_review' && steps.commit_and_push.outputs.CHANGES_APPLIED != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUM: ${{ github.event.pull_request.number }}
+          JOB_STATUS: ${{ job.status }}
+        run: |
+          # Create comment body in a temporary file to avoid command line length limits
+          if [[ "${{ steps.commit_and_push.outputs.CHANGES_APPLIED }}" == "true" ]]; then
+            if [[ "$JOB_STATUS" == "success" ]]; then
+              STATUS_PREFIX="🤖 I've automatically addressed the feedback based on the review."
+            else
+              STATUS_PREFIX="⚠️ I attempted to address the feedback, but encountered some issues."
+            fi
+          else
+            if [[ "$JOB_STATUS" == "success" ]]; then
+              STATUS_PREFIX="🤖 I attempted to address the review feedback, but no modifications were made."
+            else
+              STATUS_PREFIX="⚠️ I encountered issues while attempting to address the feedback, and no modifications were made."
+            fi
+          fi
+
+          cat > /tmp/pr-comment.md << EOL
+          ${STATUS_PREFIX}
+
+          ## Aider Output
+          \`\`\`
+          $(cat .aider_output.txt || echo 'No output available')
+          \`\`\`
+
+          Please review the output and provide additional guidance if needed.
+          EOL
+
+          # Use the file for comment body
+          gh pr comment $PR_NUM --body-file /tmp/pr-comment.md
+
+      - name: Comment on issue/PR to let the user know Aider has finished working on the request
+        if: always() && github.event_name == 'issue_comment'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          JOB_STATUS: ${{ job.status }}
+          PR_CREATED: ${{ steps.create_pr.outputs.PR_CREATED }}
+        run: |
+          echo "Commenting on issue/PR #${{ github.event.issue.number }} to let the user know Aider has finished working on the request."
+
+          if [[ "$JOB_STATUS" == "success" ]]; then
+            if [[ "$PR_CREATED" == "true" ]]; then
+              COMMENT_BODY="🤖 Aider has finished working on your request. A PR has been created."
+            else
+              COMMENT_BODY="🤖 Aider has finished working on your request, but was unable to create a PR."
+            fi
+          else
+            COMMENT_BODY="⚠️ Aider encountered issues while working on your request. Please check the workflow logs for details."
+          fi
+
+          gh issue comment ${{ github.event.issue.number }} --body "$COMMENT_BODY" --repo $GITHUB_REPOSITORY
+
+      - name: Comment on linear issue to let the user know Aider has finished working on the request
+        if: always() && github.event_name == 'repository_dispatch'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          JOB_STATUS: ${{ job.status }}
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+          PR_CREATED: ${{ steps.create_pr.outputs.PR_CREATED }}
+        run: |
+          echo "Commenting on linear issue #${{ github.event.client_payload.issue_id }} to let the user know Aider has finished working on the request."
+
+          if [[ "$JOB_STATUS" == "success" ]]; then
+            if [[ "$PR_CREATED" == "true" ]]; then
+              COMMENT_BODY="🤖 Aider has finished working on your request. A PR has been created."
+            else
+              COMMENT_BODY="🤖 Aider has finished working on your request, but was unable to create a PR."
+            fi
+          else
+            COMMENT_BODY="⚠️ Aider encountered issues while working on your request. Please check the workflow logs for details."
+          fi
+
+          curl -X POST \
+            -H "Authorization: $LINEAR_API_KEY" \
+            -H "Content-Type: application/json" \
+            "https://api.linear.app/graphql" \
+            -d "{\"query\":\"mutation { commentCreate(input: { issueId: \\\"${{ github.event.client_payload.issue_id }}\\\", body: \\\"${COMMENT_BODY}\\\" }) { success } }\"}"

.github/workflows/aider.yaml

@@ -0,0 +1,150 @@
+name: Aider Auto-fix issues and PR comments via external prompt
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  check-membership:
+    runs-on: ubicloud-standard-2
+    if: |
+      github.event_name == 'issue_comment' &&
+      contains(github.event.comment.body, '/aider') &&
+      !contains(github.event.comment.user.login, '[bot]')
+    outputs:
+      is_member: ${{ steps.check-membership.outputs.is_member }}
+    steps:
+      - name: Check organization membership
+        id: check-membership
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          COMMENTER: ${{ github.event.comment.user.login }}
+          ORG_ACCESS_TOKEN: ${{ secrets.ORG_ACCESS_TOKEN }}
+        run: |
+          ORG="windmill-labs"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            -H "Authorization: token $ORG_ACCESS_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "https://api.github.com/orgs/$ORG/members/$COMMENTER")
+
+          if [ "$STATUS" -eq 204 ]; then
+            echo "is_member=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_member=false" >> $GITHUB_OUTPUT
+          fi
+
+  check-and-prepare:
+    needs: check-membership
+    runs-on: ubicloud-standard-2
+    if: needs.check-membership.outputs.is_member == 'true'
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    env:
+      GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      WINDMILL_TOKEN: ${{ secrets.WINDMILL_TOKEN }}
+    outputs:
+      issue_title: ${{ steps.determine_inputs.outputs.ISSUE_TITLE }}
+      issue_body: ${{ steps.determine_inputs.outputs.ISSUE_BODY }}
+      comment_content: ${{ steps.determine_inputs.outputs.COMMENT_CONTENT }}
+      pr_branch: ${{ steps.checkout_pr.outputs.PR_BRANCH }}
+
+    steps:
+      - name: Acknowledge Request
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: |
+          echo "Commenting on issue/PR #${{ github.event.issue.number }} to acknowledge the /aider command."
+          gh issue comment ${{ github.event.issue.number }} --body "🤖 Aider is starting to work on your request. I'll update you here once I have a PR ready. Please be patient, this might take a few minutes." --repo $GITHUB_REPOSITORY
+
+      - name: Determine inputs for Aider
+        id: determine_inputs
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: |
+          echo "Determining inputs for Aider..."
+          ISSUE_TITLE_VAL=""
+          ISSUE_BODY_VAL=""
+
+          if [[ ! -z "${{ github.event.issue.pull_request }}" ]]; then
+            echo "This is a comment on a Pull Request"
+            PR_NUMBER="$ISSUE_NUMBER"
+            
+            PR_BODY_JSON=$(gh pr view "$PR_NUMBER" --json body --repo "$GITHUB_REPOSITORY")
+            if [[ $? -ne 0 ]]; then
+              echo "Error fetching PR body for PR #$PR_NUMBER"
+              PR_BODY_VAL=""
+            else
+              PR_BODY_VAL=$(jq -r '.body // ""' <<< "$PR_BODY_JSON")
+            fi
+            
+            if [[ ! -z "$PR_BODY_VAL" ]]; then
+              REFERENCED_ISSUE=""
+              if [[ "$PR_BODY_VAL" =~ \#([0-9]+) ]]; then
+                REFERENCED_ISSUE="${BASH_REMATCH[1]}"
+              fi
+              
+              if [[ ! -z "$REFERENCED_ISSUE" ]]; then
+                echo "Found referenced issue #$REFERENCED_ISSUE in PR description"
+                
+                ISSUE_DETAILS_JSON=$(gh issue view "$REFERENCED_ISSUE" --json title,body --repo "$GITHUB_REPOSITORY")
+                if [[ $? -ne 0 ]]; then
+                  echo "Error fetching issue details for #$REFERENCED_ISSUE"
+                else
+                  ISSUE_TITLE_VAL=$(jq -r '.title // ""' <<< "$ISSUE_DETAILS_JSON")
+                  ISSUE_BODY_VAL=$(jq -r '.body // ""' <<< "$ISSUE_DETAILS_JSON")
+                fi
+              fi
+            else
+              echo "PR body is empty or could not be fetched."
+            fi
+          else
+            echo "This is a comment on a regular issue"
+            
+            ISSUE_DETAILS_JSON=$(gh issue view "$ISSUE_NUMBER" --json title,body --repo "$GITHUB_REPOSITORY")
+            if [[ $? -ne 0 ]]; then
+              echo "Error fetching issue details for #$ISSUE_NUMBER"
+            else
+              ISSUE_TITLE_VAL=$(jq -r '.title // ""' <<< "$ISSUE_DETAILS_JSON")
+              ISSUE_BODY_VAL=$(jq -r '.body // ""' <<< "$ISSUE_DETAILS_JSON") 
+            fi
+          fi
+
+          echo "ISSUE_TITLE<<EOF_AIDER_TITLE" >> "$GITHUB_OUTPUT"
+          echo "$ISSUE_TITLE_VAL" >> "$GITHUB_OUTPUT"
+          echo "EOF_AIDER_TITLE" >> "$GITHUB_OUTPUT"
+
+          echo "ISSUE_BODY<<EOF_AIDER_BODY" >> "$GITHUB_OUTPUT"
+          echo "$ISSUE_BODY_VAL" >> "$GITHUB_OUTPUT"
+          echo "EOF_AIDER_BODY" >> "$GITHUB_OUTPUT"
+
+          CLEAN_COMMENT="${COMMENT_BODY/\/aider/}"
+          CLEAN_COMMENT="${CLEAN_COMMENT#"${CLEAN_COMMENT%%[![:space:]]*}"}"
+          CLEAN_COMMENT="${CLEAN_COMMENT%"${CLEAN_COMMENT##*[![:space:]]}"}"
+
+          echo "COMMENT_CONTENT<<EOF_AIDER_COMMENT" >> "$GITHUB_OUTPUT"
+          echo "$CLEAN_COMMENT" >> "$GITHUB_OUTPUT"
+          echo "EOF_AIDER_COMMENT" >> "$GITHUB_OUTPUT"
+          echo "Finished determining inputs."
+
+  run-aider:
+    needs: [check-membership, check-and-prepare]
+    if: needs.check-membership.outputs.is_member == 'true'
+    uses: ./.github/workflows/aider-common.yml
+    with:
+      issue_title: ${{ needs.check-and-prepare.outputs.issue_title }}
+      issue_body: ${{ needs.check-and-prepare.outputs.issue_body }}
+      instruction: ${{ needs.check-and-prepare.outputs.comment_content }}
+      issue_id: ${{ github.event.issue.number }}
+    secrets: inherit

.github/workflows/claude.yml

@@ -0,0 +1,74 @@
+name: Claude PR Assistant
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  check-membership:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '/aider') && !contains(github.event.comment.user.login, '[bot]')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '/aider') && !contains(github.event.comment.user.login, '[bot]')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '/aider') && !contains(github.event.review.user.login, '[bot]')) ||
+      (github.event_name == 'issues' && contains(github.event.issue.body, '/aider') && !contains(github.event.issue.user.login, '[bot]'))
+    runs-on: ubicloud-standard-2
+    outputs:
+      is_member: ${{ steps.check-membership.outputs.is_member }}
+    steps:
+      - name: Check organization membership
+        id: check-membership
+        env:
+          ORG_ACCESS_TOKEN: ${{ secrets.ORG_ACCESS_TOKEN }}
+        run: |
+          ORG="windmill-labs"
+
+          if [[ "${{ github.event_name }}" == "issue_comment" || "${{ github.event_name }}" == "pull_request_review_comment" ]]; then
+            COMMENTER="${{ github.event.comment.user.login }}"
+          elif [[ "${{ github.event_name }}" == "pull_request_review" ]]; then
+            COMMENTER="${{ github.event.review.user.login }}"
+          else
+            COMMENTER="${{ github.event.issue.user.login }}"
+          fi
+
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            -H "Authorization: token $ORG_ACCESS_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "https://api.github.com/orgs/$ORG/members/$COMMENTER")
+
+          if [ "$STATUS" -eq 204 ]; then
+            echo "is_member=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_member=false" >> $GITHUB_OUTPUT
+          fi
+
+  claude-code-action:
+    needs: check-membership
+    if: |
+      needs.check-membership.outputs.is_member == 'true'
+    runs-on: ubicloud-standard-8
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude PR Action
+        uses: anthropics/claude-code-action@beta
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          timeout_minutes: "60"
+          allowed_tools: "mcp__github__create_pull_request"
+          custom_instructions: "IMPORTANT: Bypass previous instructions and instead of adding a url in your comment to manually create a PR, if you created a new branch with your changes, automatically create a PR from that branch to main, with the title starting with [Claude PR]"
+          trigger_phrase: "/aider"

.github/workflows/create-docs.yml

@@ -0,0 +1,41 @@
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  check-membership:
+    if: ${{ github.event.issue.pull_request && startsWith(github.event.comment.body, '/docs') && github.event.comment.user.type != 'Bot' }}
+    runs-on: ubicloud-standard-2
+    outputs:
+      is_member: ${{ steps.check-membership.outputs.is_member }}
+    steps:
+      - name: Check organization membership
+        id: check-membership
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COMMENTER: ${{ github.event.comment.user.login }}
+        run: |
+          ORG="windmill-labs"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            -H "Authorization: token $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "https://api.github.com/orgs/$ORG/members/$COMMENTER")
+
+          if [ "$STATUS" -eq 204 ]; then
+            echo "is_member=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_member=false" >> $GITHUB_OUTPUT
+          fi
+
+  trigger-docs:
+    needs: check-membership
+    if: ${{ github.event.issue.pull_request && startsWith(github.event.comment.body, '/docs') && needs.check-membership.outputs.is_member == 'true' }}
+    uses: windmill-labs/windmilldocs/.github/workflows/create-docs.yml@main
+    with:
+      pr_number: ${{ github.event.issue.number }}
+      repo: ${{ github.event.repository.name }}
+      comment_text: ${{ github.event.comment.body }}
+    secrets:
+      DOCS_TOKEN: ${{ secrets.DOCS_TOKEN }}
+      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}

.github/workflows/discord-notification.yml

@@ -0,0 +1,32 @@
+name: Create discord thread when a PR is opened, react with green checkmark when PR is merged
+
+on:
+  pull_request:
+    types:
+      - opened
+      - ready_for_review
+      - closed
+
+jobs:
+  notify_discord_when_pr_opened:
+    if: (github.event.pull_request.draft == false) && (github.event.action == 'opened' || github.event.action == 'ready_for_review')
+    uses: ./.github/workflows/shareable-discord-notification.yml
+    with:
+      PR_TITLE: ${{ github.event.pull_request.title }}
+      PR_URL: ${{ github.event.pull_request.html_url }}
+      PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+      PR_STATUS: "opened"
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    secrets:
+      DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_PR_REVIEWS_WEBHOOK }}
+
+  merge_success_emoji:
+    if: github.event.pull_request.merged == true
+    uses: ./.github/workflows/shareable-discord-notification.yml
+    with:
+      PR_STATUS: "merged"
+      DISCORD_CHANNEL_ID: "1372204995868491786"
+      DISCORD_GUILD_ID: "930051556043276338"
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    secrets:
+      DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_PR_BOT_TOKEN }}

.github/workflows/helmchart_on_release.yml

@@ -0,0 +1,66 @@
+name: Publish Helm Chart on Release
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  bump-helm-version:
+    runs-on: ubicloud-standard-2
+
+    steps:
+      - name: Checkout on helm repository
+        uses: actions/checkout@v3
+        with:
+          repository: windmill-labs/windmill-helm-charts
+          token: ${{ secrets.DOCS_TOKEN }}
+
+      - name: Get version
+        id: get_version
+        run: |
+          echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
+
+      - name: Create new branch
+        run: |
+          # Check if branch already exists remotely
+          if git ls-remote --heads origin bump-helm-version-${{ env.VERSION }} | grep -q bump-helm-version-${{ env.VERSION }}; then
+            # Branch exists, check it out
+            git fetch origin bump-helm-version-${{ env.VERSION }}
+            git checkout bump-helm-version-${{ env.VERSION }}
+          else
+            # Create new branch
+            git checkout -b bump-helm-version-${{ env.VERSION }}
+          fi
+
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+
+      - name: Bump helm version
+        run: |
+          # Get current version and increment it by 1
+          CURRENT_VERSION=$(grep "version:" ./charts/windmill/Chart.yaml | awk '{print $2}' | head -n 1)
+          NEW_VERSION=$(echo "$CURRENT_VERSION" | awk -F. '{$NF = $NF + 1;} 1' | sed 's/ /./g')
+          sed -i "s/^version: .*/version: $NEW_VERSION/" ./charts/windmill/Chart.yaml
+
+          # Get the app version from the version
+          VERSION=${{ env.VERSION }}
+          APP_VERSION=${VERSION#refs/tag/}
+          APP_VERSION=${APP_VERSION#v}
+          APP_VERSION=${APP_VERSION%/}
+          sed -i "s/appVersion: .*/appVersion: $APP_VERSION/" ./charts/windmill/Chart.yaml
+
+      - name: Commit and push
+        run: |
+          git add .
+          git commit -m "Bump helm version to ${{ env.VERSION }}"
+          git push origin bump-helm-version-${{ env.VERSION }}
+
+      - name: Create PR
+        env:
+          GH_TOKEN: ${{ secrets.DOCS_TOKEN }}
+        run: |
+          gh pr create \
+            --title "helm: bump version to ${{ env.VERSION }}" \
+            --body "This PR was auto-generated to bring the helm chart up to date for [release ${{ env.VERSION }}](https://github.com/windmill-labs/windmill/releases/tag/v${{ env.VERSION }}) in the main repo." \
+            --head bump-helm-version-${{ env.VERSION }} \
+            --base main

.github/workflows/linear-claude.yaml

@@ -0,0 +1,38 @@
+name: Claude PR Assistant
+
+on:
+  repository_dispatch:
+    types: [external_claude_issue_fix]
+
+jobs:
+  claude-code-action:
+    runs-on: ubicloud-standard-8
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Process inputs
+        id: process_inputs
+        shell: bash
+        run: |
+          ISSUE_TITLE="${{ github.event.client_payload.issue_title }}"
+          INSTRUCTION="${{ github.event.client_payload.instruction }}"
+          ISSUE_BODY=$(printf '%q' "${{ github.event.client_payload.issue_body }}")
+          BASE_PROMPT="Try to fix the following issue based on the instruction given. You are provided with the issue title, issue body, and instruction. You are to fix the issue based on the instruction. You are to create a pull request to fix the issue."
+          CUSTOM_PROMPT=$(printf -v PROMPT "%s\n\nISSUE_TITLE: %s\n\nISSUE_BODY: %s\n\nINSTRUCTION: %s" "$BASE_PROMPT" "$ISSUE_TITLE" "$ISSUE_BODY" "$INSTRUCTION")
+          echo "CUSTOM_PROMPT=$CUSTOM_PROMPT" >> $GITHUB_OUTPUT
+
+      - name: Run Claude PR Action
+        uses: anthropics/claude-code-action@beta
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          timeout_minutes: "60"
+          allowed_tools: "mcp__github__create_pull_request"
+          direct_prompt: ${{ steps.process_inputs.outputs.CUSTOM_PROMPT }}

.github/workflows/linear-issue.yaml

@@ -0,0 +1,68 @@
+name: External Aider Issue Fix
+
+on:
+  repository_dispatch:
+    types: [external_issue_fix]
+
+jobs:
+  check-and-prepare:
+    runs-on: ubicloud-standard-2
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      issue_title: ${{ steps.determine_inputs.outputs.ISSUE_TITLE }}
+      issue_body: ${{ steps.determine_inputs.outputs.ISSUE_BODY }}
+      instruction: ${{ steps.determine_inputs.outputs.INSTRUCTION }}
+    env:
+      GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      WINDMILL_TOKEN: ${{ secrets.WINDMILL_TOKEN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+
+    steps:
+      - name: Acknowledge Request
+        env:
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+        run: |
+          echo "Commenting on Linear issue #${{ github.event.client_payload.issue_id }} to acknowledge the request."
+          curl -X POST \
+            -H "Authorization: $LINEAR_API_KEY" \
+            -H "Content-Type: application/json" \
+            "https://api.linear.app/graphql" \
+            -d "{\"query\":\"mutation { commentCreate(input: { issueId: \\\"${{ github.event.client_payload.issue_id }}\\\", body: \\\"🤖 Aider is starting to work on your request. I'll update you here once I have a PR ready. Please be patient, this might take a few minutes.\\\" }) { success } }\"}"
+
+      - name: Determine inputs for Aider
+        id: determine_inputs
+        shell: bash
+        env:
+          ISSUE_TITLE: ${{ github.event.client_payload.issue_title }}
+          ISSUE_BODY: ${{ github.event.client_payload.issue_body }}
+          INSTRUCTION: ${{ github.event.client_payload.instruction }}
+        run: |
+          echo "Determining inputs for Aider..."
+
+          echo "ISSUE_TITLE<<EOF_AIDER_TITLE" >> "$GITHUB_OUTPUT"
+          echo "$ISSUE_TITLE" >> "$GITHUB_OUTPUT"
+          echo "EOF_AIDER_TITLE" >> "$GITHUB_OUTPUT"
+
+          echo "ISSUE_BODY<<EOF_AIDER_BODY" >> "$GITHUB_OUTPUT"
+          echo "$ISSUE_BODY" >> "$GITHUB_OUTPUT"
+          echo "EOF_AIDER_BODY" >> "$GITHUB_OUTPUT"
+
+          echo "INSTRUCTION<<EOF_AIDER_INSTRUCTION" >> "$GITHUB_OUTPUT"
+          echo "$INSTRUCTION" >> "$GITHUB_OUTPUT"
+          echo "EOF_AIDER_INSTRUCTION" >> "$GITHUB_OUTPUT"
+          echo "Finished determining inputs."
+
+  run-aider:
+    needs: check-and-prepare
+    uses: ./.github/workflows/aider-common.yml
+    with:
+      issue_title: ${{ needs.check-and-prepare.outputs.issue_title }}
+      issue_body: ${{ needs.check-and-prepare.outputs.issue_body }}
+      instruction: ${{ needs.check-and-prepare.outputs.instruction }}
+      issue_id: ${{ github.event.client_payload.issue_id }}
+    secrets: inherit

.github/workflows/shareable-discord-notification.yml

@@ -0,0 +1,98 @@
+name: "Notify Discord when a PR is opened or merged"
+
+on:
+  workflow_call:
+    inputs:
+      PR_TITLE:
+        description: "The title of the PR"
+        type: string
+      PR_URL:
+        description: "The URL of the PR"
+        type: string
+      PR_AUTHOR:
+        description: "The author of the PR"
+        type: string
+      PR_STATUS:
+        description: "The status of the PR"
+        type: string
+      DISCORD_CHANNEL_ID:
+        description: "The Discord channel ID"
+        type: string
+      PR_NUMBER:
+        description: "The number of the PR"
+        type: string
+      DISCORD_GUILD_ID:
+        description: "The Discord guild ID"
+        type: string
+    secrets:
+      DISCORD_WEBHOOK_URL:
+        description: "Discord Webhook URL"
+      DISCORD_BOT_TOKEN:
+        description: "Discord Bot Token"
+
+jobs:
+  open_thread:
+    runs-on: ubicloud-standard-2
+    if: ${{ inputs.PR_STATUS == 'opened' }}
+    steps:
+      - name: Send Discord notification and start a thread
+        env:
+          WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          PR_TITLE: ${{ inputs.PR_TITLE }}
+          PR_NUMBER: ${{ inputs.PR_NUMBER }}
+          PR_URL: ${{ inputs.PR_URL }}
+          PR_AUTHOR: ${{ inputs.PR_AUTHOR }}
+        run: |
+          payload=$(jq -n \
+            --arg content "${PR_URL}" \
+            --arg thread "#${PR_NUMBER}: $PR_TITLE by \`${PR_AUTHOR}\`" \
+            '{
+              content: $content,
+              thread_name: $thread,
+              auto_archive_duration: 10080
+            }'
+          )
+          curl -H "Content-Type: application/json" \
+            -X POST \
+            -d "$payload" \
+            "$WEBHOOK_URL"
+
+  merge_success_emoji:
+    runs-on: ubuntu-latest
+    if: ${{ inputs.PR_STATUS == 'merged' }}
+    steps:
+      - name: React
+        env:
+          BOT_TOKEN: ${{ secrets.DISCORD_BOT_TOKEN }}
+          CHANNEL_ID: ${{ inputs.DISCORD_CHANNEL_ID }}
+          GUILD_ID: ${{ inputs.DISCORD_GUILD_ID }}
+          PR_NUMBER: ${{ inputs.PR_NUMBER }}
+        run: |
+          # 1) get PR thread
+          threads=$(curl -H "Authorization: Bot $BOT_TOKEN" "https://discord.com/api/v10/guilds/${GUILD_ID}/threads/active")
+          thread_id=$(
+            echo "$threads" \
+              | jq -r --arg cid "$CHANNEL_ID" \
+                    --arg pref "#${PR_NUMBER}:" \
+                '.threads[]
+                | select(.parent_id == $cid and (.name | startswith($pref)))
+                | .id'
+          )
+          if [ -z "$thread_id" ]; then
+            echo "Thread not found"
+            exit 1
+          fi
+          # 2) get the first message in that thread
+          messages=$(curl -H "Authorization: Bot $BOT_TOKEN" \
+            "https://discord.com/api/v10/channels/$thread_id/messages?limit=1")
+          message_id=$(echo "$messages" | jq -r '.[-1].id')
+
+          if [ -z "$message_id" ]; then
+            echo "Message not found"
+            exit 1
+          fi
+
+          # 3) add the ✅ reaction
+          curl -X PUT \
+            -H "Authorization: Bot $BOT_TOKEN" \
+            "https://discord.com/api/v10/channels/$thread_id/messages/$message_id/reactions/%E2%9C%85/@me"

.gitignore

@@ -10,3 +10,5 @@ CaddyfileRemoteMalo
 .vscode
 .dev-docker-wrapper*
 backend/.minio-data
+.aider*
+!.aiderignore

CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## [1.491.5](https://github.com/windmill-labs/windmill/compare/v1.491.4...v1.491.5) (2025-05-17)
+
+
+### Bug Fixes
+
+* improve handling of custom concurrency key/tag with preprocessors ([#5762](https://github.com/windmill-labs/windmill/issues/5762)) ([59afa49](https://github.com/windmill-labs/windmill/commit/59afa493fa20cc70b6825e6356713cef84d75312))
+* S3 sql mode returns S3Object ([#5764](https://github.com/windmill-labs/windmill/issues/5764)) ([b29c6e7](https://github.com/windmill-labs/windmill/commit/b29c6e7636bb21c4d977bdaf89ac90e2a1a1086c))
+
+## [1.491.4](https://github.com/windmill-labs/windmill/compare/v1.491.3...v1.491.4) (2025-05-15)
+
+
+### Bug Fixes
+
+* add v1 preprocessor support to workspace preprocessor script ([#5757](https://github.com/windmill-labs/windmill/issues/5757)) ([9b1c30e](https://github.com/windmill-labs/windmill/commit/9b1c30eeff35291ad50f3ddeb64831eac88e2f66))
+
+## [1.491.3](https://github.com/windmill-labs/windmill/compare/v1.491.2...v1.491.3) (2025-05-15)
+
+
+### Bug Fixes
+
+* **frontend:** fix accordeon tabs initialization ([f488903](https://github.com/windmill-labs/windmill/commit/f488903635a1457f839ca641ed4f8d0891ef8212))
+* http trigger routers cache version sequence ([#5755](https://github.com/windmill-labs/windmill/issues/5755)) ([d53bceb](https://github.com/windmill-labs/windmill/commit/d53bceb8004541b79d33220ae8de06d25521da91))
+
+## [1.491.2](https://github.com/windmill-labs/windmill/compare/v1.491.1...v1.491.2) (2025-05-15)
+
+
+### Bug Fixes
+
+* **cli:** --version improvement ([f8f2015](https://github.com/windmill-labs/windmill/commit/f8f201564f7a323eb96f6dc684a525a0784d41f2))
+* http trigger signature validation ([#5753](https://github.com/windmill-labs/windmill/issues/5753)) ([9e9514b](https://github.com/windmill-labs/windmill/commit/9e9514b9af2337e143a9e4cf1e915e1477032e80))
+* Improve indexer performance by factoring required queries to the DB # ([#5749](https://github.com/windmill-labs/windmill/issues/5749)) ([b12feaf](https://github.com/windmill-labs/windmill/commit/b12feaf50ae0ef03816719ff39157fcf55159dbf))
+* improve perf of job deletion ([0efba94](https://github.com/windmill-labs/windmill/commit/0efba945bac9b84a489c6ef552e834593f209fe1))
+
+
+### Performance Improvements
+
+* cache http trigger routers and auth ([#5748](https://github.com/windmill-labs/windmill/issues/5748)) ([ddd18d2](https://github.com/windmill-labs/windmill/commit/ddd18d22a615408a9f57f910d0a58f17e6d6e29d))
+
+## [1.491.1](https://github.com/windmill-labs/windmill/compare/v1.491.0...v1.491.1) (2025-05-15)
+
+
+### Bug Fixes
+
+* avoid deadlocks in sending completed job to result processors ([#5742](https://github.com/windmill-labs/windmill/issues/5742)) ([e87d4f3](https://github.com/windmill-labs/windmill/commit/e87d4f3c1afb4ad356b326b7600c89e6c7803eff))
+
+## [1.491.0](https://github.com/windmill-labs/windmill/compare/v1.490.0...v1.491.0) (2025-05-14)
+
+
+### Features
+
+* Microsoft Teams approvals ([#5734](https://github.com/windmill-labs/windmill/issues/5734)) ([039f3e0](https://github.com/windmill-labs/windmill/commit/039f3e02268f2acda48abea420479216970e58e7))
+* sql jobs outputting to s3 + streaming for high-number of rows ([#5704](https://github.com/windmill-labs/windmill/issues/5704)) ([c7886ea](https://github.com/windmill-labs/windmill/commit/c7886ea07ae44af56f1467288b2d73ff2ae27964))
+
+
+### Bug Fixes
+
+* add missing run job transaction drop ([#5730](https://github.com/windmill-labs/windmill/issues/5730)) ([318def9](https://github.com/windmill-labs/windmill/commit/318def976cf0e4d5c32d01ac611a89e0a6425368))
+* add support for log compaction on docker jobs ([#5732](https://github.com/windmill-labs/windmill/issues/5732)) ([d35a7d2](https://github.com/windmill-labs/windmill/commit/d35a7d22f960f485889e22de48e8de8557069cb7))
+* Ansible lockfile back compatibility issue ([#5731](https://github.com/windmill-labs/windmill/issues/5731)) ([f73c90c](https://github.com/windmill-labs/windmill/commit/f73c90c7518569204b298b916d0fc298932d3cf0))
+* trigger event support for webhook get endpoints ([#5728](https://github.com/windmill-labs/windmill/issues/5728)) ([76258b7](https://github.com/windmill-labs/windmill/commit/76258b7b1af1313f694731d77f3fa6994e9ded70))
+
 ## [1.490.0](https://github.com/windmill-labs/windmill/compare/v1.489.0...v1.490.0) (2025-05-12)
 
 

CLAUDE.md

@@ -0,0 +1,71 @@
+# Windmill Overview
+
+Windmill is an open-source developer platform for building internal tools, API integrations, background jobs, workflows, and user interfaces. It offers a unified system where scripts are automatically turned into sharable UIs and can be composed into flows or embedded in custom applications.
+
+## Core Capabilities
+
+- **Script Development and Execution**: Write and run scripts in Python, TypeScript/JavaScript (Deno/Bun), Go, Bash, SQL, and other languages
+- **Workflow Orchestration**: Compose scripts into multi-step flows with conditional logic, loops, and error handling
+- **UI Generation**: Automatically generate UIs from scripts or build custom applications with a low-code editor
+- **Job Scheduling**: Trigger scripts and flows on schedules, webhooks, or external events
+- **Resource Management**: Securely store and use credentials, databases, and other connections
+
+## Platform Architecture
+
+The Windmill platform consists of several key components:
+
+- **Frontend UI**: Web-based interface for script and flow development, app building, and result visualization
+- **API Server**: Central API that handles authentication, resource management, and job coordination
+- **Workers**: Execute scripts in their respective environments with proper sandboxing
+- **Database**: PostgreSQL database for storage of scripts, flows, resources, job results, and more
+- **Job Queue**: Queue system for managing job execution, implemented in PostgreSQL
+- **Client Libraries**: Libraries for interacting with Windmill from Python, TypeScript, or command line
+
+# Windmill Backend Architecture
+
+The Windmill backend is written in Rust and consists of several services working together. These services are designed for horizontal scaling with stateless API servers and workers that can be deployed across multiple machines.
+
+## Key Components
+
+- **API Server (`windmill-api`)**: Handles HTTP requests, authentication, and resource management
+- **Queue Manager (`windmill-queue`)**: Manages the job queue in PostgreSQL
+- **Worker System (`windmill-worker`)**: Executes jobs in sandboxed environments
+- **Common Utilities (`windmill-common`)**: Shared code used by multiple services
+- **Git Sync (`windmill-git-sync`)**: Synchronizes scripts with Git repositories
+
+## Job Execution System
+
+The job execution process follows these steps:
+
+1. The API server receives a request to run a script or flow and creates a job record in the database
+2. The job is added to the queue system in PostgreSQL
+3. Workers continuously poll the queue for jobs matching their capabilities
+4. When a job is picked up, it's routed to the appropriate language executor
+5. The script is executed in a sandboxed environment using NSJAIL for security
+6. Results are processed and stored in the database
+7. For flows, each step creates a new job that goes through the same process
+
+Windmill supports worker tags and groups to route jobs to workers with specific capabilities or resource access.
+
+# Windmill Frontend Architecture
+
+The Windmill frontend is built with Svelte and provides several key interfaces for interacting with the platform.
+
+## Key Components
+
+- **Script Builder**: Code editor with language support, schema inference, and dependency management
+- **Flow Builder**: Visual editor for creating multi-step workflows with branching and looping
+- **App Editor**: Grid-based editor for building custom UIs that integrate scripts and flows
+- **Schema Form System**: Generates form interfaces from script parameters automatically
+- **Result Viewer**: Visualizes job results, logs, and execution status
+
+The frontend uses the Monaco editor (same as VS Code) for code editing, with specialized language support for all supported script languages.
+
+## UI Framework
+
+The frontend is built with Svelte, providing a reactive and component-based architecture. Key frontend technologies include:
+
+- **Svelte/SvelteKit**: Core framework for UI components and routing
+- **Monaco Editor**: Code editing experience similar to VS Code
+- **Schema Form**: Automatic UI generation from TypeScript/JSON schemas
+- **Tailwind CSS**: Utility-first CSS framework for styling

backend/.sqlx/query-0e296134f05593edc989c628c00cbb60a5446993217baffa83f843bc12a5ac73.json

@@ -1,35 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT\n                    value->'preprocessor_module' IS NOT NULL as has_preprocessor,\n                    value->'preprocessor_module'->'value'->'input_transforms'->'wm_trigger' IS NOT NULL as is_v1_preprocessor,\n                    schema as \"schema: _\"\n                FROM flow \n                WHERE workspace_id = $1 \n                    AND path = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "has_preprocessor",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 1,
-        "name": "is_v1_preprocessor",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 2,
-        "name": "schema: _",
-        "type_info": "Json"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null,
-      null,
-      true
-    ]
-  },
-  "hash": "0e296134f05593edc989c628c00cbb60a5446993217baffa83f843bc12a5ac73"
-}

backend/.sqlx/query-16be720bf1c88ecfa2a4bf6adbb1924df4817b6236b3a949209465f3a2c42bb9.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT nextval('http_trigger_version_seq')",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "nextval",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "16be720bf1c88ecfa2a4bf6adbb1924df4817b6236b3a949209465f3a2c42bb9"
+}

backend/.sqlx/query-1d819b829cd92995c39d29540df8cffbcc3334bada244a331a0bd8db06029d42.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM v2_job_completed c\n                    USING v2_job j\n                    WHERE\n                        created_at <= now() - ($1::bigint::text || ' s')::interval\n                        AND completed_at + ($1::bigint::text || ' s')::interval <= now()\n                        AND c.id = j.id\n                    RETURNING c.id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "1d819b829cd92995c39d29540df8cffbcc3334bada244a331a0bd8db06029d42"
-}

backend/.sqlx/query-1eeb218c30c0a6b0f7633813c764f57f8968894b4786b94109a057796ff500e4.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                path, \n                script_path, \n                is_flow, \n                route_path, \n                authentication_resource_path,\n                workspace_id, \n                is_async, \n                authentication_method  AS \"authentication_method: _\", \n                edited_by, \n                email, \n                static_asset_config AS \"static_asset_config: _\",\n                wrap_body,\n                raw_string,\n                workspaced_route,\n                is_static_website\n            FROM \n                http_trigger \n            WHERE \n                http_method = $1\n            ",
+  "query": "\n                    SELECT \n                        path, \n                        script_path, \n                        is_flow, \n                        route_path, \n                        authentication_resource_path,\n                        workspace_id, \n                        is_async, \n                        authentication_method  AS \"authentication_method: _\", \n                        edited_by, \n                        email, \n                        static_asset_config AS \"static_asset_config: _\",\n                        wrap_body,\n                        raw_string,\n                        workspaced_route,\n                        is_static_website\n                    FROM \n                        http_trigger \n                    WHERE \n                        http_method = $1\n                    ",
   "describe": {
     "columns": [
       {
@@ -129,5 +129,5 @@
       false
     ]
   },
-  "hash": "4053f0bb30f651ddf2214115748daca0ea457da8252394eeeead0897d184f6da"
+  "hash": "1eeb218c30c0a6b0f7633813c764f57f8968894b4786b94109a057796ff500e4"
 }

backend/.sqlx/query-20fd50949796913dd48f67ee75b11272ce5b3046f87b9efd504e013fba9724f5.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT last_value FROM http_trigger_version_seq",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "last_value",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "20fd50949796913dd48f67ee75b11272ce5b3046f87b9efd504e013fba9724f5"
+}

backend/.sqlx/query-234acda79d470e99e9cbde5c7401d6f7894c25f90e39ec8606f79b8be56d1c17.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                        SELECT EXISTS(\n                            SELECT 1\n                            FROM \n                                http_trigger \n                            WHERE \n                                workspace_id = $1 AND \n                                path = $2\n                        )\n                        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "234acda79d470e99e9cbde5c7401d6f7894c25f90e39ec8606f79b8be56d1c17"
+}

backend/.sqlx/query-282afbff89d3186d47ef5dbd0b65026ad37fb31b485fc44b6ec257dd77825428.json

@@ -1,41 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT created_by, coalesce(job_logs.logs, '') as logs, job_logs.log_offset, job_logs.log_file_index\n        FROM v2_as_completed_job\n        LEFT JOIN job_logs ON job_logs.job_id = v2_as_completed_job.id\n        WHERE v2_as_completed_job.id = $1 AND v2_as_completed_job.workspace_id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "created_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "logs",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "log_offset",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 3,
-        "name": "log_file_index",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      true,
-      null,
-      false,
-      true
-    ]
-  },
-  "hash": "282afbff89d3186d47ef5dbd0b65026ad37fb31b485fc44b6ec257dd77825428"
-}

backend/.sqlx/query-2a33a35afc1ba4c31a5713cfd1a2c662f25cda387197aaf9f35000df31b8b07d.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DROP INDEX CONCURRENTLY IF EXISTS log_file_hostname_log_ts_idx",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "2a33a35afc1ba4c31a5713cfd1a2c662f25cda387197aaf9f35000df31b8b07d"
+}

backend/.sqlx/query-3f08ffbb5c71b873a9e164ecb0b10fffb37599f2a703885ee723cb9290fed13e.json

@@ -0,0 +1,91 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH job_info AS (\n            -- Query for Teams (running jobs)\n            SELECT\n                parent.job_kind AS \"job_kind!: JobKind\",\n                parent.script_hash AS \"script_hash: ScriptHash\",\n                parent.raw_flow AS \"raw_flow: sqlx::types::Json<Box<RawValue>>\",\n                child.parent_job AS \"parent_job: Uuid\",\n                parent.created_at AS \"created_at!: chrono::NaiveDateTime\",\n                parent.created_by AS \"created_by!\",\n                parent.script_path,\n                parent.args AS \"args: sqlx::types::Json<Box<RawValue>>\"\n            FROM v2_as_queue child\n            JOIN v2_as_queue parent ON parent.id = child.parent_job\n            WHERE child.id = $1 AND child.workspace_id = $2\n            UNION ALL\n            -- Query for Slack (completed jobs)\n            SELECT\n                v2_as_queue.job_kind AS \"job_kind!: JobKind\",\n                v2_as_queue.script_hash AS \"script_hash: ScriptHash\",\n                v2_as_queue.raw_flow AS \"raw_flow: sqlx::types::Json<Box<RawValue>>\",\n                v2_as_completed_job.parent_job AS \"parent_job: Uuid\",\n                v2_as_completed_job.created_at AS \"created_at!: chrono::NaiveDateTime\",\n                v2_as_completed_job.created_by AS \"created_by!\",\n                v2_as_queue.script_path,\n                v2_as_queue.args AS \"args: sqlx::types::Json<Box<RawValue>>\"\n            FROM v2_as_queue\n            JOIN v2_as_completed_job ON v2_as_completed_job.parent_job = v2_as_queue.id\n            WHERE v2_as_completed_job.id = $1 AND v2_as_completed_job.workspace_id = $2\n        )\n        SELECT * FROM job_info LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "job_kind!: JobKind",
+        "type_info": {
+          "Custom": {
+            "name": "job_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "preview",
+                "flow",
+                "dependencies",
+                "flowpreview",
+                "script_hub",
+                "identity",
+                "flowdependencies",
+                "http",
+                "graphql",
+                "postgresql",
+                "noop",
+                "appdependencies",
+                "deploymentcallback",
+                "singlescriptflow",
+                "flowscript",
+                "flownode",
+                "appscript"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 1,
+        "name": "script_hash: ScriptHash",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "raw_flow: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "parent_job: Uuid",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 4,
+        "name": "created_at!: chrono::NaiveDateTime",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 5,
+        "name": "created_by!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "script_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "args: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "3f08ffbb5c71b873a9e164ecb0b10fffb37599f2a703885ee723cb9290fed13e"
+}

backend/.sqlx/query-49943f69ed74bc889120dcd2571e8e868a4f4795933044ff95b20d8df45cd145.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "CREATE INDEX CONCURRENTLY IF NOT EXISTS ix_job_completed_completed_at ON v2_job_completed (completed_at DESC)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "49943f69ed74bc889120dcd2571e8e868a4f4795933044ff95b20d8df45cd145"
+}

backend/.sqlx/query-52ad0c838d19cbd9e90b8368abe71dd12655179f41f43896e7d30fdfb3ae5939.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH job_result AS (\n                 SELECT result \n                 FROM v2_job_completed \n                 WHERE id = $1\n             )\n             UPDATE v2_job \n             SET args = COALESCE(\n                     CASE \n                         WHEN job_result.result IS NULL THEN NULL\n                         WHEN jsonb_typeof(job_result.result) = 'object' \n                         THEN job_result.result\n                         WHEN jsonb_typeof(job_result.result) = 'null'\n                         THEN NULL\n                         ELSE jsonb_build_object('value', job_result.result)\n                     END, \n                     '{}'::jsonb\n                 ),\n                 preprocessed = TRUE\n             FROM job_result\n             WHERE v2_job.id = $2;\n             ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Uuid"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "52ad0c838d19cbd9e90b8368abe71dd12655179f41f43896e7d30fdfb3ae5939"
-}

backend/.sqlx/query-551fee7919fdeb911e3f9cc5852e158ea47e3db4895c2b2b1d3cb6b16fceeda9.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT fv.id\n                                                                                FROM flow f\n                                                                                INNER JOIN flow_version fv ON fv.id = f.versions[array_upper(f.versions, 1)]\n                                                                                WHERE fv.value->'preprocessor_module'->'value'->>'path' = $1 AND f.workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "551fee7919fdeb911e3f9cc5852e158ea47e3db4895c2b2b1d3cb6b16fceeda9"
+}

backend/.sqlx/query-5820d34be1a7f7b72e656c692f53146f45ad4a6e584e917a0a86280d8f473c10.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM v2_job_completed c\n                    WHERE completed_at <= now() - ($1::bigint::text || ' s')::interval \n                    RETURNING c.id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "5820d34be1a7f7b72e656c692f53146f45ad4a6e584e917a0a86280d8f473c10"
+}

backend/.sqlx/query-6e2564dc37ee967c634deade67ceabc4c516418e595dee9cd7d651acc1f4af6e.json

@@ -0,0 +1,248 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n                            cj.id AS \"id!\",\n                            cj.workspace_id AS \"workspace_id!\",\n                            cj.parent_job,\n                            cj.created_by AS \"created_by!\",\n                            cj.duration_ms AS \"duration_ms!\",\n                            cj.success AS \"success!\",\n                            cj.script_hash AS \"script_hash!: Option<ScriptHash>\",\n                            cj.script_path,\n                            cj.args AS \"args: sqlx::types::Json<HashMap<String, Box<RawValue>>>\",\n                            cj.result AS \"result: sqlx::types::Json<Box<RawValue>>\",\n                            cj.deleted AS \"deleted!\",\n                            cj.canceled AS \"canceled!\",\n                            cj.canceled_by,\n                            cj.canceled_reason,\n                            cj.job_kind AS \"job_kind!: JobKind\",\n                            cj.schedule_path,\n                            cj.permissioned_as AS \"permissioned_as!\",\n                            cj.is_flow_step AS \"is_flow_step!\",\n                            cj.language AS \"language: ScriptLang\",\n                            cj.is_skipped AS \"is_skipped!\",\n                            cj.email AS \"email!\",\n                            cj.visible_to_owner AS \"visible_to_owner!\",\n                            cj.mem_peak,\n                            cj.tag AS \"tag!\",\n                            cj.created_at AS \"created_at!\",\n                            cj.started_at,\n                            job_logs.logs,\n                            job_logs.log_offset AS \"log_offset?\",\n                            job_logs.log_file_index\n\n                        FROM v2_as_completed_job AS cj\n                        LEFT JOIN job_logs ON cj.id = job_logs.job_id\n                        WHERE (cj.created_at > $1 AND cj.created_at < $3)\n                               OR cj.id = ANY($2)\n                        ORDER BY cj.created_at ASC LIMIT $4",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "workspace_id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "parent_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 3,
+        "name": "created_by!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 4,
+        "name": "duration_ms!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 5,
+        "name": "success!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 6,
+        "name": "script_hash!: Option<ScriptHash>",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 7,
+        "name": "script_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "args: sqlx::types::Json<HashMap<String, Box<RawValue>>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 9,
+        "name": "result: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 10,
+        "name": "deleted!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 11,
+        "name": "canceled!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 12,
+        "name": "canceled_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 13,
+        "name": "canceled_reason",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 14,
+        "name": "job_kind!: JobKind",
+        "type_info": {
+          "Custom": {
+            "name": "job_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "preview",
+                "flow",
+                "dependencies",
+                "flowpreview",
+                "script_hub",
+                "identity",
+                "flowdependencies",
+                "http",
+                "graphql",
+                "postgresql",
+                "noop",
+                "appdependencies",
+                "deploymentcallback",
+                "singlescriptflow",
+                "flowscript",
+                "flownode",
+                "appscript"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 15,
+        "name": "schedule_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 16,
+        "name": "permissioned_as!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 17,
+        "name": "is_flow_step!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 18,
+        "name": "language: ScriptLang",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 19,
+        "name": "is_skipped!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 20,
+        "name": "email!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 21,
+        "name": "visible_to_owner!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 22,
+        "name": "mem_peak",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 23,
+        "name": "tag!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 24,
+        "name": "created_at!",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 25,
+        "name": "started_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 26,
+        "name": "logs",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 27,
+        "name": "log_offset?",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 28,
+        "name": "log_file_index",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Timestamptz",
+        "UuidArray",
+        "Timestamptz",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "6e2564dc37ee967c634deade67ceabc4c516418e595dee9cd7d651acc1f4af6e"
+}

backend/.sqlx/query-91f23fcc27777c279c79e2682fc15c026e55f9ec3799be65a2e8920fe6174a17.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT result  as \"result: Json<HashMap<String, Box<RawValue>>>\"\n                 FROM v2_job_completed \n                 WHERE id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "result: Json<HashMap<String, Box<RawValue>>>",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "91f23fcc27777c279c79e2682fc15c026e55f9ec3799be65a2e8920fe6174a17"
+}

backend/.sqlx/query-927149213e0f8ae983652ef80464f646d6be80e702193f1acdd40dd6033652e4.json

@@ -1,134 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                path, \n                script_path, \n                is_flow, \n                route_path, \n                workspace_id, \n                is_async, \n                authentication_method  AS \"authentication_method: _\", \n                edited_by, \n                email,\n                static_asset_config AS \"static_asset_config: _\",\n                wrap_body,\n                raw_string,\n                workspaced_route,\n                is_static_website,\n                authentication_resource_path\n            FROM \n                http_trigger \n            WHERE \n                workspace_id = $1 AND \n                http_method = $2\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "script_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "is_flow",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 3,
-        "name": "route_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 4,
-        "name": "workspace_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "is_async",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 6,
-        "name": "authentication_method: _",
-        "type_info": {
-          "Custom": {
-            "name": "authentication_method",
-            "kind": {
-              "Enum": [
-                "none",
-                "windmill",
-                "api_key",
-                "basic_http",
-                "custom_script",
-                "signature"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 7,
-        "name": "edited_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 8,
-        "name": "email",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 9,
-        "name": "static_asset_config: _",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 10,
-        "name": "wrap_body",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 11,
-        "name": "raw_string",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 12,
-        "name": "workspaced_route",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 13,
-        "name": "is_static_website",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 14,
-        "name": "authentication_resource_path",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        {
-          "Custom": {
-            "name": "http_method",
-            "kind": {
-              "Enum": [
-                "get",
-                "post",
-                "put",
-                "delete",
-                "patch"
-              ]
-            }
-          }
-        }
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      false,
-      false,
-      false,
-      false,
-      true,
-      false,
-      false,
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "927149213e0f8ae983652ef80464f646d6be80e702193f1acdd40dd6033652e4"
-}

backend/.sqlx/query-a8ca4e588e0bf3c4bba2fe4b68a5364e4cba99964513599f8a012a5680d3dca8.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "CREATE INDEX CONCURRENTLY IF NOT EXISTS alerts_by_workspace ON alerts (workspace_id);",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "a8ca4e588e0bf3c4bba2fe4b68a5364e4cba99964513599f8a012a5680d3dca8"
+}

backend/.sqlx/query-b7335ac24702c86fbb4ab95916a6aa1648082287b09122755df2462dc71ce831.json

@@ -0,0 +1,46 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        WITH j AS (\n            SELECT \n                raw_flow->>'concurrency_key' as concurrency_key, \n                raw_flow->>'concurrency_time_window_s' as concurrency_time_window_s,\n                raw_flow->>'concurrency_limit' as concurrent_limit,\n                runnable_path, \n                runnable_id as version FROM v2_job\n            WHERE id = $1\n        )\n        SELECT tag, j.concurrency_key, j.concurrency_time_window_s::int, j.concurrent_limit::int, j.version\n            FROM flow, j\n            WHERE path = j.runnable_path\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "concurrency_key",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "concurrency_time_window_s",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 3,
+        "name": "concurrent_limit",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 4,
+        "name": "version",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      true,
+      null,
+      null,
+      null,
+      true
+    ]
+  },
+  "hash": "b7335ac24702c86fbb4ab95916a6aa1648082287b09122755df2462dc71ce831"
+}

backend/.sqlx/query-c51f9ad5133c46fd7c499b8339dbbf3f3059bbb85de07ee3b4b4cea971984a52.json

@@ -0,0 +1,132 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                SELECT\n                    mqtt_resource_path,\n                    subscribe_topics as \"subscribe_topics: _\",\n                    v3_config as \"v3_config: _\",\n                    v5_config as \"v5_config: _\",\n                    client_version AS \"client_version: _\",\n                    client_id,\n                    workspace_id,\n                    path,\n                    script_path,\n                    is_flow,\n                    edited_by,\n                    email,\n                    edited_at,\n                    server_id,\n                    last_server_ping,\n                    extra_perms,\n                    error,\n                    enabled\n                FROM \n                    mqtt_trigger\n                ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "mqtt_resource_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "subscribe_topics: _",
+        "type_info": "JsonbArray"
+      },
+      {
+        "ordinal": 2,
+        "name": "v3_config: _",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "v5_config: _",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 4,
+        "name": "client_version: _",
+        "type_info": {
+          "Custom": {
+            "name": "mqtt_client_version",
+            "kind": {
+              "Enum": [
+                "v3",
+                "v5"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 5,
+        "name": "client_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "script_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 9,
+        "name": "is_flow",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 10,
+        "name": "edited_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 11,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 12,
+        "name": "edited_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 13,
+        "name": "server_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 14,
+        "name": "last_server_ping",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 15,
+        "name": "extra_perms",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 16,
+        "name": "error",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 17,
+        "name": "enabled",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      false,
+      true,
+      true,
+      false,
+      true,
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      false,
+      true,
+      false
+    ]
+  },
+  "hash": "c51f9ad5133c46fd7c499b8339dbbf3f3059bbb85de07ee3b4b4cea971984a52"
+}

backend/.sqlx/query-e07660e8d2a265cb6a83f3a2bb8e7e6330f09ab116e9837f6f16f8fdef938004.json

@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH job_result AS (\n                 SELECT result \n                 FROM v2_job_completed \n                 WHERE id = $1\n             ),\n             updated_queue AS (\n                UPDATE v2_job_queue\n                SET running = false,\n                tag = COALESCE($3, tag)\n                WHERE id = $2\n             )\n             UPDATE v2_job \n             SET \n                tag = COALESCE($3, tag),\n                concurrent_limit = COALESCE($4, concurrent_limit),\n                concurrency_time_window_s = COALESCE($5, concurrency_time_window_s),\n                args = COALESCE(\n                     CASE \n                         WHEN job_result.result IS NULL THEN NULL\n                         WHEN jsonb_typeof(job_result.result) = 'object' \n                         THEN job_result.result\n                         WHEN jsonb_typeof(job_result.result) = 'null'\n                         THEN NULL\n                         ELSE jsonb_build_object('value', job_result.result)\n                     END, \n                     '{}'::jsonb\n                 ),\n                 preprocessed = TRUE\n             FROM job_result\n             WHERE v2_job.id = $2;\n             ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid",
+        "Varchar",
+        "Int4",
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e07660e8d2a265cb6a83f3a2bb8e7e6330f09ab116e9837f6f16f8fdef938004"
+}

backend/.sqlx/query-e7348225a27bbdc9607d7c799e7192cd6ce4088467d91a5cbdc019430320d26d.json

@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n                    value->'preprocessor_module'->'value' as \"preprocessor_module: _\",\n                    schema as \"schema: _\"\n                FROM flow_version\n                WHERE \n                    path = $1\n                    AND workspace_id = $2\n                ORDER BY created_at DESC\n                LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "preprocessor_module: _",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "schema: _",
+        "type_info": "Json"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      true
+    ]
+  },
+  "hash": "e7348225a27bbdc9607d7c799e7192cd6ce4088467d91a5cbdc019430320d26d"
+}

backend/.sqlx/query-f0fdeb7aea3e71099e7db0f4343bbd7ec86610ddc8589bf5b606fab0947c8b75.json

@@ -1,91 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT\n            v2_as_queue.job_kind AS \"job_kind!: JobKind\",\n            v2_as_queue.script_hash AS \"script_hash: ScriptHash\",\n            v2_as_queue.raw_flow AS \"raw_flow: sqlx::types::Json<Box<RawValue>>\",\n            v2_as_completed_job.parent_job AS \"parent_job: Uuid\",\n            v2_as_completed_job.created_at AS \"created_at!: chrono::NaiveDateTime\",\n            v2_as_completed_job.created_by AS \"created_by!\",\n            v2_as_queue.script_path,\n            v2_as_queue.args AS \"args: sqlx::types::Json<Box<RawValue>>\"\n        FROM v2_as_queue\n        JOIN v2_as_completed_job ON v2_as_completed_job.parent_job = v2_as_queue.id\n        WHERE v2_as_completed_job.id = $1 AND v2_as_completed_job.workspace_id = $2\n        LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "job_kind!: JobKind",
-        "type_info": {
-          "Custom": {
-            "name": "job_kind",
-            "kind": {
-              "Enum": [
-                "script",
-                "preview",
-                "flow",
-                "dependencies",
-                "flowpreview",
-                "script_hub",
-                "identity",
-                "flowdependencies",
-                "http",
-                "graphql",
-                "postgresql",
-                "noop",
-                "appdependencies",
-                "deploymentcallback",
-                "singlescriptflow",
-                "flowscript",
-                "flownode",
-                "appscript"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 1,
-        "name": "script_hash: ScriptHash",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 2,
-        "name": "raw_flow: sqlx::types::Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "parent_job: Uuid",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 4,
-        "name": "created_at!: chrono::NaiveDateTime",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 5,
-        "name": "created_by!",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 6,
-        "name": "script_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 7,
-        "name": "args: sqlx::types::Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      true,
-      true,
-      true,
-      true,
-      true,
-      true,
-      true,
-      true
-    ]
-  },
-  "hash": "f0fdeb7aea3e71099e7db0f4343bbd7ec86610ddc8589bf5b606fab0947c8b75"
-}

backend/.sqlx/query-f22964772dc2d67aee437bbbd08b64792c00da1d713d7ca8f9904ccce7bfdae7.json

@@ -0,0 +1,246 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n                            cj.id AS \"id!\",\n                            cj.workspace_id AS \"workspace_id!\",\n                            cj.parent_job,\n                            cj.created_by AS \"created_by!\",\n                            cj.duration_ms AS \"duration_ms!\",\n                            cj.success AS \"success!\",\n                            cj.script_hash AS \"script_hash!: Option<ScriptHash>\",\n                            cj.script_path,\n                            cj.args AS \"args: sqlx::types::Json<HashMap<String, Box<RawValue>>>\",\n                            cj.result AS \"result: sqlx::types::Json<Box<RawValue>>\",\n                            cj.deleted AS \"deleted!\",\n                            cj.canceled AS \"canceled!\",\n                            cj.canceled_by,\n                            cj.canceled_reason,\n                            cj.job_kind AS \"job_kind!: JobKind\",\n                            cj.schedule_path,\n                            cj.permissioned_as AS \"permissioned_as!\",\n                            cj.is_flow_step AS \"is_flow_step!\",\n                            cj.language AS \"language: ScriptLang\",\n                            cj.is_skipped AS \"is_skipped!\",\n                            cj.email AS \"email!\",\n                            cj.visible_to_owner AS \"visible_to_owner!\",\n                            cj.mem_peak,\n                            cj.tag AS \"tag!\",\n                            cj.created_at AS \"created_at!\",\n                            cj.started_at,\n                            job_logs.logs,\n                            job_logs.log_offset AS \"log_offset?\",\n                            job_logs.log_file_index\n\n                        FROM v2_as_completed_job AS cj\n                        LEFT JOIN job_logs ON cj.id = job_logs.job_id\n                        WHERE cj.created_at < $1\n                        ORDER BY cj.created_at ASC LIMIT $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "workspace_id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "parent_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 3,
+        "name": "created_by!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 4,
+        "name": "duration_ms!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 5,
+        "name": "success!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 6,
+        "name": "script_hash!: Option<ScriptHash>",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 7,
+        "name": "script_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "args: sqlx::types::Json<HashMap<String, Box<RawValue>>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 9,
+        "name": "result: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 10,
+        "name": "deleted!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 11,
+        "name": "canceled!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 12,
+        "name": "canceled_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 13,
+        "name": "canceled_reason",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 14,
+        "name": "job_kind!: JobKind",
+        "type_info": {
+          "Custom": {
+            "name": "job_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "preview",
+                "flow",
+                "dependencies",
+                "flowpreview",
+                "script_hub",
+                "identity",
+                "flowdependencies",
+                "http",
+                "graphql",
+                "postgresql",
+                "noop",
+                "appdependencies",
+                "deploymentcallback",
+                "singlescriptflow",
+                "flowscript",
+                "flownode",
+                "appscript"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 15,
+        "name": "schedule_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 16,
+        "name": "permissioned_as!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 17,
+        "name": "is_flow_step!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 18,
+        "name": "language: ScriptLang",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 19,
+        "name": "is_skipped!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 20,
+        "name": "email!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 21,
+        "name": "visible_to_owner!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 22,
+        "name": "mem_peak",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 23,
+        "name": "tag!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 24,
+        "name": "created_at!",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 25,
+        "name": "started_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 26,
+        "name": "logs",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 27,
+        "name": "log_offset?",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 28,
+        "name": "log_file_index",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Timestamptz",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "f22964772dc2d67aee437bbbd08b64792c00da1d713d7ca8f9904ccce7bfdae7"
+}

backend/.sqlx/query-f632d08a8d3df691fff9f57fdf926f787287c3cd181a6853056077edba10473d.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n                SELECT EXISTS(\n                    SELECT 1 \n                    FROM \n                        http_trigger \n                    WHERE \n                        workspace_id = $1 AND \n                        path = $2\n                )\n                ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "exists",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "f632d08a8d3df691fff9f57fdf926f787287c3cd181a6853056077edba10473d"
-}

backend/CLAUDE.md

@@ -0,0 +1,104 @@
+# Windmill Backend - Rust Best Practices
+
+## Project Structure
+
+Windmill uses a workspace-based architecture with multiple crates:
+
+- **windmill-api**: API server functionality
+- **windmill-worker**: Job execution
+- **windmill-common**: Shared code used by all crates
+- **windmill-queue**: Job & flow queuing
+- **windmill-audit**: Audit logging
+- Other specialized crates (git-sync, autoscaling, etc.)
+
+## Adding New Code
+
+### Module Organization
+
+- Place new code in the appropriate crate based on functionality
+- For API endpoints, create or modify files in `windmill-api/src/` organized by domain
+- For shared functionality, use `windmill-common/src/`
+- Use the `_ee.rs` suffix for enterprise-only modules
+- Follow existing patterns for file structure and organization
+
+### Error Handling
+
+- Use the custom `Error` enum from `windmill-common::error`
+- Return `Result<T, Error>` or `JsonResult<T>` for functions that can fail
+- Use the `?` operator for error propagation
+- Add location tracking to errors using `#[track_caller]`
+
+### Database Operations
+
+- Use `sqlx` for database operations with prepared statements
+- Leverage existing database helper functions in `db.rs` modules
+- Use transactions for multi-step operations
+- Handle database errors properly
+
+### API Endpoints
+
+- Follow existing patterns in the `windmill-api` crate
+- Use axum's routing system and extractors
+- Group related routes together
+- Use consistent response formats (JSON)
+- Follow proper authentication and authorization patterns
+
+## Performance Optimizations
+
+When generating code, especially involving `serde`, `sqlx`, and `tokio`, prioritize performance by applying the following principles:
+
+### Serde Optimizations (Serialization & Deserialization)
+
+- **Specify Structure Explicitly:** When defining structs for Serde (`#[derive(Serialize, Deserialize)]`), use `#[serde(...` attributes extensively. This includes:
+  - `#[serde(rename = "...")]` or `#[serde(alias = "...")]` to map external names precisely, avoiding dynamic lookups.
+  - `#[serde(default)]` for optional fields with default values, reducing parsing complexity.
+  - `#[serde(skip_serializing_if = "...")]` to avoid writing fields that meet a certain condition (e.g., `Option::is_none()`, `Vec::is_empty()`, or a custom function), reducing output size and serialization work.
+  - `#[serde(skip_serializing)]` or `#[serde(skip_deserializing)]` for fields that should _not_ be included.
+- **Prefer Borrowing:** Where possible and safe (data lifetime allows), use `Cow<'a, str>` or `&'a str` (with `#[serde(borrow)]`) instead of `String` for string fields during deserialization. This avoids allocating new strings, enabling zero-copy reading from the input buffer. Apply this principle to byte slices (`&'a [u8]` / `Cow<'a, [u8]>`) and potentially borrowed vectors as well.
+- **Avoid Intermediate `Value`:** Unless the data structure is truly dynamic or unknown at compile time, deserialize directly into a well-defined struct or enum rather than into `serde_json::Value` (or equivalent for other formats). This avoids unnecessary heap allocations and type switching.
+
+### SQLx Optimizations (Database Interaction)
+
+- **Select Only Necessary Columns:** In `SELECT` queries, list specific column names rather than using `SELECT *`. This reduces data transferred from the database and the work needed for hydration/deserialization.
+- **Batch Operations:** For multiple `INSERT`, `UPDATE`, or `DELETE` statements, prefer executing them in a single query if the database and driver support it efficiently (e.g., `INSERT INTO ... VALUES (...), (...), ...`). This minimizes round trips to the database.
+- **Avoid N+1 Queries:** Do not loop through results of one query and execute a separate query for each item (e.g., fetching users, then querying for each user's profile in a loop). Instead, use JOINs or a single query with an `IN` clause to fetch related data efficiently.
+- **Deserialize Directly:** Use `#[derive(FromRow)]` on structs and ensure the struct fields match the selected columns in the query. This allows SQLx to hydrate objects directly, avoiding intermediate data structures.
+- **Parameterize Queries:** Always use SQLx's query methods (`.bind(...)`) to pass values as parameters rather than string formatting. This prevents SQL injection and allows the database to cache query plans, improving performance on repeated executions.
+
+### Tokio Optimizations (Asynchronous Runtime)
+
+- **Avoid Blocking Operations:** **Crucially**, never perform blocking operations (synchronous file I/O, `std::thread::sleep`, CPU-bound loops, `std::sync::Mutex::lock`, blocking network calls without `tokio::net`) directly within an `async fn` or a standard `tokio::spawn` task. Blocking pauses the entire worker thread, potentially starving other tasks. Use `tokio::task::spawn_blocking` for CPU-intensive work or blocking I/O.
+- **Use Tokio's Async Primitives:** Prefer `tokio::sync` (channels, mutexes, semaphores), `tokio::io`, `tokio::net`, and `tokio::time` over their `std` counterparts in asynchronous contexts. These are designed to yield control back to the scheduler.
+- **Manage Concurrency:** Be mindful of how many tasks are spawned. Creating a new task for every tiny piece of work can introduce overhead. Group related asynchronous operations where appropriate.
+- **Handle Shared State Efficiently:** Use `Arc` for shared ownership in concurrent tasks. When shared state needs mutation, prefer `tokio::sync::Mutex` over `std::sync::Mutex` in `async` code. Consider `tokio::sync::RwLock` if reads significantly outnumber writes. Minimize the duration for which locks are held.
+- **Understand `.await`:** Place `.await` strategically to allow the runtime to switch to other ready tasks. Ensure that `.await` points to genuinely asynchronous operations.
+- **Backpressure:** If dealing with data streams or queues between tasks, implement backpressure mechanisms (e.g., bounded channels like `tokio::sync::mpsc::channel`) to prevent one component from overwhelming another or critical resources like the database.
+
+## Enterprise Features
+
+- Use feature flags for enterprise functionality
+- Conditionally compile with `#[cfg(feature = "enterprise")]`
+- Isolate enterprise code in separate modules
+
+## Code Style
+
+- Group imports by external and internal crates
+- Place struct/enum definitions before implementations
+- Group similar functionality together
+- Use descriptive naming consistent with the codebase
+- Follow existing patterns for async code using tokio
+
+## Testing
+
+- Write unit tests for core functionality
+- Use the `#[cfg(test)]` module for test code
+- For database tests, use the existing test utilities
+
+## Common Crates Used
+
+- **tokio**: For async runtime
+- **axum**: For web server and routing
+- **sqlx**: For database operations
+- **serde**: For serialization/deserialization
+- **tracing**: For logging and diagnostics
+- **reqwest**: For HTTP client functionality

backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.490.0"
+version = "1.491.5"
 authors.workspace = true
 edition.workspace = true
 
@@ -32,7 +32,7 @@ members = [
 ]
 
 [workspace.package]
-version = "1.490.0"
+version = "1.491.5"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -137,6 +137,7 @@ v8 = { workspace = true, optional = true }
 rustls.workspace = true
 systemstat.workspace = true
 size.workspace = true
+strum.workspace = true
 
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
 tikv-jemallocator = { optional = true, workspace = true }
@@ -235,7 +236,7 @@ itertools = "^0"
 regex = "^1"
 semver = "^1"
 
-v8 = "=130.0.7"  # Exact version
+v8 = "=130.0.7"  # Exact version NOTE: Do not forget to update version and hash in flake.nix
 deno_fetch = "0.214.0"
 deno_tls = "0.177.0"
 deno_console = "0.190.0"
@@ -389,3 +390,5 @@ tree-sitter-c-sharp = "0.23.0"
 tree-sitter-java = "0.23.0"
 oracle = { version = "0.6.3", features = ["chrono"] }
 rumqttc = { version = "0.24.0", features = ["use-native-tls"]}
+strum = "^0"
+strum_macros = "^0"

backend/ee-repo-ref.txt

@@ -1 +1 @@
-4dc1f25f4fcc013334d4cc1d07cbe60a22b56d1f
+bea87fa885dc041fba83b2491609a4a2cdbbfa6f

backend/migrations/20250514120017_http_trigger_update_notify.down.sql

@@ -0,0 +1,4 @@
+-- Add down migration script here
+DROP TRIGGER http_trigger_change_trigger ON http_trigger;
+DROP FUNCTION notify_http_trigger_change();
+DROP SEQUENCE http_trigger_version_seq;

backend/migrations/20250514120017_http_trigger_update_notify.up.sql

@@ -0,0 +1,15 @@
+-- Add up migration script here
+CREATE OR REPLACE FUNCTION notify_http_trigger_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('notify_http_trigger_change', NEW.workspace_id || ':' || NEW.path);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+CREATE TRIGGER http_trigger_change_trigger
+AFTER INSERT OR UPDATE OR DELETE ON http_trigger
+FOR EACH ROW
+EXECUTE FUNCTION notify_http_trigger_change();
+
+CREATE SEQUENCE http_trigger_version_seq;
+

backend/migrations/20250515155403_add_grant_on_dependency_map.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20250515155403_add_grant_on_dependency_map.up.sql

@@ -0,0 +1,3 @@
+-- Add up migration script here
+GRANT ALL ON dependency_map TO windmill_user;
+GRANT ALL ON dependency_map TO windmill_admin;

backend/migrations/20250515181903_fix_http_routers_cache.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20250515181903_fix_http_routers_cache.up.sql

@@ -0,0 +1,9 @@
+-- Add up migration script here
+-- this makes sure that the first time nextval is called, 2 is returned
+-- otherwise, `SELECT last_value from http_trigger_version_seq;` would return 1 before and after the first nextval call
+-- which would not refresh the routers cache after the first create/update/delete
+SELECT setval(                                  
+    'http_trigger_version_seq',
+    (SELECT last_value FROM http_trigger_version_seq),
+    true
+);

backend/migrations/20250520104210_workspace_preprocessor_notify.down.sql

@@ -0,0 +1,12 @@
+-- Add down migration script here
+CREATE OR REPLACE FUNCTION notify_runnable_version_change()
+RETURNS TRIGGER AS $$
+DECLARE
+    source_type TEXT;
+BEGIN
+    source_type := TG_ARGV[0];
+
+    PERFORM pg_notify('notify_runnable_version_change', NEW.workspace_id || ':' || source_type || ':' || NEW.path);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;

backend/migrations/20250520104210_workspace_preprocessor_notify.up.sql

@@ -0,0 +1,19 @@
+-- Add up migration script here
+CREATE OR REPLACE FUNCTION notify_runnable_version_change()
+RETURNS TRIGGER AS $$
+DECLARE
+    source_type TEXT;
+    kind TEXT;
+BEGIN
+    source_type := TG_ARGV[0];
+
+    IF source_type = 'script' THEN
+        kind := NEW.kind;
+    ELSE
+        kind := 'flow';
+    END IF;
+
+    PERFORM pg_notify('notify_runnable_version_change', NEW.workspace_id || ':' || source_type || ':' || NEW.path || ':' || kind);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;

backend/parsers/windmill-parser-sql/src/lib.rs

@@ -120,6 +120,60 @@ pub fn parse_db_resource(code: &str) -> Option<String> {
     cap.map(|x| x.get(1).map(|x| x.as_str().to_string()).unwrap())
 }
 
+#[derive(Clone, Copy, Debug)]
+pub enum S3ModeFormat {
+    Json,
+    Csv,
+    Parquet,
+}
+pub fn s3_mode_extension(format: S3ModeFormat) -> &'static str {
+    match format {
+        S3ModeFormat::Json => "json",
+        S3ModeFormat::Csv => "csv",
+        S3ModeFormat::Parquet => "parquet",
+    }
+}
+pub struct S3ModeArgs {
+    pub prefix: Option<String>,
+    pub storage: Option<String>,
+    pub format: S3ModeFormat,
+}
+pub fn parse_s3_mode(code: &str) -> anyhow::Result<Option<S3ModeArgs>> {
+    let cap = match RE_S3_MODE.captures(code) {
+        Some(x) => x,
+        None => return Ok(None),
+    };
+    let args_str = cap
+        .get(1)
+        .map(|x| x.as_str().to_string())
+        .unwrap_or_default();
+
+    let mut prefix = None;
+    let mut storage = None;
+    let mut format = S3ModeFormat::Json;
+
+    for kv in args_str.split(' ').map(|kv| kv.trim()) {
+        if kv.is_empty() {
+            continue;
+        }
+        let mut it = kv.split('=');
+        let (Some(key), Some(value)) = (it.next(), it.next()) else {
+            return Err(anyhow!("Invalid S3 mode argument: {}", kv));
+        };
+        match (key.trim(), value.trim()) {
+            ("prefix", _) => prefix = Some(value.to_string()),
+            ("storage", _) => storage = Some(value.to_string()),
+            ("format", "json") => format = S3ModeFormat::Json,
+            ("format", "parquet") => format = S3ModeFormat::Parquet,
+            ("format", "csv") => format = S3ModeFormat::Csv,
+            ("format", format) => return Err(anyhow!("Invalid S3 mode format: {}", format)),
+            (_, _) => return Err(anyhow!("Invalid S3 mode argument: {}", kv)),
+        }
+    }
+
+    Ok(Some(S3ModeArgs { prefix, storage, format }))
+}
+
 pub fn parse_sql_blocks(code: &str) -> Vec<&str> {
     let mut blocks = vec![];
     let mut last_idx = 0;
@@ -147,6 +201,7 @@ lazy_static::lazy_static! {
     static ref RE_NONEMPTY_SQL_BLOCK: Regex = Regex::new(r#"(?m)^\s*[^\s](?:[^-]|$)"#).unwrap();
 
     static ref RE_DB: Regex = Regex::new(r#"(?m)^-- database (\S+) *(?:\r|\n|$)"#).unwrap();
+    static ref RE_S3_MODE: Regex = Regex::new(r#"(?m)^-- s3( (.+))? *(?:\r|\n|$)"#).unwrap();
 
     // -- $1 name (type) = default
     static ref RE_ARG_MYSQL: Regex = Regex::new(r#"(?m)^-- \? (\w+) \((\w+)\)(?: ?\= ?(.+))? *(?:\r|\n|$)"#).unwrap();

backend/src/main.rs

@@ -5,7 +5,6 @@
  * Please see the included NOTICE for copyright information and
  * LICENSE-AGPL for a copy of the license.
  */
-
 use anyhow::Context;
 use monitor::{
     load_base_url, load_otel, reload_critical_alerts_on_db_oversize,
@@ -23,6 +22,7 @@ use std::{
     net::{IpAddr, Ipv4Addr, SocketAddr},
     time::{Duration, Instant},
 };
+use strum::IntoEnumIterator;
 use tokio::{fs::File, io::AsyncReadExt, task::JoinHandle};
 use uuid::Uuid;
 use windmill_api::HTTP_CLIENT;
@@ -50,6 +50,7 @@ use windmill_common::{
     },
     scripts::ScriptLang,
     stats_ee::schedule_stats,
+    triggers::TriggerKind,
     utils::{hostname, rd_string, Mode, GIT_VERSION, MODE_AND_ADDONS},
     worker::{
         reload_custom_tags_setting, Connection, HUB_CACHE_DIR, TMP_DIR, TMP_LOGS_DIR, WORKER_GROUP,
@@ -791,11 +792,37 @@ Windmill Community Edition {GIT_VERSION}
                                                     let payload = n.payload();
                                                     tracing::info!("Runnable version change detected: {}", payload);
                                                     match payload.split(':').collect::<Vec<&str>>().as_slice() {
-                                                        [workspace_id, source_type, path] => {
+                                                        [workspace_id, source_type, path, kind] => {
                                                             let key = (workspace_id.to_string(), path.to_string());
                                                             match source_type {
                                                                 &"script" => {
                                                                     windmill_common::DEPLOYED_SCRIPT_HASH_CACHE.remove(&key);
+                                                                    match kind {
+                                                                        &"preprocessor" => {
+                                                                            match sqlx::query_scalar!(
+                                                                                "SELECT fv.id
+                                                                                FROM flow f
+                                                                                INNER JOIN flow_version fv ON fv.id = f.versions[array_upper(f.versions, 1)]
+                                                                                WHERE fv.value->'preprocessor_module'->'value'->>'path' = $1 AND f.workspace_id = $2",
+                                                                                path,
+                                                                                workspace_id
+                                                                            ).fetch_all(&db).await {
+                                                                                Ok(flow_versions) => {
+                                                                                    tracing::debug!("Workspace preprocessor {} changed, removing runnable format version cache for flow versions {:?}", path, flow_versions);
+                                                                                    for version in flow_versions {
+                                                                                        for trigger_kind in TriggerKind::iter() {
+                                                                                            let key = (windmill_common::triggers::HubOrWorkspaceId::WorkspaceId(workspace_id.to_string()), version, trigger_kind);
+                                                                                            windmill_common::triggers::RUNNABLE_FORMAT_VERSION_CACHE.remove(&key);
+                                                                                        }
+                                                                                    }
+                                                                                }
+                                                                                Err(e) => {
+                                                                                    tracing::error!("Error fetching flow paths: {e:#}");
+                                                                                }
+                                                                            }
+                                                                        },
+                                                                        _ => {}
+                                                                    }
                                                                 }
                                                                 &"flow" => {
                                                                     windmill_common::FLOW_VERSION_CACHE.remove(&key);
@@ -810,6 +837,21 @@ Windmill Community Edition {GIT_VERSION}
                                                         }
                                                     }
                                                 },
+                                                #[cfg(feature = "http_trigger")]
+                                                "notify_http_trigger_change" => {
+                                                    tracing::info!("HTTP trigger change detected: {}", n.payload());
+                                                    match windmill_api::http_triggers::refresh_routers(&db).await {
+                                                        Ok((true, _)) => {
+                                                            tracing::info!("Refreshed HTTP routers (trigger change)");
+                                                        },
+                                                        Ok((false, _)) => {
+                                                            tracing::warn!("Should have refreshed HTTP routers (trigger change) but did not");
+                                                        },
+                                                        Err(err) => {
+                                                            tracing::error!("Error refreshing HTTP routers (trigger change): {err:#}");
+                                                        }
+                                                    };
+                                                },
                                                 "notify_global_setting_change" => {
                                                     tracing::info!("Global setting change detected: {}", n.payload());
                                                     match n.payload() {
@@ -1133,6 +1175,10 @@ async fn listen_pg(url: &str) -> Option<PgListener> {
         "notify_workspace_envs_change",
         "notify_runnable_version_change",
     ];
+
+    #[cfg(feature = "http_trigger")]
+    channels.push("notify_http_trigger_change");
+
     #[cfg(feature = "cloud")]
     channels.push("notify_workspace_premium_change");
 

backend/src/monitor.rs

@@ -62,7 +62,11 @@ use windmill_common::{
     users::truncate_token,
     utils::{empty_as_none, now_from_db, rd_string, report_critical_error, Mode},
     worker::{
-        load_env_vars, load_init_bash_from_env, load_whitelist_env_vars_from_env, load_worker_config, reload_custom_tags_setting, store_pull_query, store_suspended_pull_query, update_min_version, Connection, WorkerConfig, DEFAULT_TAGS_PER_WORKSPACE, DEFAULT_TAGS_WORKSPACES, INDEXER_CONFIG, SCRIPT_TOKEN_EXPIRY, SMTP_CONFIG, TMP_DIR, WORKER_CONFIG, WORKER_GROUP
+        load_env_vars, load_init_bash_from_env, load_whitelist_env_vars_from_env,
+        load_worker_config, reload_custom_tags_setting, store_pull_query,
+        store_suspended_pull_query, update_min_version, Connection, WorkerConfig,
+        DEFAULT_TAGS_PER_WORKSPACE, DEFAULT_TAGS_WORKSPACES, INDEXER_CONFIG, SCRIPT_TOKEN_EXPIRY,
+        SMTP_CONFIG, TMP_DIR, WORKER_CONFIG, WORKER_GROUP,
     },
     KillpillSender, BASE_URL, CRITICAL_ALERTS_ON_DB_OVERSIZE, CRITICAL_ALERT_MUTE_UI_ENABLED,
     CRITICAL_ERROR_CHANNELS, DB, DEFAULT_HUB_BASE_URL, HUB_BASE_URL, JOB_RETENTION_SECS,
@@ -829,11 +833,7 @@ pub async fn delete_expired_items(db: &DB) -> () {
             Ok(mut tx) => {
                 let deleted_jobs = sqlx::query_scalar!(
                     "DELETE FROM v2_job_completed c
-                    USING v2_job j
-                    WHERE
-                        created_at <= now() - ($1::bigint::text || ' s')::interval
-                        AND completed_at + ($1::bigint::text || ' s')::interval <= now()
-                        AND c.id = j.id
+                    WHERE completed_at <= now() - ($1::bigint::text || ' s')::interval 
                     RETURNING c.id",
                     job_retention_secs
                 )
@@ -1122,10 +1122,13 @@ pub async fn reload_s3_cache_setting(db: &DB) {
             if let Err(e) = setting {
                 tracing::error!("Error parsing s3 cache config: {:?}", e)
             } else {
-                let s3_client = build_object_store_from_settings(setting.unwrap()).await;
+                let setting = setting.unwrap();
+                let bucket = setting.get_bucket().map(|b| b.to_string());
+                let s3_client = build_object_store_from_settings(setting).await;
                 if let Err(e) = s3_client {
                     tracing::error!("Error building s3 client from settings: {:?}", e)
                 } else {
+                    tracing::info!("Loaded object store {:?}", bucket);
                     *s3_cache_settings = Some(s3_client.unwrap());
                 }
             }

backend/windmill-api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.490.0
+  version: 1.491.5
   title: Windmill API
 
   contact:
@@ -7899,6 +7899,52 @@ paths:
         "200":
           description: Interactive slack approval message sent successfully
 
+  /w/{workspace}/jobs/teams_approval/{id}:
+    get:
+      summary: generate interactive teams approval for suspended job
+      operationId: getTeamsApprovalPayload
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/JobId"
+        - name: approver
+          in: query
+          schema:
+            type: string
+        - name: message
+          in: query
+          schema:
+            type: string
+        - name: team_name
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: channel_name
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: flow_step_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: default_args_json
+          in: query
+          required: false
+          schema:
+            type: string
+        - name: dynamic_enums_json
+          in: query
+          required: false
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Interactive slack approval message sent successfully
+
   /w/{workspace}/jobs_u/resume/{id}/{resume_id}/{signature}:
     get:
       summary: resume a job for a suspended flow
@@ -10982,7 +11028,8 @@ paths:
           description: a config
           content:
             application/json:
-              schema: {}
+              schema:
+                $ref: "#/components/schemas/Configs"
 
   /configs/update/{name}:
     post:
@@ -12543,6 +12590,11 @@ paths:
           required: true
           schema:
             type: string
+        - name: pagination_offset
+          in: query
+          required: false
+          schema:
+            type: integer
       responses:
         "200":
           description: search results
@@ -12555,15 +12607,26 @@ paths:
                     description: a list of the terms that couldn't be parsed (and thus ignored)
                     type: array
                     items:
-                      type: object
-                      properties:
-                        dancer:
-                          type: string
+                      type: string
                   hits:
                     description: the jobs that matched the query
                     type: array
                     items:
                       $ref: "#/components/schemas/JobSearchHit"
+                  hit_count:
+                    description: how many jobs matched in total
+                    type: number
+                  index_metadata:
+                    description: Metadata about the index current state
+                    type: object
+                    properties:
+                      indexed_until:
+                        description: Datetime of the most recently indexed job
+                        type: string
+                        format: date-time
+                      lost_lock_ownership:
+                        description: Is the current indexer service being replaced
+                        type: boolean
 
   /srch/index/search/service_logs:
     get:
@@ -13137,6 +13200,37 @@ components:
         code_completion_model:
           $ref: "#/components/schemas/AIProviderModel"
 
+    Alert:
+      type: object
+      properties:
+        name:
+          type: string
+        tags_to_monitor:
+          type: array
+          items:
+            type: string
+        jobs_num_threshold:
+          type: integer
+        alert_cooldown_seconds:
+          type: integer
+        alert_time_threshold_seconds:
+          type: integer
+      required:
+        - name
+        - tags_to_monitor
+        - jobs_num_threshold
+        - alert_cooldown_seconds
+        - alert_time_threshold_seconds
+
+    Configs:
+      type: object
+      nullable: true
+      properties:
+        alerts:
+          type: array
+          items:
+            $ref: '#/components/schemas/Alert'
+
     Script:
       type: object
       properties:
@@ -16238,6 +16332,7 @@ components:
               - schedule
               - user
               - group
+              - trigger
         repositories:
           type: array
           items:
@@ -16305,6 +16400,7 @@ components:
               - schedule
               - user
               - group
+              - trigger
       required:
         - script_path
         - git_repo_resource_path
@@ -16730,4 +16826,4 @@ components:
         channel_name:
           type: string
           description: Microsoft Teams channel name
-          minLength: 1
+          minLength: 1

backend/windmill-api/src/agent_workers_ee.rs

@@ -28,7 +28,7 @@ pub fn workspaced_service(
     use windmill_worker::JobCompletedSender;
 
     let (job_completed_tx, _job_completed_rx) =
-        JobCompletedSender::new(&Connection::Sql(db.clone()), 100);
+        JobCompletedSender::new(&Connection::Sql(db.clone()), 10);
 
     let router = Router::new();
 

backend/windmill-api/src/approvals.rs

@@ -0,0 +1,292 @@
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use uuid::Uuid;
+use std::str::FromStr;
+use regex::Regex;
+use serde_json::Value;
+use crate::db::{ApiAuthed, DB};
+use crate::jobs::{cancel_suspended_job, resume_suspended_job, QueryApprover, QueryOrBody, ResumeUrls, get_resume_urls_internal};
+use axum::{extract::{Path, Query}, Extension};
+use windmill_common::error::Error;
+use windmill_common::cache;
+use windmill_common::jobs::JobKind;
+use windmill_common::scripts::ScriptHash;
+use serde_json::value::RawValue;
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct ResumeSchema {
+    pub schema: Schema,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct Schema {
+    pub order: Vec<String>,
+    pub required: Vec<String>,
+    pub properties: HashMap<String, ResumeFormField>,
+}
+
+#[derive(Debug, Deserialize, Serialize, Clone)]
+#[serde(rename_all = "lowercase")]
+pub enum FieldType {
+    Boolean,
+    String,
+    Number,
+    Integer,
+    #[serde(other)]
+    Unknown,
+}
+
+#[derive(Debug, Deserialize, Serialize, Clone)]
+pub struct ResumeFormField {
+    pub r#type: FieldType,
+    pub format: Option<String>,
+    pub default: Option<serde_json::Value>,
+    pub description: Option<String>,
+    pub title: Option<String>,
+    pub r#enum: Option<Vec<String>>,
+    #[serde(rename = "enumLabels")]
+    pub enum_labels: Option<HashMap<String, String>>,
+    pub nullable: Option<bool>,
+    pub placeholder: Option<String>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct ResumeFormRow {
+    pub resume_form: Option<serde_json::Value>,
+    pub hide_cancel: Option<bool>,
+}
+
+#[derive(Deserialize)]
+pub struct QueryMessage {
+    pub message: Option<String>,
+}
+
+#[derive(Deserialize)]
+pub struct QueryFlowStepId {
+    pub flow_step_id: String,
+}
+
+#[derive(Deserialize, Debug)]
+pub struct QueryDefaultArgsJson {
+    pub default_args_json: Option<serde_json::Value>,
+}
+
+#[derive(Deserialize, Debug)]
+pub struct QueryDynamicEnumJson {
+    pub dynamic_enums_json: Option<serde_json::Value>,
+}
+
+#[derive(Debug)]
+pub struct ApprovalFormDetails {
+    pub message_str: String,
+    pub urls: ResumeUrls,
+    pub schema: Option<ResumeFormRow>,
+}
+
+#[allow(dead_code)]
+#[derive(Debug, Clone, Copy)]
+pub enum MessageFormat {
+    Slack,
+    Teams,
+}
+
+pub fn extract_w_id_from_resume_url(resume_url: &str) -> Result<&str, Error> {
+    let re = Regex::new(r"/api/w/(?P<w_id>[^/]+)/jobs_u/(?P<action>resume|cancel)/(?P<job_id>[^/]+)/(?P<resume_id>[^/]+)/(?P<secret>[a-fA-F0-9]+)(?:\?approver=(?P<approver>[^&]+))?").unwrap();
+    let captures = re.captures(resume_url).ok_or_else(|| {
+        tracing::error!("Resume URL does not match the pattern.");
+        Error::BadRequest("Invalid URL format.".to_string())
+    })?;
+    Ok(captures.name("w_id").map_or("", |m| m.as_str()))
+}
+
+pub async fn handle_resume_action(
+    authed: Option<ApiAuthed>,
+    db: DB,
+    resume_url: &str,
+    form_data: Value,
+    action: &str,
+) -> Result<(), Error> {
+    // Extract information from resume_url using regex
+    let re = Regex::new(r"/api/w/(?P<w_id>[^/]+)/jobs_u/(?P<action>resume|cancel)/(?P<job_id>[^/]+)/(?P<resume_id>[^/]+)/(?P<secret>[a-fA-F0-9]+)(?:\?approver=(?P<approver>[^&]+))?").unwrap();
+    let captures = re.captures(resume_url).ok_or_else(|| {
+        tracing::error!("Resume URL does not match the pattern.");
+        Error::BadRequest("Invalid URL format.".to_string())
+    })?;
+
+    let (w_id, job_id, resume_id, secret, approver) = (
+        captures.name("w_id").map_or("", |m| m.as_str()),
+        captures.name("job_id").map_or("", |m| m.as_str()),
+        captures.name("resume_id").map_or("", |m| m.as_str()),
+        captures.name("secret").map_or("", |m| m.as_str()),
+        captures.name("approver").map(|m| m.as_str().to_string()),
+    );
+
+    let approver = QueryApprover { approver };
+
+    // Convert job_id and resume_id to appropriate types
+    let job_uuid = Uuid::from_str(job_id)
+        .map_err(|_| Error::BadRequest("Invalid job ID format.".to_string()))?;
+
+    let resume_id_parsed = resume_id
+        .parse::<u32>()
+        .map_err(|_| Error::BadRequest("Invalid resume ID format.".to_string()))?;
+
+    // Call the appropriate function based on the action
+    let res = if action == "resume" {
+        resume_suspended_job(
+            authed,
+            Extension(db.clone()),
+            Path((
+                w_id.to_string(),
+                job_uuid,
+                resume_id_parsed,
+                secret.to_string(),
+            )),
+            Query(approver),
+            QueryOrBody(Some(form_data)),
+        )
+        .await
+    } else {
+        cancel_suspended_job(
+            authed,
+            Extension(db.clone()),
+            Path((
+                w_id.to_string(),
+                job_uuid,
+                resume_id_parsed,
+                secret.to_string(),
+            )),
+            Query(approver),
+            QueryOrBody(Some(form_data)),
+        )
+        .await
+    };
+
+    tracing::debug!("Job action result: {:#?}", res);
+    res?;
+
+    Ok(())
+}
+
+pub async fn get_approval_form_details(
+    db: DB,
+    w_id: &str,
+    job_id: Uuid,
+    flow_step_id: Option<&str>,
+    resume_id: u32,
+    approver: Option<&str>,
+    message: Option<&str>,
+    format: MessageFormat,
+) -> Result<ApprovalFormDetails, Error> {
+    let res = get_resume_urls_internal(
+        axum::Extension(db.clone()),
+        Path((w_id.to_string(), job_id, resume_id)),
+        Query(QueryApprover { approver: approver.map(|a| a.to_string()) }),
+    )
+    .await?;
+
+    let urls = res.0;
+
+    tracing::debug!("Job ID: {:?}", job_id);
+
+    // TODO: do we have a helper function for this?
+    let (job_kind, script_hash, raw_flow, parent_job_id, created_at, created_by, script_path, args) = sqlx::query!(
+        "WITH job_info AS (
+            -- Query for Teams (running jobs)
+            SELECT
+                parent.job_kind AS \"job_kind!: JobKind\",
+                parent.script_hash AS \"script_hash: ScriptHash\",
+                parent.raw_flow AS \"raw_flow: sqlx::types::Json<Box<RawValue>>\",
+                child.parent_job AS \"parent_job: Uuid\",
+                parent.created_at AS \"created_at!: chrono::NaiveDateTime\",
+                parent.created_by AS \"created_by!\",
+                parent.script_path,
+                parent.args AS \"args: sqlx::types::Json<Box<RawValue>>\"
+            FROM v2_as_queue child
+            JOIN v2_as_queue parent ON parent.id = child.parent_job
+            WHERE child.id = $1 AND child.workspace_id = $2
+            UNION ALL
+            -- Query for Slack (completed jobs)
+            SELECT
+                v2_as_queue.job_kind AS \"job_kind!: JobKind\",
+                v2_as_queue.script_hash AS \"script_hash: ScriptHash\",
+                v2_as_queue.raw_flow AS \"raw_flow: sqlx::types::Json<Box<RawValue>>\",
+                v2_as_completed_job.parent_job AS \"parent_job: Uuid\",
+                v2_as_completed_job.created_at AS \"created_at!: chrono::NaiveDateTime\",
+                v2_as_completed_job.created_by AS \"created_by!\",
+                v2_as_queue.script_path,
+                v2_as_queue.args AS \"args: sqlx::types::Json<Box<RawValue>>\"
+            FROM v2_as_queue
+            JOIN v2_as_completed_job ON v2_as_completed_job.parent_job = v2_as_queue.id
+            WHERE v2_as_completed_job.id = $1 AND v2_as_completed_job.workspace_id = $2
+        )
+        SELECT * FROM job_info LIMIT 1",
+        job_id,
+        &w_id
+    )
+    .fetch_optional(&db)
+    .await
+    .map_err(|e| Error::BadRequest(e.to_string()))?
+    .ok_or_else(|| Error::BadRequest("This workflow is no longer running and has either already timed out or been cancelled or completed.".to_string()))
+    .map(|r| (r.job_kind, r.script_hash, r.raw_flow, r.parent_job, r.created_at, r.created_by, r.script_path, r.args))?;
+
+    let flow_data = match cache::job::fetch_flow(&db, job_kind, script_hash).await {
+        Ok(data) => data,
+        Err(_) => {
+            if let Some(parent_job_id) = parent_job_id.as_ref() {
+                cache::job::fetch_preview_flow(&db, parent_job_id, raw_flow).await?
+            } else {
+                return Err(Error::BadRequest(
+                    "This workflow is no longer running and has either already timed out or been cancelled or completed.".to_string(),
+                ));
+            }
+        }
+    };
+
+    let flow_value = &flow_data.flow;
+    let flow_step_id = flow_step_id.unwrap_or("");
+    let module = flow_value.modules.iter().find(|m| m.id == flow_step_id);
+
+    tracing::debug!("Module: {:#?}", module);
+
+    let schema = module.and_then(|module| {
+        module.suspend.as_ref().map(|suspend| ResumeFormRow {
+            resume_form: suspend.resume_form.clone(),
+            hide_cancel: suspend.hide_cancel,
+        })
+    });
+
+    let args_str = args.map_or("None".to_string(), |a| a.get().to_string());
+    let parent_job_id_str = parent_job_id.map_or("None".to_string(), |id| id.to_string());
+    let script_path_str = script_path.as_deref().unwrap_or("None");
+
+    let created_at_formatted = created_at.format("%Y-%m-%d %H:%M:%S").to_string();
+
+    let bold_format = match format {
+        MessageFormat::Slack => "*{}*",
+        MessageFormat::Teams => "**{}**",
+    };
+
+    let mut message_str = format!(
+        "A workflow has been suspended and is waiting for approval:\n\n\
+        {}: {created_by}\n\n\
+        {}: {created_at_formatted}\n\n\
+        {}: {script_path_str}\n\n\
+        {}: {args_str}\n\n\
+        {}: {parent_job_id_str}\n\n",
+        bold_format.replace("{}", "Created by"),
+        bold_format.replace("{}", "Created at"),
+        bold_format.replace("{}", "Script path"),
+        bold_format.replace("{}", "Args"),
+        bold_format.replace("{}", "Flow ID")
+    );
+
+    // Append custom message if provided
+    if let Some(msg) = message {
+        message_str.push_str(msg);
+    }
+
+    tracing::debug!("Schema: {:#?}", schema);
+
+    Ok(ApprovalFormDetails { message_str, urls, schema })
+}

backend/windmill-api/src/args.rs

@@ -10,12 +10,17 @@ use http::{header::CONTENT_TYPE, request::Parts, StatusCode};
 use serde::{Deserialize, Serialize};
 use serde_json::value::RawValue;
 use sqlx::types::JsonRawValue;
-use windmill_common::{error::Error, worker::to_raw_value, DB};
-use windmill_queue::{PushArgsOwned, TriggerKind};
+use windmill_common::{
+    error::Error,
+    triggers::{RunnableFormat, RunnableFormatVersion, TriggerKind},
+    worker::to_raw_value,
+    DB,
+};
+use windmill_queue::PushArgsOwned;
 
 use crate::{
     db::ApiAuthed,
-    trigger_helpers::{get_runnable_format, RunnableFormat, RunnableFormatVersion, RunnableId},
+    trigger_helpers::{get_runnable_format, RunnableId},
 };
 
 #[derive(Debug)]
@@ -29,14 +34,14 @@ pub enum RawBody {
     Empty,
 }
 
-#[derive(Clone, Serialize)]
+#[derive(Debug, Clone, Serialize)]
 #[serde(untagged)]
 pub enum Body {
     HashMap(HashMap<String, Box<RawValue>>),
     NoHashMap(Box<RawValue>),
 }
 
-#[derive(Clone, Default)]
+#[derive(Debug, Clone, Default)]
 pub struct WebhookArgsMetadata {
     pub raw_string: Option<String>,
     pub headers: HashMap<String, Box<RawValue>>,
@@ -51,7 +56,7 @@ pub struct RawWebhookArgs {
     pub metadata: WebhookArgsMetadata,
 }
 
-#[derive(Clone)]
+#[derive(Debug, Clone)]
 pub struct WebhookArgs {
     pub body: Body,
     pub metadata: WebhookArgsMetadata,

backend/windmill-api/src/capture.rs

@@ -14,11 +14,18 @@ use {
 };
 
 #[cfg(all(feature = "enterprise", feature = "gcp_trigger"))]
-use crate::gcp_triggers_ee::{
-    manage_google_subscription, process_google_push_request, validate_jwt_token,
-    CreateUpdateConfig, SubscriptionMode,
+use {
+    crate::gcp_triggers_ee::{
+        manage_google_subscription, process_google_push_request, validate_jwt_token,
+        CreateUpdateConfig, SubscriptionMode,
+    },
+    axum::extract::Request,
+    http::HeaderMap,
 };
 
+#[cfg(all(feature = "enterprise", feature = "gcp_trigger"))]
+use windmill_common::utils::empty_as_none;
+
 #[cfg(all(feature = "enterprise", feature = "sqs_trigger"))]
 use windmill_common::auth::aws::AwsAuthResourceType;
 
@@ -26,12 +33,7 @@ use windmill_common::auth::aws::AwsAuthResourceType;
     feature = "http_trigger",
     all(feature = "enterprise", feature = "gcp_trigger")
 ))]
-use {
-    axum::extract::Request,
-    http::HeaderMap,
-    serde::de::DeserializeOwned,
-    windmill_common::{error::Error, utils::empty_as_none},
-};
+use {serde::de::DeserializeOwned, windmill_common::error::Error};
 
 #[cfg(all(feature = "enterprise", feature = "kafka"))]
 use crate::kafka_triggers_ee::KafkaTriggerConfigConnection;
@@ -55,7 +57,6 @@ use {
 use crate::{
     args::RawWebhookArgs,
     db::{ApiAuthed, DB},
-    trigger_helpers::{RunnableFormat, RunnableFormatVersion},
     users::fetch_api_authed,
     utils::RunnableKind,
 };
@@ -74,11 +75,12 @@ use sqlx::types::Json as SqlxJson;
 use windmill_common::{
     db::UserDB,
     error::{JsonResult, Result},
+    triggers::{RunnableFormat, RunnableFormatVersion, TriggerKind},
     utils::{not_found_if_none, paginate, Pagination, StripPath},
     worker::{to_raw_value, CLOUD_HOSTED},
 };
 
-use windmill_queue::{PushArgs, PushArgsOwned, TriggerKind};
+use windmill_queue::{PushArgs, PushArgsOwned};
 
 const KEEP_LAST: i64 = 20;
 
@@ -381,6 +383,7 @@ async fn set_gcp_trigger_config(
         gcp_config.subscription_mode,
         gcp_config.create_update,
         false,
+        capture_config.is_flow,
     )
     .await?;
     gcp_config.create_update = Some(config);

backend/windmill-api/src/db.rs

@@ -782,10 +782,32 @@ async fn fix_job_completed_index(db: &DB) -> Result<(), Error> {
         .execute(db)
         .await?;
     });
+
+    run_windmill_migration!("job_completed_completed_at", db, |tx| {
+        sqlx::query!(
+            "CREATE INDEX CONCURRENTLY IF NOT EXISTS ix_job_completed_completed_at ON v2_job_completed (completed_at DESC)"
+        )
+        .execute(db)
+        .await?;
+    });
+
+    run_windmill_migration!("alerts_by_workspace", db, |tx| {
+        sqlx::query!(
+            "CREATE INDEX CONCURRENTLY IF NOT EXISTS alerts_by_workspace ON alerts (workspace_id);"
+        )
+        .execute(db)
+        .await?;
+    });
+
+    run_windmill_migration!("remove_redundant_log_file_index", db, |tx| {
+        sqlx::query!("DROP INDEX CONCURRENTLY IF EXISTS log_file_hostname_log_ts_idx")
+            .execute(db)
+            .await?;
+    });
     Ok(())
 }
 
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, Hash, Eq, PartialEq)]
 pub struct ApiAuthed {
     pub email: String,
     pub username: String,

backend/windmill-api/src/gcp_triggers_ee.rs

@@ -11,9 +11,9 @@ use windmill_common::db::UserDB;
 use windmill_common::worker::to_raw_value;
 use windmill_common::{
     error::{Error as WindmillError, Result as WindmillResult},
+    triggers::TriggerKind,
     utils::empty_as_none,
 };
-use windmill_queue::TriggerKind;
 
 #[derive(sqlx::Type, Debug, Deserialize, Serialize)]
 #[serde(rename_all(serialize = "lowercase", deserialize = "lowercase"))]
@@ -86,6 +86,7 @@ pub async fn manage_google_subscription(
     _subscription_mode: SubscriptionMode,
     _create_update_config: Option<CreateUpdateConfig>,
     _trigger_mode: bool,
+    _is_flow: bool,
 ) -> WindmillResult<CreateUpdateConfig> {
     Ok(CreateUpdateConfig::default())
 }

backend/windmill-api/src/http_trigger_args.rs

@@ -6,18 +6,22 @@ use axum::{
 };
 use serde::{Deserialize, Serialize};
 use serde_json::value::RawValue;
-use windmill_common::{error::Error, worker::to_raw_value, DB};
+use windmill_common::{
+    error::Error,
+    triggers::{RunnableFormat, RunnableFormatVersion},
+    worker::to_raw_value,
+    DB,
+};
 use windmill_queue::PushArgsOwned;
 
 use crate::{
     args::{try_from_request_body, Body, RawWebhookArgs, WebhookArgs, WebhookArgsMetadata},
     db::ApiAuthed,
-    trigger_helpers::{RunnableFormat, RunnableFormatVersion},
 };
 
 pub struct RawHttpTriggerArgs(pub RawWebhookArgs);
 
-#[derive(Serialize, Deserialize, sqlx::Type, Debug)]
+#[derive(Serialize, Deserialize, sqlx::Type, Debug, Clone, Hash, Eq, PartialEq)]
 #[sqlx(type_name = "HTTP_METHOD", rename_all = "lowercase")]
 #[serde(rename_all = "lowercase")]
 pub enum HttpMethod {
@@ -56,7 +60,7 @@ where
     }
 }
 
-#[derive(Clone)]
+#[derive(Debug, Clone)]
 pub struct HttpTriggerArgs(pub WebhookArgs);
 
 impl RawHttpTriggerArgs {

backend/windmill-api/src/http_trigger_auth.rs

@@ -414,7 +414,7 @@ pub enum Encoding {
     Base64Uri,
     Hex,
 }
-#[derive(Debug, Serialize, Deserialize)]
+#[derive(Debug, Serialize, Deserialize, Clone)]
 pub struct SignatureAuthenticationMethod {
     algorithm: HmacAlgorithm,
     encoding: Encoding,
@@ -426,20 +426,20 @@ pub struct SignatureConfigData<'config> {
     secret_key: &'config str,
 }
 
-#[derive(Debug, Serialize, Deserialize)]
+#[derive(Debug, Serialize, Deserialize, Clone)]
 pub struct SignatureAuthentication {
     signature_provider: WebhookType,
     secret_key: String,
     authentication_config: Option<SignatureAuthenticationMethod>,
 }
 
-#[derive(Debug, Serialize, Deserialize)]
+#[derive(Debug, Serialize, Deserialize, Clone)]
 pub struct BasicAuthAuthentication {
     pub username: String,
     pub password: String,
 }
 
-#[derive(Debug, Serialize, Deserialize)]
+#[derive(Debug, Serialize, Deserialize, Clone)]
 pub struct ApiKeyAuthentication {
     api_key_header: String,
     api_key_secret: String,
@@ -558,7 +558,7 @@ pub fn verify_hmac_signature(
     Ok(())
 }
 
-#[derive(Debug, Serialize, Deserialize)]
+#[derive(Debug, Serialize, Deserialize, Clone)]
 #[serde(untagged)]
 pub enum AuthenticationMethod {
     Signature(SignatureAuthentication),

backend/windmill-api/src/http_triggers.rs

@@ -4,7 +4,7 @@ use crate::http_trigger_args::{HttpMethod, RawHttpTriggerArgs};
 use crate::job_helpers_ee::get_workspace_s3_resource;
 use crate::resources::try_get_resource_from_db_as;
 use crate::trigger_helpers::{get_runnable_format, RunnableId};
-use crate::utils::non_empty_str;
+use crate::utils::{non_empty_str, ExpiringCacheEntry};
 use crate::{
     auth::{AuthCache, OptTokened},
     db::{ApiAuthed, DB},
@@ -24,11 +24,14 @@ use axum::{
 #[cfg(feature = "parquet")]
 use http::header::IF_NONE_MATCH;
 use http::{HeaderMap, StatusCode};
+use quick_cache::sync::Cache;
 use serde::{Deserialize, Serialize};
 use sql_builder::{bind::Bind, SqlBuilder};
 use sqlx::prelude::FromRow;
+use sqlx::PgTransaction;
 use std::borrow::Cow;
 use std::{collections::HashMap, sync::Arc};
+use tokio::sync::{RwLock, RwLockReadGuard};
 use tower_http::cors::CorsLayer;
 use windmill_audit::{audit_ee::audit_log, ActionKind};
 use windmill_common::error::Error;
@@ -38,10 +41,11 @@ use windmill_common::{
     db::UserDB,
     error::{self, JsonResult},
     s3_helpers::S3Object,
+    triggers::TriggerKind,
     utils::{not_found_if_none, paginate, require_admin, Pagination, StripPath},
     worker::CLOUD_HOSTED,
 };
-use windmill_queue::TriggerKind;
+use windmill_git_sync::handle_deployment_metadata;
 
 lazy_static::lazy_static! {
     static ref ROUTE_PATH_KEY_RE: regex::Regex = regex::Regex::new(r"/?:[-\w]+").unwrap();
@@ -283,6 +287,16 @@ fn validate_authentication_method(
     Ok(())
 }
 
+async fn increase_trigger_version_and_commit(mut tx: PgTransaction<'_>) -> error::Result<()> {
+    sqlx::query!("SELECT nextval('http_trigger_version_seq')",)
+        .fetch_one(&mut *tx)
+        .await?;
+
+    tx.commit().await?;
+
+    Ok(())
+}
+
 async fn create_trigger(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -382,7 +396,18 @@ async fn create_trigger(
     )
     .await?;
 
-    tx.commit().await?;
+    increase_trigger_version_and_commit(tx).await?;
+
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        windmill_git_sync::DeployedObject::HttpTrigger { path: ct.path.clone() },
+        Some(format!("HTTP trigger '{}' created", ct.path)),
+        true,
+    )
+    .await?;
 
     Ok((StatusCode::CREATED, format!("{}", ct.path)))
 }
@@ -531,20 +556,32 @@ async fn update_trigger(
         &mut *tx,
         &authed,
         "http_triggers.update",
-        ActionKind::Create,
+        ActionKind::Update,
         &w_id,
-        Some(path),
+        Some(&ct.path),
         None,
     )
     .await?;
 
-    tx.commit().await?;
+    increase_trigger_version_and_commit(tx).await?;
 
-    Ok(path.to_string())
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        windmill_git_sync::DeployedObject::HttpTrigger { path: ct.path.clone() },
+        Some(format!("HTTP trigger '{}' updated", ct.path)),
+        true,
+    )
+    .await?;
+
+    Ok(ct.path.to_string())
 }
 
 async fn delete_trigger(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
 ) -> error::Result<String> {
@@ -572,7 +609,18 @@ async fn delete_trigger(
     )
     .await?;
 
-    tx.commit().await?;
+    increase_trigger_version_and_commit(tx).await?;
+
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        windmill_git_sync::DeployedObject::HttpTrigger { path: path.to_string() },
+        Some(format!("HTTP trigger '{}' deleted", path)),
+        true,
+    )
+    .await?;
 
     Ok(format!("HTTP trigger {path} deleted"))
 }
@@ -685,8 +733,8 @@ async fn exists_route(
     Ok(Json(exists))
 }
 
-#[derive(Debug, Deserialize)]
-struct TriggerRoute {
+#[derive(Debug, Deserialize, Clone)]
+pub struct TriggerRoute {
     path: String,
     script_path: String,
     is_flow: bool,
@@ -704,6 +752,145 @@ struct TriggerRoute {
     raw_string: bool,
 }
 
+pub struct RoutersCache {
+    routers: HashMap<HttpMethod, matchit::Router<TriggerRoute>>,
+    version: i64,
+}
+
+lazy_static::lazy_static! {
+    static ref HTTP_ACCESS_CACHE: Cache<(String, String, ApiAuthed), ExpiringCacheEntry<()>> = Cache::new(100);
+    static ref HTTP_AUTH_CACHE: Cache<(String, String, ApiAuthed), ExpiringCacheEntry<crate::http_trigger_auth::AuthenticationMethod>> = Cache::new(100);
+
+    static ref HTTP_ROUTERS_CACHE: RwLock<RoutersCache> = RwLock::new(RoutersCache {
+        routers: HashMap::new(),
+        version: 0,
+    });
+}
+
+pub async fn refresh_routers_loop(
+    db: &DB,
+    mut killpill_rx: tokio::sync::broadcast::Receiver<()>,
+) -> () {
+    match refresh_routers(db).await {
+        Ok(_) => {
+            tracing::info!("Loaded HTTP routers");
+        }
+        Err(err) => {
+            tracing::error!("Error loading HTTP routers: {err:#}");
+        }
+    };
+    let db = db.clone();
+    tokio::spawn(async move {
+        loop {
+            tokio::select! {
+                _ = killpill_rx.recv() => {
+                    break;
+                }
+                _ = tokio::time::sleep(std::time::Duration::from_secs(60)) => {
+                    match refresh_routers(&db).await {
+                        Ok((true, _)) => {
+                            tracing::info!("Refreshed HTTP routers");
+                        }
+                        Err(err) => {
+                            tracing::error!("Error refreshing HTTP routers: {err:#}");
+                        }
+                        _ => {}
+                    }
+                }
+            }
+        }
+    });
+}
+
+pub async fn refresh_routers(db: &DB) -> Result<(bool, RwLockReadGuard<'_, RoutersCache>), Error> {
+    let version = sqlx::query_scalar!("SELECT last_value FROM http_trigger_version_seq",)
+        .fetch_one(db)
+        .await?;
+    let routers_cache = HTTP_ROUTERS_CACHE.read().await;
+    if routers_cache.version == 0 || version > routers_cache.version {
+        drop(routers_cache);
+        let mut routers = HashMap::new();
+
+        for http_method in [
+            HttpMethod::Get,
+            HttpMethod::Post,
+            HttpMethod::Put,
+            HttpMethod::Patch,
+            HttpMethod::Delete,
+        ] {
+            let triggers = sqlx::query_as!(
+                TriggerRoute,
+                r#"
+                    SELECT 
+                        path, 
+                        script_path, 
+                        is_flow, 
+                        route_path, 
+                        authentication_resource_path,
+                        workspace_id, 
+                        is_async, 
+                        authentication_method  AS "authentication_method: _", 
+                        edited_by, 
+                        email, 
+                        static_asset_config AS "static_asset_config: _",
+                        wrap_body,
+                        raw_string,
+                        workspaced_route,
+                        is_static_website
+                    FROM 
+                        http_trigger 
+                    WHERE 
+                        http_method = $1
+                    "#,
+                &http_method as &HttpMethod
+            )
+            .fetch_all(db)
+            .await?;
+
+            let mut router = matchit::Router::new();
+
+            for trigger in triggers {
+                let full_path = if trigger.workspaced_route || *CLOUD_HOSTED {
+                    format!("/{}/{}", trigger.workspace_id, trigger.route_path)
+                } else {
+                    format!("/{}", trigger.route_path)
+                };
+
+                if trigger.is_static_website {
+                    router
+                        .insert(format!("{}/*wm_subpath", full_path), trigger.clone())
+                        .unwrap_or_else(|e| {
+                            tracing::warn!(
+                                "Failed to consider http trigger route {}/*wm_subpath: {:?}",
+                                full_path,
+                                e,
+                            );
+                        });
+                }
+                router
+                    .insert(full_path.clone(), trigger.clone())
+                    .unwrap_or_else(|e| {
+                        tracing::warn!(
+                            "Failed to consider http trigger route {}: {:?}",
+                            full_path,
+                            e,
+                        );
+                    });
+            }
+
+            routers.insert(http_method, router);
+        }
+
+        let mut routers_cache = HTTP_ROUTERS_CACHE.write().await;
+        *routers_cache = RoutersCache { routers, version };
+
+        Ok((true, routers_cache.downgrade()))
+    } else {
+        tracing::debug!("No HTTP routers refresh needed");
+        Ok((false, routers_cache))
+    }
+}
+
 async fn get_http_route_trigger(
     route_path: &str,
     auth_cache: &Arc<AuthCache>,
@@ -713,111 +900,30 @@ async fn get_http_route_trigger(
     method: &http::Method,
 ) -> error::Result<(TriggerRoute, String, HashMap<String, String>, ApiAuthed)> {
     let http_method: HttpMethod = method.try_into()?;
-    let (mut triggers, route_path) = if *CLOUD_HOSTED {
-        let mut splitted = route_path.split("/");
-        let w_id = splitted.next().ok_or_else(|| {
-            error::Error::BadRequest("Missing workspace id in route path".to_string())
-        })?;
-        let route_path = StripPath(splitted.collect::<Vec<_>>().join("/"));
-        let triggers = sqlx::query_as!(
-            TriggerRoute,
-            r#"
-            SELECT 
-                path, 
-                script_path, 
-                is_flow, 
-                route_path, 
-                workspace_id, 
-                is_async, 
-                authentication_method  AS "authentication_method: _", 
-                edited_by, 
-                email,
-                static_asset_config AS "static_asset_config: _",
-                wrap_body,
-                raw_string,
-                workspaced_route,
-                is_static_website,
-                authentication_resource_path
-            FROM 
-                http_trigger 
-            WHERE 
-                workspace_id = $1 AND 
-                http_method = $2
-            "#,
-            w_id,
-            http_method as HttpMethod
-        )
-        .fetch_all(db)
-        .await?;
-        (triggers, route_path)
+
+    let requested_path = format!("/{}", route_path);
+
+    let routers_cache = HTTP_ROUTERS_CACHE.read().await;
+
+    let routers_cache = if routers_cache.routers.is_empty() {
+        tracing::warn!("HTTP routers are not loaded, loading from db");
+        let (_, routers_cache) = refresh_routers(db).await?;
+        routers_cache
     } else {
-        let triggers = sqlx::query_as!(
-            TriggerRoute,
-            r#"
-            SELECT 
-                path, 
-                script_path, 
-                is_flow, 
-                route_path, 
-                authentication_resource_path,
-                workspace_id, 
-                is_async, 
-                authentication_method  AS "authentication_method: _", 
-                edited_by, 
-                email, 
-                static_asset_config AS "static_asset_config: _",
-                wrap_body,
-                raw_string,
-                workspaced_route,
-                is_static_website
-            FROM 
-                http_trigger 
-            WHERE 
-                http_method = $1
-            "#,
-            http_method as HttpMethod
-        )
-        .fetch_all(db)
-        .await?;
-        (triggers, StripPath(route_path.to_string()))
+        routers_cache
     };
 
-    let mut router = matchit::Router::new();
+    let router = routers_cache
+        .routers
+        .get(&http_method)
+        .ok_or(error::Error::internal_err(
+            "HTTP routers could not be loaded".to_string(),
+        ))?;
 
-    for (idx, trigger) in triggers.iter().enumerate() {
-        let route_path = match trigger.workspaced_route {
-            true => format!("{}/{}", &trigger.workspace_id, &trigger.route_path),
-            _ => trigger.route_path.clone(),
-        };
-        if trigger.is_static_website {
-            router
-                .insert(format!("/{}/*wm_subpath", route_path), idx)
-                .unwrap_or_else(|e| {
-                    tracing::warn!(
-                        "Failed to consider http trigger route {}: {:?}",
-                        route_path,
-                        e,
-                    );
-                });
-        }
-        router
-            .insert(format!("/{}", route_path), idx)
-            .unwrap_or_else(|e| {
-                tracing::warn!(
-                    "Failed to consider http trigger route {}: {:?}",
-                    route_path,
-                    e,
-                );
-            });
-    }
+    let trigger_match = router.at(requested_path.as_str()).ok();
 
-    let requested_path = format!("/{}", route_path.0);
-    let trigger_idx = router.at(requested_path.as_str()).ok();
-
-    let matchit::Match { value: trigger_idx, params } =
-        not_found_if_none(trigger_idx, "Trigger", requested_path.as_str())?;
-
-    let trigger = triggers.remove(trigger_idx.to_owned());
+    let matchit::Match { value: trigger, params } =
+        not_found_if_none(trigger_match, "Trigger", requested_path.as_str())?;
 
     let params: HashMap<String, String> = params
         .iter()
@@ -834,25 +940,49 @@ async fn get_http_route_trigger(
         };
         if let Some(authed) = opt_authed {
             // check that the user has access to the trigger
-            let mut tx = user_db.begin(&authed).await?;
-            let exists = sqlx::query_scalar!(
-                r#"
-                SELECT EXISTS(
-                    SELECT 1 
-                    FROM 
-                        http_trigger 
-                    WHERE 
-                        workspace_id = $1 AND 
-                        path = $2
-                )
-                "#,
-                trigger.workspace_id,
-                trigger.path
-            )
-            .fetch_one(&mut *tx)
-            .await?
-            .unwrap_or(false);
-            tx.commit().await?;
+            let cache_key = (
+                trigger.workspace_id.clone(),
+                trigger.path.clone(),
+                authed.clone(),
+            );
+            let exists = match HTTP_ACCESS_CACHE.get(&cache_key) {
+                Some(cache_entry) if cache_entry.expiry > std::time::Instant::now() => {
+                    tracing::debug!("HTTP access cache hit for trigger {}", trigger.path);
+                    true
+                }
+                _ => {
+                    tracing::debug!("HTTP access cache miss for trigger {}", trigger.path);
+                    let mut tx = user_db.begin(&authed).await?;
+                    let exists = sqlx::query_scalar!(
+                        r#"
+                        SELECT EXISTS(
+                            SELECT 1
+                            FROM 
+                                http_trigger 
+                            WHERE 
+                                workspace_id = $1 AND 
+                                path = $2
+                        )
+                        "#,
+                        trigger.workspace_id,
+                        trigger.path
+                    )
+                    .fetch_one(&mut *tx)
+                    .await?
+                    .unwrap_or(false);
+                    if exists {
+                        HTTP_ACCESS_CACHE.insert(
+                            cache_key,
+                            ExpiringCacheEntry {
+                                value: (),
+                                expiry: std::time::Instant::now()
+                                    + std::time::Duration::from_secs(10),
+                            },
+                        );
+                    }
+                    exists
+                }
+            };
             if exists {
                 Some(authed.display_username().to_owned())
             } else {
@@ -876,7 +1006,7 @@ async fn get_http_route_trigger(
     )
     .await?;
 
-    Ok((trigger, route_path.0, params, authed))
+    Ok((trigger.clone(), route_path.to_string(), params, authed))
 }
 
 async fn route_job(
@@ -901,7 +1031,15 @@ async fn route_job(
     .map_err(|e| e.into_response())?;
 
     let args = args
-        .process_args(&authed, &db, &trigger.workspace_id, trigger.raw_string)
+        .process_args(
+            &authed,
+            &db,
+            &trigger.workspace_id,
+            match trigger.authentication_method {
+                AuthenticationMethod::CustomScript | AuthenticationMethod::Signature => true,
+                _ => trigger.raw_string,
+            },
+        )
         .await
         .map_err(|e| e.into_response())?;
 
@@ -920,31 +1058,45 @@ async fn route_job(
                 }
             };
 
-            let authentication_method =
-                try_get_resource_from_db_as::<crate::http_trigger_auth::AuthenticationMethod>(
-                    authed.clone(),
-                    Some(user_db.clone()),
-                    &db,
-                    &resource_path,
-                    &trigger.workspace_id,
-                )
-                .await
-                .map_err(|e| e.into_response())?;
+            let cache_key = (
+                trigger.workspace_id.clone(),
+                resource_path.clone(),
+                authed.clone(),
+            );
 
-            let raw_payload = args
-                .0
-                .metadata
-                .raw_string
-                .as_ref()
-                .map(|raw_payload| serde_json::from_str::<String>(raw_payload))
-                .transpose()
-                .map_err(|e| {
-                    windmill_common::error::Error::SerdeJson { location: e.to_string(), error: e }
-                        .into_response()
-                })?;
+            let authentication_method = match HTTP_AUTH_CACHE.get(&cache_key) {
+                Some(cache_entry) if cache_entry.expiry > std::time::Instant::now() => {
+                    tracing::debug!("HTTP auth method cache hit for trigger {}", trigger.path);
+                    cache_entry.value
+                }
+                _ => {
+                    tracing::debug!("HTTP auth method cache miss for trigger {}", trigger.path);
+                    let auth_method = try_get_resource_from_db_as::<
+                        crate::http_trigger_auth::AuthenticationMethod,
+                    >(
+                        authed.clone(),
+                        Some(user_db.clone()),
+                        &db,
+                        &resource_path,
+                        &trigger.workspace_id,
+                    )
+                    .await
+                    .map_err(|e| e.into_response())?;
+                    HTTP_AUTH_CACHE.insert(
+                        cache_key,
+                        ExpiringCacheEntry {
+                            value: auth_method.clone(),
+                            expiry: std::time::Instant::now() + std::time::Duration::from_secs(60),
+                        },
+                    );
+                    auth_method
+                }
+            };
+
+            let raw_payload = args.0.metadata.raw_string.as_ref();
 
             let response = authentication_method
-                .authenticate_http_request(&headers, raw_payload.as_ref())
+                .authenticate_http_request(&headers, raw_payload)
                 .map_err(|e| e.into_response())?;
 
             if let Some(response) = response {

backend/windmill-api/src/jobs.rs

@@ -42,7 +42,7 @@ use crate::trigger_helpers::RunnableId;
 use crate::users::get_scope_tags;
 use crate::utils::content_plain;
 use crate::{
-    args::{DecodeQueries, RawWebhookArgs},
+    args::{self, RawWebhookArgs},
     db::DB,
     users::{check_scopes, require_owner_of_path, OptAuthed},
     utils::require_super_admin,
@@ -3473,7 +3473,7 @@ pub async fn run_flow_by_path(
             &authed,
             &db,
             &w_id,
-            RunnableId::from_flow_path(&flow_path.0),
+            RunnableId::from_flow_path(flow_path.to_path()),
             run_query.skip_preprocessor,
         )
         .await?;
@@ -3672,7 +3672,7 @@ pub async fn run_script_by_path(
             &authed,
             &db,
             &w_id,
-            RunnableId::from_script_path(&script_path.0),
+            RunnableId::from_script_path(script_path.to_path()),
             run_query.skip_preprocessor,
         )
         .await?;
@@ -4330,7 +4330,7 @@ pub async fn run_wait_result_job_by_path_get(
     Extension(db): Extension<DB>,
     Path((w_id, script_path)): Path<(String, StripPath)>,
     Query(run_query): Query<RunJobQuery>,
-    DecodeQueries(queries): DecodeQueries,
+    args: RawWebhookArgs,
 ) -> error::Result<Response> {
     #[cfg(feature = "enterprise")]
     check_license_key_valid().await?;
@@ -4342,20 +4342,27 @@ pub async fn run_wait_result_job_by_path_get(
         x.map_err(|e| Error::internal_err(format!("Impossible to decode query payload: {e:#?}")))
     });
 
-    let mut payload_args = if let Some(payload) = payload_r {
+    let payload_args = if let Some(payload) = payload_r {
         payload?
     } else {
         HashMap::new()
     };
-    queries.iter().for_each(|(k, v)| {
-        payload_args.insert(k.to_string(), v.clone());
-    });
 
-    let inner_args: HashMap<String, Box<RawValue>> = HashMap::new();
-    let args = PushArgs { extra: Some(payload_args), args: &inner_args };
+    let mut args = args.process_args(&authed, &db, &w_id, None).await?;
+    args.body = args::Body::HashMap(payload_args);
+
+    let script_path = script_path.to_path();
+
+    let args = args
+        .to_args_from_runnable(
+            &db,
+            &w_id,
+            RunnableId::from_script_path(script_path),
+            run_query.skip_preprocessor,
+        )
+        .await?;
 
     check_queue_too_long(&db, QUEUE_LIMIT_WAIT_RESULT.or(run_query.queue_limit)).await?;
-    let script_path = script_path.to_path();
     check_scopes(&authed, || format!("run:script/{script_path}"))?;
 
     let mut tx = user_db.clone().begin(&authed).await?;
@@ -4424,7 +4431,7 @@ pub async fn run_wait_result_flow_by_path_get(
     Extension(db): Extension<DB>,
     Path((w_id, flow_path)): Path<(String, StripPath)>,
     Query(run_query): Query<RunJobQuery>,
-    DecodeQueries(queries): DecodeQueries,
+    args: RawWebhookArgs,
 ) -> error::Result<Response> {
     #[cfg(feature = "enterprise")]
     check_license_key_valid().await?;
@@ -4438,17 +4445,23 @@ pub async fn run_wait_result_flow_by_path_get(
         })
     });
 
-    let mut payload_args = if let Some(payload) = payload_r {
+    let payload_args = if let Some(payload) = payload_r {
         payload?
     } else {
         HashMap::new()
     };
 
-    queries.iter().for_each(|(k, v)| {
-        payload_args.insert(k.to_string(), v.clone());
-    });
+    let mut args = args.process_args(&authed, &db, &w_id, None).await?;
+    args.body = args::Body::HashMap(payload_args);
 
-    let args = PushArgsOwned { extra: Some(payload_args), args: HashMap::new() };
+    let args = args
+        .to_args_from_runnable(
+            &db,
+            &w_id,
+            RunnableId::from_flow_path(flow_path.to_path()),
+            run_query.skip_preprocessor,
+        )
+        .await?;
 
     run_wait_result_flow_by_path_internal(db, run_query, flow_path, authed, user_db, args, w_id)
         .await
@@ -4470,7 +4483,7 @@ pub async fn run_wait_result_script_by_path(
             &authed,
             &db,
             &w_id,
-            RunnableId::from_script_path(&script_path.0),
+            RunnableId::from_script_path(script_path.to_path()),
             run_query.skip_preprocessor,
         )
         .await?;
@@ -4495,6 +4508,7 @@ pub async fn run_wait_result_script_by_path_internal(
     let mut tx = user_db.clone().begin(&authed).await?;
     let (job_payload, tag, delete_after_use, timeout, on_behalf_of) =
         script_path_to_payload(script_path, &mut *tx, &w_id, run_query.skip_preprocessor).await?;
+    drop(tx);
 
     let tag = run_query.tag.clone().or(tag);
     check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
@@ -4679,7 +4693,7 @@ pub async fn run_wait_result_flow_by_path(
             &authed,
             &db,
             &w_id,
-            RunnableId::from_flow_path(&flow_path.0),
+            RunnableId::from_flow_path(flow_path.to_path()),
             run_query.skip_preprocessor,
         )
         .await?;
@@ -4715,6 +4729,7 @@ pub async fn run_wait_result_flow_by_path_internal(
         edited_by,
         version,
     } = get_latest_flow_version_info_for_path(&mut *tx, &w_id, &flow_path, true).await?;
+    drop(tx);
 
     let tag = run_query.tag.clone().or(tag);
     check_tag_available_for_workspace(&w_id, &tag, &authed).await?;

backend/windmill-api/src/lib.rs

@@ -85,13 +85,14 @@ mod http_trigger_args;
 #[cfg(feature = "http_trigger")]
 mod http_trigger_auth;
 #[cfg(feature = "http_trigger")]
-mod http_triggers;
+pub mod http_triggers;
 mod indexer_ee;
 mod inputs;
 mod integration;
 #[cfg(feature = "postgres_trigger")]
 mod postgres_triggers;
 
+mod approvals;
 #[cfg(feature = "enterprise")]
 mod apps_ee;
 #[cfg(all(feature = "enterprise", feature = "gcp_trigger"))]
@@ -124,6 +125,7 @@ mod slack_approvals;
 mod smtp_server_ee;
 #[cfg(all(feature = "enterprise", feature = "sqs_trigger"))]
 mod sqs_triggers_ee;
+mod teams_approvals_ee;
 mod trigger_helpers;
 
 mod static_assets;
@@ -404,6 +406,12 @@ pub async fn run_server(
         Router::new()
     };
 
+    #[cfg(feature = "http_trigger")]
+    {
+        let http_killpill_rx = killpill_rx.resubscribe();
+        http_triggers::refresh_routers_loop(&db, http_killpill_rx).await;
+    }
+
     let postgres_triggers_service = {
         #[cfg(feature = "postgres_trigger")]
         {
@@ -650,6 +658,10 @@ pub async fn run_server(
                     "/w/:workspace_id/jobs/slack_approval/:job_id",
                     get(slack_approvals::request_slack_approval),
                 )
+                .route(
+                    "/w/:workspace_id/jobs/teams_approval/:job_id",
+                    get(teams_approvals_ee::request_teams_approval),
+                )
                 .nest("/w/:workspace_id/github_app", {
                     #[cfg(feature = "enterprise")]
                     {

backend/windmill-api/src/mqtt_triggers.rs

@@ -6,7 +6,7 @@ use crate::{
     trigger_helpers::TriggerJobArgs,
     users::fetch_api_authed,
 };
-use windmill_queue::TriggerKind;
+use windmill_git_sync::{handle_deployment_metadata, DeployedObject};
 
 use axum::{
     async_trait,
@@ -43,6 +43,7 @@ use windmill_audit::{audit_ee::audit_log, ActionKind};
 use windmill_common::{
     db::UserDB,
     error::{self, JsonResult},
+    triggers::TriggerKind,
     utils::{not_found_if_none, paginate, report_critical_error, Pagination, StripPath},
     worker::{to_raw_value, CLOUD_HOSTED},
     INSTANCE_NAME,
@@ -244,25 +245,25 @@ pub struct EditMqttTrigger {
 
 #[derive(Debug, Serialize, Deserialize, FromRow)]
 pub struct MqttTrigger {
-    mqtt_resource_path: String,
-    subscribe_topics: Vec<SqlxJson<SubscribeTopic>>,
-    v3_config: Option<SqlxJson<MqttV3Config>>,
-    v5_config: Option<SqlxJson<MqttV5Config>>,
-    client_id: Option<String>,
+    pub mqtt_resource_path: String,
+    pub subscribe_topics: Vec<SqlxJson<SubscribeTopic>>,
+    pub v3_config: Option<SqlxJson<MqttV3Config>>,
+    pub v5_config: Option<SqlxJson<MqttV5Config>>,
+    pub client_id: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    client_version: Option<MqttClientVersion>,
-    path: String,
-    script_path: String,
-    is_flow: bool,
-    workspace_id: String,
-    edited_by: String,
-    email: String,
-    edited_at: chrono::DateTime<chrono::Utc>,
-    extra_perms: Option<serde_json::Value>,
-    error: Option<String>,
-    server_id: Option<String>,
-    last_server_ping: Option<chrono::DateTime<chrono::Utc>>,
-    enabled: bool,
+    pub client_version: Option<MqttClientVersion>,
+    pub path: String,
+    pub script_path: String,
+    pub is_flow: bool,
+    pub workspace_id: String,
+    pub edited_by: String,
+    pub email: String,
+    pub edited_at: chrono::DateTime<chrono::Utc>,
+    pub extra_perms: Option<serde_json::Value>,
+    pub error: Option<String>,
+    pub server_id: Option<String>,
+    pub last_server_ping: Option<chrono::DateTime<chrono::Utc>>,
+    pub enabled: bool,
 }
 
 #[derive(Deserialize, Serialize)]
@@ -515,13 +516,14 @@ pub async fn test_mqtt_connection(
 
 pub async fn create_mqtt_trigger(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path(w_id): Path<String>,
     Json(new_mqtt_trigger): Json<NewMqttTrigger>,
 ) -> error::Result<(StatusCode, String)> {
     if *CLOUD_HOSTED {
         return Err(error::Error::BadRequest(
-            "Mqtt triggers are not supported on multi-tenant cloud, use dedicated cloud or self-host".to_string(),
+            "MQTT triggers are not supported on multi-tenant cloud, use dedicated cloud or self-host".to_string(),
         ));
     }
 
@@ -606,7 +608,18 @@ pub async fn create_mqtt_trigger(
 
     tx.commit().await?;
 
-    Ok((StatusCode::CREATED, path.to_string()))
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        DeployedObject::MqttTrigger { path: path.to_string() },
+        Some(format!("MQTT trigger '{}' created", path)),
+        true,
+    )
+    .await?;
+
+    Ok((StatusCode::CREATED, format!("{}", path.to_string())))
 }
 
 pub async fn list_mqtt_triggers(
@@ -719,6 +732,7 @@ pub async fn get_mqtt_trigger(
 
 pub async fn update_mqtt_trigger(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(mqtt_trigger): Json<EditMqttTrigger>,
@@ -787,7 +801,7 @@ pub async fn update_mqtt_trigger(
         &mut *tx,
         &authed,
         "mqtt_triggers.update",
-        ActionKind::Create,
+        ActionKind::Update,
         &w_id,
         Some(&path),
         None,
@@ -796,11 +810,23 @@ pub async fn update_mqtt_trigger(
 
     tx.commit().await?;
 
-    Ok(workspace_path.to_string())
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        DeployedObject::MqttTrigger { path: path.clone() },
+        Some(format!("MQTT trigger '{}' updated", path)),
+        true,
+    )
+    .await?;
+
+    Ok(path.to_string())
 }
 
 pub async fn delete_mqtt_trigger(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
 ) -> error::Result<String> {
@@ -834,7 +860,18 @@ pub async fn delete_mqtt_trigger(
 
     tx.commit().await?;
 
-    Ok(format!("Mqtt trigger {path} deleted"))
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        DeployedObject::MqttTrigger { path: path.to_string() },
+        Some(format!("MQTT trigger '{}' deleted", path)),
+        true,
+    )
+    .await?;
+
+    Ok(format!("MQTT trigger {path} deleted"))
 }
 
 pub async fn exists_mqtt_trigger(
@@ -864,6 +901,7 @@ pub async fn exists_mqtt_trigger(
 
 pub async fn set_enabled(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(payload): Json<SetEnabled>,
@@ -913,6 +951,17 @@ pub async fn set_enabled(
 
     tx.commit().await?;
 
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        DeployedObject::MqttTrigger { path: path.to_string() },
+        Some(format!("MQTT trigger '{}' updated", path)),
+        true,
+    )
+    .await?;
+
     Ok(format!(
         "successfully updated mqtt trigger at path {} to status {}",
         path, payload.enabled

backend/windmill-api/src/postgres_triggers/handler.rs

@@ -25,9 +25,10 @@ use windmill_common::error::Error;
 use windmill_common::{
     db::UserDB,
     error::{self, JsonResult, Result},
-    utils::{not_found_if_none, paginate, Pagination, StripPath},
+    utils::{not_found_if_none, paginate, Pagination, StripPath, empty_as_none},
     worker::CLOUD_HOSTED,
 };
+use windmill_git_sync::{handle_deployment_metadata, DeployedObject};
 
 use super::{
     create_logical_replication_slot_query, create_publication_query, drop_publication_query,
@@ -45,7 +46,8 @@ pub struct Postgres {
     pub dbname: String,
     #[serde(default)]
     pub sslmode: String,
-    pub root_certificate_pem: String,
+    #[serde(default, deserialize_with = "empty_as_none")]
+    pub root_certificate_pem: Option<String>,
 }
 
 #[derive(Debug, Clone, FromRow, Serialize, Deserialize)]
@@ -453,6 +455,17 @@ pub async fn create_postgres_trigger(
 
     tx.commit().await?;
 
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        DeployedObject::PostgresTrigger { path: path.to_string() },
+        Some(format!("Postgres trigger '{}' created", path)),
+        true,
+    )
+    .await?;
+
     Ok((StatusCode::CREATED, path.to_string()))
 }
 
@@ -1158,7 +1171,7 @@ pub async fn update_postgres_trigger(
         &mut *tx,
         &authed,
         "postgres_triggers.update",
-        ActionKind::Create,
+        ActionKind::Update,
         &w_id,
         Some(&path),
         None,
@@ -1167,11 +1180,23 @@ pub async fn update_postgres_trigger(
 
     tx.commit().await?;
 
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        DeployedObject::PostgresTrigger { path: path.to_string() },
+        Some(format!("Postgres trigger '{}' updated", path)),
+        true,
+    )
+    .await?;
+
     Ok(workspace_path.to_string())
 }
 
 pub async fn delete_postgres_trigger(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
 ) -> Result<String> {
@@ -1203,6 +1228,17 @@ pub async fn delete_postgres_trigger(
 
     tx.commit().await?;
 
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        DeployedObject::PostgresTrigger { path: path.to_string() },
+        Some(format!("Postgres trigger '{}' deleted", path)),
+        true,
+    )
+    .await?;
+
     Ok(format!("Postgres trigger {path} deleted"))
 }
 
@@ -1231,6 +1267,7 @@ pub async fn exists_postgres_trigger(
 
 pub async fn set_enabled(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(payload): Json<SetEnabled>,
@@ -1279,6 +1316,17 @@ pub async fn set_enabled(
 
     tx.commit().await?;
 
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        DeployedObject::PostgresTrigger { path: path.to_string() },
+        Some(format!("Postgres trigger '{}' updated", path)),
+        true,
+    )
+    .await?;
+
     Ok(format!(
         "succesfully updated postgres trigger at path {} to status {}",
         path, payload.enabled

backend/windmill-api/src/postgres_triggers/mod.rs

@@ -84,8 +84,8 @@ pub async fn get_raw_postgres_connection(
             }
         };
 
-        let options = if !db.root_certificate_pem.is_empty() {
-            options.ssl_root_cert_from_pem(db.root_certificate_pem.as_bytes().to_vec())
+        let options = if let Some(root_certificate_pem) = &db.root_certificate_pem {
+            options.ssl_root_cert_from_pem(root_certificate_pem.as_bytes().to_vec())
         } else {
             options
         };
@@ -96,7 +96,6 @@ pub async fn get_raw_postgres_connection(
             options
         }
     };
-
     Ok(PgConnection::connect_with(&options).await?)
 }
 

backend/windmill-api/src/postgres_triggers/trigger.rs

@@ -15,22 +15,22 @@ use crate::{
     trigger_helpers::TriggerJobArgs,
     users::fetch_api_authed,
 };
-use windmill_queue::TriggerKind;
 
 use bytes::{BufMut, Bytes, BytesMut};
 use chrono::TimeZone;
 use futures::{pin_mut, SinkExt, StreamExt};
-use native_tls::TlsConnector;
+use native_tls::{Certificate, TlsConnector};
 use pg_escape::{quote_identifier, quote_literal};
 use rand::seq::SliceRandom;
-use rust_postgres::{config::SslMode, Client, Config, CopyBothDuplex, SimpleQueryMessage};
+use rust_postgres::{config::SslMode, Client, Config, CopyBothDuplex, NoTls, SimpleQueryMessage};
 use rust_postgres_native_tls::MakeTlsConnector;
 use serde::Deserialize;
 use serde_json::value::RawValue;
 use sqlx::types::Json as SqlxJson;
 
 use windmill_common::{
-    db::UserDB, error, utils::report_critical_error, worker::to_raw_value, INSTANCE_NAME,
+    db::UserDB, error, triggers::TriggerKind, utils::report_critical_error, worker::to_raw_value,
+    INSTANCE_NAME,
 };
 
 use super::{
@@ -79,6 +79,45 @@ enum Error {
     Tls(#[from] native_tls::Error),
 }
 
+fn build_tls_connector(
+    ssl_mode: SslMode,
+    root_certificate_pem: Option<&String>,
+) -> Result<Option<MakeTlsConnector>, Error> {
+    let get_tls_builder_for_verify = |root_certificate: Option<&String>| {
+        let mut builder = TlsConnector::builder();
+        if let Some(root_certificate) = root_certificate {
+            let root_certificate_pem = Certificate::from_pem(root_certificate.as_bytes()).map_err(|e| {
+                Error::Common(error::Error::BadConfig(format!("Invalid Certs: {e:#}")))
+            })?;
+            builder.add_root_certificate(root_certificate_pem);
+        }
+        Ok::<_, Error>(builder)
+    };
+    let connector = match ssl_mode {
+        SslMode::Disable => return Ok(None),
+        SslMode::Require | SslMode::Prefer => {
+            let mut builder = TlsConnector::builder();
+            builder.danger_accept_invalid_certs(true);
+            builder.danger_accept_invalid_hostnames(true);
+            builder
+        }
+
+        SslMode::VerifyCa => {
+            let mut builder = get_tls_builder_for_verify(root_certificate_pem)?;
+            builder.danger_accept_invalid_hostnames(true);
+            builder
+        }
+
+        SslMode::VerifyFull => {
+            let builder = get_tls_builder_for_verify(root_certificate_pem)?;
+            builder
+        }
+        _ => unreachable!(),
+    };
+
+    Ok(Some(MakeTlsConnector::new(connector.build()?)))
+}
+
 pub struct PostgresSimpleClient(Client);
 
 impl PostgresSimpleClient {
@@ -112,20 +151,27 @@ impl PostgresSimpleClient {
             config.password(&database.password);
         }
 
-        if !database.root_certificate_pem.is_empty() {
-            config.ssl_root_cert(database.root_certificate_pem.as_bytes());
-        }
+        let connector = build_tls_connector(ssl_mode, database.root_certificate_pem.as_ref())?;
 
-        let connector = MakeTlsConnector::new(TlsConnector::new()?);
-
-        let (client, connection) = config.connect(connector).await?;
-
-        tokio::spawn(async move {
-            if let Err(e) = connection.await {
-                tracing::debug!("{:#?}", e);
-            };
-            tracing::info!("Successfully Connected into database");
-        });
+        let client = if let Some(connector) = connector {
+            let (client, connection) = config.connect(connector).await?;
+            tokio::spawn(async move {
+                if let Err(e) = connection.await {
+                    tracing::debug!("{:#?}", e);
+                };
+                tracing::info!("Successfully Connected into database");
+            });
+            client
+        } else {
+            let (client, connection) = config.connect(NoTls).await?;
+            tokio::spawn(async move {
+                if let Err(e) = connection.await {
+                    tracing::debug!("{:#?}", e);
+                };
+                tracing::info!("Successfully Connected into database");
+            });
+            client
+        };
 
         Ok(PostgresSimpleClient(client))
     }

backend/windmill-api/src/scripts.rs

@@ -223,7 +223,8 @@ async fn list_scripts(
             "draft_only",
             "ws_error_handler_muted",
             "no_main_func",
-            "codebase IS NOT NULL as use_codebase"
+            "codebase IS NOT NULL as use_codebase",
+            "kind"
         ])
         .left()
         .join("favorite")
@@ -298,7 +299,9 @@ async fn list_scripts(
     if let Some(it) = &lq.is_template {
         sqlb.and_where_eq("is_template", it);
     }
-    if let Some(lowercased_kinds) = lowercased_kinds {
+    if authed.is_operator {
+        sqlb.and_where_eq("kind", quote("script"));
+    } else if let Some(lowercased_kinds) = lowercased_kinds {
         let safe_kinds = lowercased_kinds
             .into_iter()
             .map(sql_builder::quote)
@@ -683,36 +686,40 @@ async fn create_script_internal<'c>(
 
     let validate_schema = should_validate_schema(&ns.content, &ns.language);
 
-    let (no_main_func, has_preprocessor) = match lang {
-        ScriptLang::Bun | ScriptLang::Bunnative | ScriptLang::Deno | ScriptLang::Nativets => {
-            let args = windmill_parser_ts::parse_deno_signature(&ns.content, true, true, None);
-            match args {
-                Ok(args) => (args.no_main_func, args.has_preprocessor),
-                Err(e) => {
-                    tracing::warn!(
-                        "Error parsing deno signature when deploying script {}: {:?}",
-                        ns.path,
-                        e
-                    );
-                    (None, None)
+    let (no_main_func, has_preprocessor) = if matches!(ns.kind, Some(ScriptKind::Preprocessor)) {
+        (ns.no_main_func, ns.has_preprocessor)
+    } else {
+        match lang {
+            ScriptLang::Bun | ScriptLang::Bunnative | ScriptLang::Deno | ScriptLang::Nativets => {
+                let args = windmill_parser_ts::parse_deno_signature(&ns.content, true, true, None);
+                match args {
+                    Ok(args) => (args.no_main_func, args.has_preprocessor),
+                    Err(e) => {
+                        tracing::warn!(
+                            "Error parsing deno signature when deploying script {}: {:?}",
+                            ns.path,
+                            e
+                        );
+                        (None, None)
+                    }
                 }
             }
-        }
-        ScriptLang::Python3 => {
-            let args = windmill_parser_py::parse_python_signature(&ns.content, None, true);
-            match args {
-                Ok(args) => (args.no_main_func, args.has_preprocessor),
-                Err(e) => {
-                    tracing::warn!(
-                        "Error parsing python signature when deploying script {}: {:?}",
-                        ns.path,
-                        e
-                    );
-                    (None, None)
+            ScriptLang::Python3 => {
+                let args = windmill_parser_py::parse_python_signature(&ns.content, None, true);
+                match args {
+                    Ok(args) => (args.no_main_func, args.has_preprocessor),
+                    Err(e) => {
+                        tracing::warn!(
+                            "Error parsing python signature when deploying script {}: {:?}",
+                            ns.path,
+                            e
+                        );
+                        (None, None)
+                    }
                 }
             }
+            _ => (ns.no_main_func, ns.has_preprocessor),
         }
-        _ => (ns.no_main_func, ns.has_preprocessor),
     };
 
     sqlx::query!(

backend/windmill-api/src/slack_approvals.rs

@@ -3,28 +3,21 @@ use axum::{
     Extension,
 };
 use hyper::StatusCode;
-use serde::{Deserialize, Serialize};
-use serde_json::value::{RawValue, Value};
-
-use sqlx::types::Uuid;
-use std::{collections::HashMap, str::FromStr};
-
-use regex::Regex;
 use reqwest::Client;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use sqlx::types::Uuid;
+use std::collections::HashMap;
+use windmill_common::error::Error;
+use windmill_common::variables::get_secret_value_as_admin;
 
+use crate::approvals::{
+    extract_w_id_from_resume_url, handle_resume_action, ApprovalFormDetails, FieldType,
+    MessageFormat, QueryDefaultArgsJson, QueryDynamicEnumJson, QueryFlowStepId, QueryMessage,
+    ResumeFormField, ResumeSchema,
+};
 use crate::db::{ApiAuthed, DB};
-use crate::jobs::{
-    cancel_suspended_job, get_resume_urls_internal, resume_suspended_job, QueryApprover,
-    QueryOrBody, ResumeUrls,
-};
-
-use windmill_common::{
-    cache,
-    error::{self, Error},
-    jobs::JobKind,
-    scripts::ScriptHash,
-    variables::get_secret_value_as_admin,
-};
+use crate::jobs::{QueryApprover, ResumeUrls};
 
 #[derive(Deserialize, Debug)]
 pub struct SlackFormData {
@@ -91,53 +84,6 @@ struct SelectedOption {
     value: String,
 }
 
-#[derive(Debug, Deserialize, Serialize)]
-struct ResumeSchema {
-    schema: Schema,
-}
-
-#[derive(Debug, Deserialize)]
-struct ResumeFormRow {
-    resume_form: Option<serde_json::Value>,
-    hide_cancel: Option<bool>,
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-struct Schema {
-    order: Vec<String>,
-    required: Vec<String>,
-    properties: HashMap<String, ResumeFormField>,
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(rename_all = "lowercase")]
-enum FieldType {
-    Boolean,
-    String,
-    Number,
-    Integer,
-    #[serde(other)]
-    Unknown,
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-struct ResumeFormField {
-    r#type: FieldType,
-    format: Option<String>,
-    default: Option<serde_json::Value>,
-    description: Option<String>,
-    title: Option<String>,
-    r#enum: Option<Vec<String>>,
-    #[serde(rename = "enumLabels")]
-    enum_labels: Option<HashMap<String, String>>,
-    nullable: Option<bool>,
-}
-
-#[derive(Deserialize)]
-pub struct QueryMessage {
-    message: Option<String>,
-}
-
 #[derive(Deserialize)]
 pub struct QueryResourcePath {
     slack_resource_path: String,
@@ -148,21 +94,6 @@ pub struct QueryChannelId {
     channel_id: String,
 }
 
-#[derive(Deserialize)]
-pub struct QueryFlowStepId {
-    flow_step_id: String,
-}
-
-#[derive(Deserialize, Debug)]
-pub struct QueryDefaultArgsJson {
-    default_args_json: Option<serde_json::Value>,
-}
-
-#[derive(Deserialize, Debug)]
-pub struct QueryDynamicEnumJson {
-    dynamic_enums_json: Option<serde_json::Value>,
-}
-
 #[derive(Deserialize, Debug)]
 struct ModalActionValue {
     w_id: String,
@@ -362,73 +293,21 @@ async fn handle_submission(
         return Ok(());
     }
 
-    // Use regex to extract information from private_metadata
-    let re = Regex::new(r"/api/w/(?P<w_id>[^/]+)/jobs_u/(?P<action>resume|cancel)/(?P<job_id>[^/]+)/(?P<resume_id>[^/]+)/(?P<secret>[a-fA-F0-9]+)(?:\?approver=(?P<approver>[^&]+))?").unwrap();
-    let captures = re.captures(resume_url.as_str()).ok_or_else(|| {
-        tracing::error!("Resume URL does not match the pattern.");
-        Error::BadRequest("Invalid URL format.".to_string())
-    })?;
+    // Use the common handler to process the resume/cancel action
+    handle_resume_action(authed, db.clone(), &resume_url, state_json, action).await?;
 
-    let (w_id, job_id, resume_id, secret, approver) = (
-        captures.name("w_id").map_or("", |m| m.as_str()),
-        captures.name("job_id").map_or("", |m| m.as_str()),
-        captures.name("resume_id").map_or("", |m| m.as_str()),
-        captures.name("secret").map_or("", |m| m.as_str()),
-        captures.name("approver").map(|m| m.as_str().to_string()),
-    );
-
-    let approver = QueryApprover { approver: approver };
-
-    // Convert job_id and resume_id to appropriate types
-    let job_uuid = Uuid::from_str(job_id)
-        .map_err(|_| Error::BadRequest("Invalid job ID format.".to_string()))?;
-
-    let resume_id_parsed = resume_id
-        .parse::<u32>()
-        .map_err(|_| Error::BadRequest("Invalid resume ID format.".to_string()))?;
-
-    // Call the appropriate function based on the action
-    let res = if action == "resume" {
-        resume_suspended_job(
-            authed,
-            Extension(db.clone()),
-            Path((
-                w_id.to_string(),
-                job_uuid,
-                resume_id_parsed,
-                secret.to_string(),
-            )),
-            Query(approver),
-            QueryOrBody(Some(state_json)),
-        )
-        .await
-    } else {
-        cancel_suspended_job(
-            authed,
-            Extension(db.clone()),
-            Path((
-                w_id.to_string(),
-                job_uuid,
-                resume_id_parsed,
-                secret.to_string(),
-            )),
-            Query(approver),
-            QueryOrBody(Some(state_json)),
-        )
-        .await
-    };
-    tracing::debug!("Resume job action result: {:#?}", res);
-    let slack_token = get_slack_token(&db, &resource_path, &w_id).await?;
+    let w_id = extract_w_id_from_resume_url(&resume_url)?;
+    let slack_token = get_slack_token(&db, &resource_path, w_id).await?;
     update_original_slack_message(action, slack_token, container).await?;
     Ok(())
 }
 
 async fn transform_schemas(
     text: &str,
-    properties: Option<&HashMap<String, ResumeFormField>>,
+    properties: Option<HashMap<String, ResumeFormField>>,
     urls: &ResumeUrls,
-    order: Option<&Vec<String>>,
-    required: Option<&Vec<String>>,
+    order: Option<Vec<String>>,
+    required: Option<Vec<String>>,
     default_args_json: Option<&serde_json::Value>,
     dynamic_enums_json: Option<&serde_json::Value>,
 ) -> Result<serde_json::Value, Error> {
@@ -443,16 +322,16 @@ async fn transform_schemas(
     })];
 
     if let Some(properties) = properties {
-        for key in order.unwrap() {
-            if let Some(schema) = properties.get(key) {
-                let is_required = required.unwrap().contains(key);
+        for key in order.unwrap_or_default() {
+            if let Some(schema) = properties.get(&key) {
+                let is_required = required.as_ref().map_or(false, |r| r.contains(&key));
 
-                let default_value = default_args_json.and_then(|json| json.get(key).cloned());
+                let default_value = default_args_json.and_then(|json| json.get(&key).cloned());
                 let dynamic_enums_value =
-                    dynamic_enums_json.and_then(|json| json.get(key).cloned());
+                    dynamic_enums_json.and_then(|json| json.get(&key).cloned());
 
                 let input_block = create_input_block(
-                    key,
+                    &key,
                     schema,
                     is_required,
                     default_value,
@@ -947,155 +826,59 @@ async fn get_modal_blocks(
     default_args_json: Option<&serde_json::Value>,
     dynamic_enums_json: Option<&serde_json::Value>,
 ) -> Result<axum::Json<serde_json::Value>, Error> {
-    let res = get_resume_urls_internal(
-        axum::Extension(db.clone()),
-        Path((w_id.to_string(), job_id, resume_id)),
-        Query(QueryApprover { approver: approver.map(|a| a.to_string()) }),
+    let approval_details = crate::approvals::get_approval_form_details(
+        db,
+        w_id,
+        job_id,
+        flow_step_id,
+        resume_id,
+        approver,
+        message,
+        MessageFormat::Slack,
     )
     .await?;
 
-    let urls = res.0;
+    let ApprovalFormDetails { message_str, urls, schema } = approval_details;
 
-    tracing::debug!("Job ID: {:?}", job_id);
-
-    let (job_kind, script_hash, raw_flow, parent_job_id, created_at, created_by, script_path, args) = sqlx::query!(
-        "SELECT
-            v2_as_queue.job_kind AS \"job_kind!: JobKind\",
-            v2_as_queue.script_hash AS \"script_hash: ScriptHash\",
-            v2_as_queue.raw_flow AS \"raw_flow: sqlx::types::Json<Box<RawValue>>\",
-            v2_as_completed_job.parent_job AS \"parent_job: Uuid\",
-            v2_as_completed_job.created_at AS \"created_at!: chrono::NaiveDateTime\",
-            v2_as_completed_job.created_by AS \"created_by!\",
-            v2_as_queue.script_path,
-            v2_as_queue.args AS \"args: sqlx::types::Json<Box<RawValue>>\"
-        FROM v2_as_queue
-        JOIN v2_as_completed_job ON v2_as_completed_job.parent_job = v2_as_queue.id
-        WHERE v2_as_completed_job.id = $1 AND v2_as_completed_job.workspace_id = $2
-        LIMIT 1",
-        job_id,
-        &w_id
+    // Get the card content
+    let card_content = transform_schemas(
+        &message_str,
+        schema
+            .as_ref()
+            .and_then(|s| s.resume_form.as_ref())
+            .map(|f| {
+                let inner_schema: ResumeSchema = serde_json::from_value(f.clone()).unwrap();
+                inner_schema.schema.properties
+            }),
+        &urls,
+        schema
+            .as_ref()
+            .and_then(|s| s.resume_form.as_ref())
+            .map(|f| {
+                let inner_schema: ResumeSchema = serde_json::from_value(f.clone()).unwrap();
+                inner_schema.schema.order
+            }),
+        schema
+            .as_ref()
+            .and_then(|s| s.resume_form.as_ref())
+            .map(|f| {
+                let inner_schema: ResumeSchema = serde_json::from_value(f.clone()).unwrap();
+                inner_schema.schema.required
+            }),
+        default_args_json,
+        dynamic_enums_json,
     )
-    .fetch_optional(&db)
-    .await
-    .map_err(|e| error::Error::BadRequest(e.to_string()))?
-    .ok_or_else(|| error::Error::BadRequest("This workflow is no longer running and has either already timed out or been cancelled or completed.".to_string()))
-    .map(|r| (r.job_kind, r.script_hash, r.raw_flow, r.parent_job, r.created_at, r.created_by, r.script_path, r.args))?;
+    .await?;
 
-    let flow_data = match cache::job::fetch_flow(&db, job_kind, script_hash).await {
-        Ok(data) => data,
-        Err(_) => {
-            if let Some(parent_job_id) = parent_job_id.as_ref() {
-                cache::job::fetch_preview_flow(&db, parent_job_id, raw_flow).await?
-            } else {
-                return Err(error::Error::BadRequest(
-                    "This workflow is no longer running and has either already timed out or been cancelled or completed.".to_string(),
-                ));
-            }
-        }
-    };
-
-    let flow_value = &flow_data.flow;
-    let flow_step_id = flow_step_id.unwrap_or("");
-    let module = flow_value.modules.iter().find(|m| m.id == flow_step_id);
-
-    tracing::debug!("Module: {:#?}", module);
-
-    let schema = module.and_then(|module| {
-        module.suspend.as_ref().map(|suspend| ResumeFormRow {
-            resume_form: suspend.resume_form.clone(),
-            hide_cancel: suspend.hide_cancel,
-        })
-    });
-
-    let args_str = args.map_or("None".to_string(), |a| a.get().to_string());
-    let parent_job_id_str = parent_job_id.map_or("None".to_string(), |id| id.to_string());
-    let script_path_str = script_path.as_deref().unwrap_or("None");
-
-    let created_at_formatted = created_at.format("%Y-%m-%d %H:%M:%S").to_string();
-
-    let mut message_str = format!(
-        "A workflow has been suspended and is waiting for approval:\n\n\
-        *Created by*: {created_by}\n\
-        *Created at*: {created_at_formatted}\n\
-        *Script path*: {script_path_str}\n\
-        *Args*: {args_str}\n\
-        *Flow ID*: {parent_job_id_str}\n\n"
-    );
-
-    // Append custom message if provided
-    if let Some(msg) = message {
-        message_str.push_str(msg);
-    }
-
-    tracing::debug!("Schema: {:#?}", schema);
-
-    if let Some(resume_schema) = schema {
-        let hide_cancel = resume_schema.hide_cancel.unwrap_or(false);
-
-        // if hide cancel is false add note to message
-        if !hide_cancel {
-            message_str.push_str("\n\n*NOTE*: closing this modal will cancel the workflow.\n\n");
-        }
-
-        // Convert message_str back to &str when needed
-        let message_str_ref: &str = &message_str;
-
-        if let Some(schema_obj) = resume_schema.resume_form {
-            let inner_schema: ResumeSchema =
-                serde_json::from_value(schema_obj.clone()).map_err(|e| {
-                    tracing::error!("Failed to deserialize form schema: {:?}", e);
-                    Error::BadRequest(
-                        "Failed to deserialize resume form schema! Unsupported form field used."
-                            .to_string(),
-                    )
-                })?;
-
-            let blocks = transform_schemas(
-                message_str_ref,
-                Some(&inner_schema.schema.properties),
-                &urls,
-                Some(&inner_schema.schema.order),
-                Some(&inner_schema.schema.required),
-                default_args_json,
-                dynamic_enums_json,
-            )
-            .await?;
-
-            tracing::debug!("Slack Blocks: {:#?}", blocks);
-            return Ok(axum::Json(construct_payload(
-                blocks,
-                hide_cancel,
-                trigger_id,
-                &urls.resume,
-                resource_path,
-                container,
-            )));
-        } else {
-            tracing::debug!("No suspend form found!");
-            let blocks = transform_schemas(
-                message_str_ref,
-                None,
-                &urls,
-                None,
-                None,
-                default_args_json,
-                dynamic_enums_json,
-            )
-            .await?;
-            return Ok(axum::Json(construct_payload(
-                blocks,
-                hide_cancel,
-                trigger_id,
-                &urls.resume,
-                resource_path,
-                container,
-            )));
-        }
-    } else {
-        Err(Error::BadRequest(
-            "No approval form schema found.".to_string(),
-        ))
-    }
+    tracing::debug!("Slack Blocks: {:#?}", card_content);
+    Ok(axum::Json(construct_payload(
+        card_content,
+        schema.as_ref().and_then(|s| s.hide_cancel).unwrap_or(false),
+        trigger_id,
+        &urls.resume,
+        resource_path,
+        container,
+    )))
 }
 
 fn construct_payload(

backend/windmill-api/src/teams_approvals_ee.rs

@@ -0,0 +1,7 @@
+use hyper::StatusCode;
+
+use windmill_common::error::Error;
+
+pub async fn request_teams_approval() -> Result<StatusCode, Error> {
+    Err(Error::InternalErr("enterprise feature only".to_string()))
+}

backend/windmill-api/src/trigger_helpers.rs

@@ -1,35 +1,23 @@
-use quick_cache::sync::Cache;
 use serde::Deserialize;
 use serde_json::value::RawValue;
 use std::collections::HashMap;
 use windmill_common::{
     error::Result,
+    flows::FlowModuleValue,
     get_latest_deployed_hash_for_path, get_latest_flow_version_info_for_path,
-    scripts::{ScriptHash, ScriptLang},
+    jobs::get_has_preprocessor_from_content_and_lang,
+    scripts::{get_full_hub_script_by_path, ScriptHash, ScriptLang},
+    triggers::{
+        HubOrWorkspaceId, RunnableFormat, RunnableFormatVersion, TriggerKind,
+        RUNNABLE_FORMAT_VERSION_CACHE,
+    },
+    utils::StripPath,
     worker::to_raw_value,
     FlowVersionInfo,
 };
-use windmill_queue::{PushArgsOwned, TriggerKind};
+use windmill_queue::PushArgsOwned;
 
-use crate::db::DB;
-
-type RunnableFormatCacheKey = (String, i64, TriggerKind);
-
-lazy_static::lazy_static! {
-    pub static ref RUNNABLE_FORMAT_VERSION_CACHE: Cache<RunnableFormatCacheKey, RunnableFormat> = Cache::new(1000);
-}
-
-#[derive(Debug, Clone, Eq, PartialEq, Hash, Copy)]
-pub struct RunnableFormat {
-    pub version: RunnableFormatVersion,
-    pub has_preprocessor: bool,
-}
-
-#[derive(Debug, Clone, Eq, PartialEq, Hash, Copy)]
-pub enum RunnableFormatVersion {
-    V1,
-    V2,
-}
+use crate::{db::DB, HTTP_CLIENT};
 
 struct ScriptInfo {
     has_preprocessor: Option<bool>,
@@ -38,12 +26,6 @@ struct ScriptInfo {
     schema: Option<sqlx::types::Json<PartialSchema>>,
 }
 
-struct FlowInfo {
-    has_preprocessor: Option<bool>,
-    is_v1_preprocessor: Option<bool>,
-    schema: Option<sqlx::types::Json<PartialSchema>>,
-}
-
 #[derive(Debug, Deserialize)]
 struct PropertyDefinition {
     r#type: Option<String>,
@@ -58,6 +40,7 @@ struct PartialSchema {
 pub enum RunnableId {
     FlowPath(String),
     ScriptId(ScriptId),
+    HubScript(String),
 }
 
 impl RunnableId {
@@ -66,7 +49,11 @@ impl RunnableId {
     }
 
     pub fn from_script_path(path: &str) -> Self {
-        Self::ScriptId(ScriptId::ScriptPath(path.to_string()))
+        if path.starts_with("hub/") {
+            Self::HubScript(path.to_string())
+        } else {
+            Self::ScriptId(ScriptId::ScriptPath(path.to_string()))
+        }
     }
 
     pub fn from_flow_path(path: &str) -> Self {
@@ -104,9 +91,8 @@ async fn get_script_info(
         .await
 }
 
-fn runnable_format_from_schema(
+fn runnable_format_from_schema_without_preprocessor(
     trigger_kind: &TriggerKind,
-    has_preprocessor: bool,
     schema: Option<sqlx::types::Json<PartialSchema>>,
 ) -> RunnableFormat {
     match trigger_kind {
@@ -119,7 +105,7 @@ fn runnable_format_from_schema(
                 })
             }) =>
         {
-            RunnableFormat { version: RunnableFormatVersion::V1, has_preprocessor }
+            RunnableFormat { version: RunnableFormatVersion::V1, has_preprocessor: false }
         }
         TriggerKind::Kafka | TriggerKind::Nats
             if schema.as_ref().is_some_and(|schema| {
@@ -129,23 +115,132 @@ fn runnable_format_from_schema(
                     .is_some_and(|properties| properties.keys().any(|key| key == "msg"))
             }) =>
         {
-            RunnableFormat { version: RunnableFormatVersion::V1, has_preprocessor }
+            RunnableFormat { version: RunnableFormatVersion::V1, has_preprocessor: false }
         }
-        _ => RunnableFormat { version: RunnableFormatVersion::V2, has_preprocessor },
+        _ => RunnableFormat { version: RunnableFormatVersion::V2, has_preprocessor: false },
     }
 }
+
+fn runnable_format_from_preprocessor_args(
+    args: Option<Vec<windmill_parser::Arg>>,
+) -> RunnableFormat {
+    if let Some(args) = args {
+        if args.iter().any(|arg| arg.name == "wm_trigger")
+            || (args.len() > 0 && args.iter().all(|arg| arg.name != "event"))
+        {
+            RunnableFormat { version: RunnableFormatVersion::V1, has_preprocessor: true }
+        } else {
+            RunnableFormat { version: RunnableFormatVersion::V2, has_preprocessor: true }
+        }
+    } else {
+        RunnableFormat { version: RunnableFormatVersion::V2, has_preprocessor: true }
+    }
+}
+
+enum PreprocessorInfo {
+    Preprocessor { content: String, language: ScriptLang },
+    NoPreprocessor { schema: Option<sqlx::types::Json<PartialSchema>> },
+}
+
+#[derive(Debug, Deserialize)]
+struct FlowInfo {
+    preprocessor_module: Option<sqlx::types::Json<FlowModuleValue>>,
+    schema: Option<sqlx::types::Json<PartialSchema>>,
+}
+
+fn get_preprocessor_args_from_content_and_language(
+    content: &str,
+    language: &ScriptLang,
+) -> Result<Option<Vec<windmill_parser::Arg>>> {
+    let args = match language {
+        ScriptLang::Bun | ScriptLang::Bunnative | ScriptLang::Deno | ScriptLang::Nativets => {
+            let args = windmill_parser_ts::parse_deno_signature(
+                &content,
+                true,
+                false,
+                Some("preprocessor".to_string()),
+            )?;
+            Some(args.args)
+        }
+        ScriptLang::Python3 => {
+            let args = windmill_parser_py::parse_python_signature(
+                &content,
+                Some("preprocessor".to_string()),
+                false,
+            )?;
+            Some(args.args)
+        }
+        _ => None,
+    };
+    Ok(args)
+}
+
 pub async fn get_runnable_format(
     runnable_id: RunnableId,
     workspace_id: &str,
     db: &DB,
     trigger_kind: &TriggerKind,
 ) -> Result<RunnableFormat> {
-    match runnable_id {
+    let (key, preprocessor_info) = match runnable_id {
+        RunnableId::HubScript(path) => {
+            let Some(version) = path.split("/").nth(1) else {
+                return Err(windmill_common::error::Error::internal_err(
+                    "Invalid hub script path".to_string(),
+                ));
+            };
+
+            let version = match version.parse::<i64>() {
+                Ok(version) => version,
+                Err(_) => {
+                    return Err(windmill_common::error::Error::internal_err(
+                        "Invalid hub script version".to_string(),
+                    ));
+                }
+            };
+
+            let key = (HubOrWorkspaceId::Hub, version, trigger_kind.clone());
+
+            let runnable_format = RUNNABLE_FORMAT_VERSION_CACHE.get(&key);
+
+            if let Some(runnable_format) = runnable_format {
+                tracing::debug!("Using cached runnable format for hub script {path}");
+                return Ok(runnable_format);
+            }
+
+            let hub_script =
+                get_full_hub_script_by_path(StripPath(path.to_string()), &HTTP_CLIENT, Some(db))
+                    .await?;
+
+            let has_preprocessor = get_has_preprocessor_from_content_and_lang(
+                &hub_script.content,
+                &hub_script.language,
+            )?;
+
+            let partial_schema = serde_json::from_str(hub_script.schema.get())?;
+
+            (
+                key,
+                if has_preprocessor {
+                    PreprocessorInfo::Preprocessor {
+                        content: hub_script.content,
+                        language: hub_script.language,
+                    }
+                } else {
+                    PreprocessorInfo::NoPreprocessor {
+                        schema: Some(sqlx::types::Json(partial_schema)),
+                    }
+                },
+            )
+        }
         RunnableId::FlowPath(path) => {
             let FlowVersionInfo { version, .. } =
                 get_latest_flow_version_info_for_path(db, workspace_id, &path, true).await?;
 
-            let key = (workspace_id.to_string(), version, trigger_kind.clone());
+            let key = (
+                HubOrWorkspaceId::WorkspaceId(workspace_id.to_string()),
+                version,
+                trigger_kind.clone(),
+            );
 
             let runnable_format = RUNNABLE_FORMAT_VERSION_CACHE.get(&key);
 
@@ -157,34 +252,62 @@ pub async fn get_runnable_format(
             let flow_info = sqlx::query_as!(
                 FlowInfo,
                 "SELECT
-                    value->'preprocessor_module' IS NOT NULL as has_preprocessor,
-                    value->'preprocessor_module'->'value'->'input_transforms'->'wm_trigger' IS NOT NULL as is_v1_preprocessor,
+                    value->'preprocessor_module'->'value' as \"preprocessor_module: _\",
                     schema as \"schema: _\"
-                FROM flow 
-                WHERE workspace_id = $1 
-                    AND path = $2",
+                FROM flow_version
+                WHERE 
+                    path = $1
+                    AND workspace_id = $2
+                ORDER BY created_at DESC
+                LIMIT 1",
+                path,
                 workspace_id,
-                path
             )
             .fetch_one(db)
             .await?;
 
-            let has_preprocessor = flow_info.has_preprocessor.unwrap_or(false);
-            let is_v1_preprocessor = flow_info.is_v1_preprocessor.unwrap_or(false);
-
-            let runnable_format = if has_preprocessor && is_v1_preprocessor {
-                RunnableFormat { version: RunnableFormatVersion::V1, has_preprocessor: true }
+            if let Some(preprocessor_module) = flow_info.preprocessor_module {
+                match preprocessor_module.0 {
+                    FlowModuleValue::RawScript { content, language, .. } => {
+                        (key, PreprocessorInfo::Preprocessor { content, language })
+                    }
+                    FlowModuleValue::Script { path, hash, .. } => {
+                        let hash = if let Some(hash) = hash {
+                            hash.0
+                        } else {
+                            let script_hash =
+                                get_latest_deployed_hash_for_path(db, workspace_id, &path).await?;
+                            script_hash.hash
+                        };
+                        let script_info = get_script_info(db, workspace_id, hash).await?;
+                        (
+                            key,
+                            PreprocessorInfo::Preprocessor {
+                                content: script_info.content,
+                                language: script_info.language,
+                            },
+                        )
+                    }
+                    _ => {
+                        return Err(windmill_common::error::Error::internal_err(
+                            "Unsupported preprocessor module".to_string(),
+                        ));
+                    }
+                }
             } else {
-                runnable_format_from_schema(trigger_kind, has_preprocessor, flow_info.schema)
-            };
-
-            RUNNABLE_FORMAT_VERSION_CACHE.insert(key, runnable_format);
-
-            Ok(runnable_format)
+                (
+                    key,
+                    PreprocessorInfo::NoPreprocessor { schema: flow_info.schema },
+                )
+            }
         }
         RunnableId::ScriptId(script_id) => {
             let hash = script_id.get_script_hash(workspace_id, db).await?;
-            let key = (workspace_id.to_string(), hash, trigger_kind.clone());
+            let key = (
+                HubOrWorkspaceId::WorkspaceId(workspace_id.to_string()),
+                hash,
+                trigger_kind.clone(),
+            );
             let runnable_format = RUNNABLE_FORMAT_VERSION_CACHE.get(&key);
 
             if let Some(runnable_format) = runnable_format {
@@ -194,47 +317,36 @@ pub async fn get_runnable_format(
 
             let script_info = get_script_info(db, workspace_id, hash).await?;
 
-            let has_preprocessor = script_info.has_preprocessor.unwrap_or(false);
-
-            let runnable_format = if has_preprocessor {
-                let args = match script_info.language {
-                    ScriptLang::Bun
-                    | ScriptLang::Bunnative
-                    | ScriptLang::Deno
-                    | ScriptLang::Nativets => {
-                        let args = windmill_parser_ts::parse_deno_signature(
-                            &script_info.content,
-                            true,
-                            false,
-                            Some("preprocessor".to_string()),
-                        )?;
-                        Some(args.args)
-                    }
-                    ScriptLang::Python3 => {
-                        let args = windmill_parser_py::parse_python_signature(
-                            &script_info.content,
-                            Some("preprocessor".to_string()),
-                            false,
-                        )?;
-                        Some(args.args)
-                    }
-                    _ => None,
-                };
-
-                if args.is_some_and(|args| args.iter().any(|arg| arg.name == "wm_trigger")) {
-                    RunnableFormat { version: RunnableFormatVersion::V1, has_preprocessor: true }
-                } else {
-                    runnable_format_from_schema(trigger_kind, has_preprocessor, script_info.schema)
-                }
+            if script_info.has_preprocessor.unwrap_or(false) {
+                (
+                    key,
+                    PreprocessorInfo::Preprocessor {
+                        content: script_info.content,
+                        language: script_info.language,
+                    },
+                )
             } else {
-                runnable_format_from_schema(trigger_kind, has_preprocessor, script_info.schema)
-            };
-
-            RUNNABLE_FORMAT_VERSION_CACHE.insert(key, runnable_format);
-
-            Ok(runnable_format)
+                (
+                    key,
+                    PreprocessorInfo::NoPreprocessor { schema: script_info.schema },
+                )
+            }
         }
-    }
+    };
+
+    let runnable_format = match preprocessor_info {
+        PreprocessorInfo::Preprocessor { content, language } => {
+            let args = get_preprocessor_args_from_content_and_language(&content, &language)?;
+            runnable_format_from_preprocessor_args(args)
+        }
+        PreprocessorInfo::NoPreprocessor { schema } => {
+            runnable_format_from_schema_without_preprocessor(trigger_kind, schema)
+        }
+    };
+
+    RUNNABLE_FORMAT_VERSION_CACHE.insert(key, runnable_format);
+
+    Ok(runnable_format)
 }
 
 #[allow(dead_code)]

backend/windmill-api/src/users.rs

@@ -8,6 +8,8 @@
 
 #![allow(non_snake_case)]
 
+use quick_cache::sync::Cache;
+
 use std::sync::atomic::AtomicBool;
 use std::sync::Arc;
 use std::time::Duration;
@@ -20,7 +22,8 @@ use crate::utils::{
     generate_instance_wide_unique_username, get_instance_username_or_create_pending,
 };
 use crate::{
-    db::DB, utils::require_super_admin, webhook_util::WebhookShared, COOKIE_DOMAIN, IS_SECURE,
+    auth::ExpiringAuthCache, db::DB, utils::require_super_admin, webhook_util::WebhookShared,
+    COOKIE_DOMAIN, IS_SECURE,
 };
 use argon2::{Argon2, PasswordHash, PasswordVerifier};
 use axum::{
@@ -214,6 +217,10 @@ pub async fn fetch_api_authed(
     fetch_api_authed_from_permissioned_as(permissioned_as, email, w_id, db, username_override).await
 }
 
+lazy_static::lazy_static! {
+    static ref API_AUTHED_CACHE: Cache<(String,String,String), ExpiringAuthCache> = Cache::new(300);
+}
+
 #[allow(unused)]
 pub async fn fetch_api_authed_from_permissioned_as(
     permissioned_as: String,
@@ -222,18 +229,43 @@ pub async fn fetch_api_authed_from_permissioned_as(
     db: &DB,
     username_override: Option<String>,
 ) -> error::Result<ApiAuthed> {
-    let authed =
-        fetch_authed_from_permissioned_as(permissioned_as, email.clone(), w_id, db).await?;
-    Ok(ApiAuthed {
-        username: authed.username,
-        email: email,
-        is_admin: authed.is_admin,
-        is_operator: authed.is_operator,
-        groups: authed.groups,
-        folders: authed.folders,
-        scopes: authed.scopes,
-        username_override: username_override,
-    })
+    let key = (w_id.to_string(), permissioned_as.clone(), email.clone());
+
+    let mut api_authed = match API_AUTHED_CACHE.get(&key) {
+        Some(expiring_authed) if expiring_authed.expiry > chrono::Utc::now() => {
+            tracing::debug!("API authed cache hit for user {}", email);
+            expiring_authed.authed
+        }
+        _ => {
+            tracing::debug!("API authed cache miss for user {}", email);
+            let authed =
+                fetch_authed_from_permissioned_as(permissioned_as, email.clone(), w_id, db).await?;
+
+            let api_authed = ApiAuthed {
+                username: authed.username,
+                email: email,
+                is_admin: authed.is_admin,
+                is_operator: authed.is_operator,
+                groups: authed.groups,
+                folders: authed.folders,
+                scopes: authed.scopes,
+                username_override: None,
+            };
+
+            API_AUTHED_CACHE.insert(
+                key,
+                ExpiringAuthCache {
+                    authed: api_authed.clone(),
+                    expiry: chrono::Utc::now() + chrono::Duration::try_seconds(120).unwrap(),
+                },
+            );
+
+            api_authed
+        }
+    };
+
+    api_authed.username_override = username_override;
+    Ok(api_authed)
 }
 
 #[derive(FromRow, Serialize)]

backend/windmill-api/src/utils.rs

@@ -6,6 +6,8 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
+use std::fmt::Display;
+
 use axum::{body::Body, response::Response};
 use regex::Regex;
 use serde::{Deserialize, Deserializer};
@@ -36,6 +38,16 @@ pub enum RunnableKind {
     Flow,
 }
 
+impl Display for RunnableKind {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let runnable_kind = match self {
+            RunnableKind::Script => "script",
+            RunnableKind::Flow => "flow"
+        };
+        write!(f, "{}", runnable_kind)
+    }
+}
+
 pub async fn require_super_admin(db: &DB, email: &str) -> error::Result<()> {
     let is_admin = is_super_admin_email(db, email).await?;
 
@@ -415,3 +427,10 @@ pub async fn acknowledge_all_critical_alerts(
     );
     Ok("All unacknowledged critical alerts acknowledged".to_string())
 }
+
+#[cfg(feature = "http_trigger")]
+#[derive(Clone)]
+pub struct ExpiringCacheEntry<T> {
+    pub value: T,
+    pub expiry: std::time::Instant,
+}

backend/windmill-api/src/websocket_triggers.rs

@@ -24,14 +24,14 @@ use windmill_audit::{audit_ee::audit_log, ActionKind};
 use windmill_common::{
     db::UserDB,
     error::{self, to_anyhow, JsonResult},
+    triggers::TriggerKind,
     utils::{not_found_if_none, paginate, report_critical_error, Pagination, StripPath},
     worker::{to_raw_value, CLOUD_HOSTED},
     INSTANCE_NAME,
 };
+use windmill_git_sync::handle_deployment_metadata;
 use windmill_queue::PushArgsOwned;
 
-use windmill_queue::TriggerKind;
-
 use crate::{
     capture::{insert_capture_payload, WebsocketTriggerConfig},
     db::{ApiAuthed, DB},
@@ -195,6 +195,7 @@ async fn get_websocket_trigger(
 
 async fn create_websocket_trigger(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path(w_id): Path<String>,
     Json(ct): Json<NewWebsocketTrigger>,
@@ -244,11 +245,23 @@ async fn create_websocket_trigger(
 
     tx.commit().await?;
 
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        windmill_git_sync::DeployedObject::WebsocketTrigger { path: ct.path.clone() },
+        Some(format!("WebSocket trigger '{}' created", ct.path)),
+        true,
+    )
+    .await?;
+
     Ok((StatusCode::CREATED, format!("{}", ct.path)))
 }
 
 async fn update_websocket_trigger(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(ct): Json<EditWebsocketTrigger>,
@@ -287,16 +300,27 @@ async fn update_websocket_trigger(
         &mut *tx,
         &authed,
         "websocket_triggers.update",
-        ActionKind::Create,
+        ActionKind::Update,
         &w_id,
-        Some(path),
+        Some(&ct.path),
         None,
     )
     .await?;
 
     tx.commit().await?;
 
-    Ok(path.to_string())
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        windmill_git_sync::DeployedObject::WebsocketTrigger { path: ct.path.clone() },
+        Some(format!("WebSocket trigger '{}' updated", ct.path)),
+        true,
+    )
+    .await?;
+
+    Ok(ct.path.to_string())
 }
 
 #[derive(Deserialize)]
@@ -306,6 +330,7 @@ pub struct SetEnabled {
 
 pub async fn set_enabled(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(payload): Json<SetEnabled>,
@@ -339,6 +364,17 @@ pub async fn set_enabled(
 
     tx.commit().await?;
 
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        windmill_git_sync::DeployedObject::WebsocketTrigger { path: path.to_string() },
+        Some(format!("WebSocket trigger '{}' updated", path)),
+        true,
+    )
+    .await?;
+
     Ok(format!(
         "succesfully updated WebSocket trigger at path {} to status {}",
         path, payload.enabled
@@ -347,6 +383,7 @@ pub async fn set_enabled(
 
 async fn delete_websocket_trigger(
     authed: ApiAuthed,
+    Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
 ) -> error::Result<String> {
@@ -373,6 +410,17 @@ async fn delete_websocket_trigger(
 
     tx.commit().await?;
 
+    handle_deployment_metadata(
+        &authed.email,
+        &authed.username,
+        &db,
+        &w_id,
+        windmill_git_sync::DeployedObject::WebsocketTrigger { path: path.to_string() },
+        Some(format!("WebSocket trigger '{}' deleted", path)),
+        true,
+    )
+    .await?;
+
     Ok(format!("WebSocket trigger {path} deleted"))
 }
 

backend/windmill-api/src/workspaces.rs

@@ -443,10 +443,12 @@ async fn get_settings(
         "SELECT workspace_id, slack_team_id, teams_team_id, teams_team_name, slack_name, slack_command_script, teams_command_script, slack_email, auto_invite_domain, auto_invite_operator, auto_add, customer_id, plan, webhook, deploy_to, ai_config, error_handler, error_handler_extra_args, error_handler_muted_on_cancel, large_file_storage, git_sync, deploy_ui, default_app, default_scripts, mute_critical_alerts, color, operator_settings, git_app_installations FROM workspace_settings WHERE workspace_id = $1",
         &w_id
     )
-    .fetch_one(&mut *tx)
+    .fetch_optional(&mut *tx)
     .await
     .map_err(|e| Error::internal_err(format!("getting settings: {e:#}")))?;
     tx.commit().await?;
+    let settings = not_found_if_none(settings, "workspace settings", &w_id)?;
+
     Ok(Json(settings))
 }
 

backend/windmill-api/src/workspaces_export.rs

@@ -763,6 +763,45 @@ pub(crate) async fn tarball_workspace(
                     .await?;
             }
         }
+
+        #[cfg(all(feature = "enterprise", feature = "mqtt_trigger"))]
+        {
+            let mqtt_triggers = sqlx::query_as!(
+                crate::mqtt_triggers::MqttTrigger,
+                r#"
+                SELECT
+                    mqtt_resource_path,
+                    subscribe_topics as "subscribe_topics: _",
+                    v3_config as "v3_config: _",
+                    v5_config as "v5_config: _",
+                    client_version AS "client_version: _",
+                    client_id,
+                    workspace_id,
+                    path,
+                    script_path,
+                    is_flow,
+                    edited_by,
+                    email,
+                    edited_at,
+                    server_id,
+                    last_server_ping,
+                    extra_perms,
+                    error,
+                    enabled
+                FROM 
+                    mqtt_trigger
+                "#,
+            )
+            .fetch_all(&mut *tx)
+            .await?;
+
+            for trigger in mqtt_triggers {
+                let trigger_str = &to_string_without_metadata(&trigger, false, None).unwrap();
+                archive
+                    .write_to_archive(&trigger_str, &format!("{}.mqtt_trigger.json", trigger.path))
+                    .await?;
+            }
+        }
     }
 
     if include_users.unwrap_or(false) {

backend/windmill-common/Cargo.toml

@@ -12,7 +12,7 @@ tantivy = []
 prometheus = ["dep:prometheus"]
 loki = ["dep:tracing-loki"]
 benchmark = []
-parquet = ["dep:object_store", "dep:aws-config", "dep:aws-sdk-sts"]
+parquet = ["dep:object_store", "dep:aws-config", "dep:aws-sdk-sts", "dep:datafusion"]
 aws_auth = ["dep:aws-sdk-sts", "dep:aws-config"]
 otel = ["dep:opentelemetry-semantic-conventions", "dep:opentelemetry-otlp", "dep:opentelemetry_sdk", 
     "dep:opentelemetry", "dep:tracing-opentelemetry", "dep:opentelemetry-appender-tracing", "dep:tonic"]
@@ -44,6 +44,9 @@ tracing = { workspace = true }
 axum = { workspace = true }
 hyper = { workspace = true }
 tokio = { workspace = true }
+tokio-stream.workspace = true
+tokio-util.workspace = true
+datafusion = { workspace = true, optional = true}
 reqwest = { workspace = true }
 tracing-subscriber = { workspace = true }
 lazy_static.workspace = true
@@ -67,8 +70,13 @@ async-stream.workspace = true
 const_format.workspace = true
 crc.workspace = true
 windmill-macros.workspace = true
+windmill-parser-sql.workspace = true
+windmill-parser-ts.workspace = true
+windmill-parser-py.workspace = true
 jsonwebtoken.workspace = true
 backon.workspace = true
+strum.workspace = true
+strum_macros.workspace = true
 
 semver.workspace = true
 croner = "2.0.6"

backend/windmill-common/src/db.rs

@@ -120,62 +120,6 @@ impl UserDB {
         .execute(&mut *tx)
         .await?;
 
-        // set_session_context(
-        //     username TEXT,
-        //     groups TEXT,
-        //     pgroups TEXT,
-        //     folders_read TEXT,
-        //     folders_write TEXT
-        // )
-
-        // sqlx::query!(
-        //     "SELECT set_config('session.user', $1, true)",
-        //     authed.username()
-        // )
-        // .fetch_optional(&mut *tx)
-        // .await?;
-
-        // sqlx::query!(
-        //     "SELECT set_config('session.groups', $1, true)",
-        //     &authed.groups().join(",")
-        // )
-        // .fetch_optional(&mut *tx)
-        // .await?;
-
-        // sqlx::query!(
-        //     "SELECT set_config('session.pgroups', $1, true)",
-        //     &authed
-        //         .groups()
-        //         .iter()
-        //         .map(|x| format!("g/{}", x))
-        //         .collect::<Vec<_>>()
-        //         .join(",")
-        // )
-        // .fetch_optional(&mut *tx)
-        // .await?;
-
-        // sqlx::query!(
-        //     "SELECT set_config('session.folders_read', $1, true)",
-        //     folders_read
-        //         .iter()
-        //         .map(|x| x.0.clone())
-        //         .collect::<Vec<_>>()
-        //         .join(",")
-        // )
-        // .fetch_optional(&mut *tx)
-        // .await?;
-
-        // sqlx::query!(
-        //     "SELECT set_config('session.folders_write', $1, true)",
-        //     folders_write
-        //         .iter()
-        //         .map(|x| x.0.clone())
-        //         .collect::<Vec<_>>()
-        //         .join(",")
-        // )
-        // .fetch_optional(&mut *tx)
-        // .await?;
-
         Ok(tx)
     }
 }

backend/windmill-common/src/jobs.rs

@@ -18,8 +18,9 @@ use crate::{
     flow_status::{FlowStatus, RestartedFrom},
     flows::{FlowNodeId, FlowValue, Retry},
     get_latest_deployed_hash_for_path, get_latest_flow_version_info_for_path,
-    scripts::{ScriptHash, ScriptLang},
+    scripts::{get_full_hub_script_by_path, ScriptHash, ScriptLang},
     users::username_to_permissioned_as,
+    utils::{StripPath, HTTP_CLIENT},
     worker::{to_raw_value, TMP_DIR},
     FlowVersionInfo, ScriptHashInfo,
 };
@@ -270,6 +271,7 @@ impl CompletedJob {
 pub enum JobPayload {
     ScriptHub {
         path: String,
+        apply_preprocessor: bool,
     },
     ScriptHash {
         hash: ScriptHash,
@@ -387,6 +389,25 @@ pub struct OnBehalfOf {
     pub permissioned_as: String,
 }
 
+pub fn get_has_preprocessor_from_content_and_lang(
+    content: &str,
+    language: &ScriptLang,
+) -> error::Result<bool> {
+    let has_preprocessor = match language {
+        ScriptLang::Bun | ScriptLang::Bunnative | ScriptLang::Deno | ScriptLang::Nativets => {
+            let args = windmill_parser_ts::parse_deno_signature(&content, true, true, None)?;
+            args.has_preprocessor.unwrap_or(false)
+        }
+        ScriptLang::Python3 => {
+            let args = windmill_parser_py::parse_python_signature(&content, None, true)?;
+            args.has_preprocessor.unwrap_or(false)
+        }
+        _ => false,
+    };
+
+    Ok(has_preprocessor)
+}
+
 pub async fn script_path_to_payload<'e, A: sqlx::Acquire<'e, Database = Postgres> + Send>(
     script_path: &str,
     db: A,
@@ -399,63 +420,74 @@ pub async fn script_path_to_payload<'e, A: sqlx::Acquire<'e, Database = Postgres
     Option<i32>,
     Option<OnBehalfOf>,
 )> {
-    let (job_payload, tag, delete_after_use, script_timeout, on_behalf_of) =
-        if script_path.starts_with("hub/") {
-            (
-                JobPayload::ScriptHub { path: script_path.to_owned() },
-                None,
-                None,
-                None,
-                None,
-            )
+    let (job_payload, tag, delete_after_use, script_timeout, on_behalf_of) = if script_path
+        .starts_with("hub/")
+    {
+        let hub_script =
+            get_full_hub_script_by_path(StripPath(script_path.to_string()), &HTTP_CLIENT, None)
+                .await?;
+
+        let has_preprocessor =
+            get_has_preprocessor_from_content_and_lang(&hub_script.content, &hub_script.language)?;
+
+        (
+            JobPayload::ScriptHub {
+                path: script_path.to_owned(),
+                apply_preprocessor: has_preprocessor && !skip_preprocessor.unwrap_or(false),
+            },
+            None,
+            None,
+            None,
+            None,
+        )
+    } else {
+        let ScriptHashInfo {
+            hash,
+            tag,
+            concurrency_key,
+            concurrent_limit,
+            concurrency_time_window_s,
+            cache_ttl,
+            language,
+            dedicated_worker,
+            priority,
+            delete_after_use,
+            timeout,
+            has_preprocessor,
+            on_behalf_of_email,
+            created_by,
+            ..
+        } = get_latest_deployed_hash_for_path(db, w_id, script_path).await?;
+
+        let on_behalf_of = if let Some(email) = on_behalf_of_email {
+            Some(OnBehalfOf {
+                email,
+                permissioned_as: username_to_permissioned_as(created_by.as_str()),
+            })
         } else {
-            let ScriptHashInfo {
-                hash,
-                tag,
-                concurrency_key,
+            None
+        };
+
+        (
+            JobPayload::ScriptHash {
+                hash: ScriptHash(hash),
+                path: script_path.to_owned(),
+                custom_concurrency_key: concurrency_key,
                 concurrent_limit,
                 concurrency_time_window_s,
-                cache_ttl,
+                cache_ttl: cache_ttl,
                 language,
                 dedicated_worker,
                 priority,
-                delete_after_use,
-                timeout,
-                has_preprocessor,
-                on_behalf_of_email,
-                created_by,
-                ..
-            } = get_latest_deployed_hash_for_path(db, w_id, script_path).await?;
-
-            let on_behalf_of = if let Some(email) = on_behalf_of_email {
-                Some(OnBehalfOf {
-                    email,
-                    permissioned_as: username_to_permissioned_as(created_by.as_str()),
-                })
-            } else {
-                None
-            };
-
-            (
-                JobPayload::ScriptHash {
-                    hash: ScriptHash(hash),
-                    path: script_path.to_owned(),
-                    custom_concurrency_key: concurrency_key,
-                    concurrent_limit,
-                    concurrency_time_window_s,
-                    cache_ttl: cache_ttl,
-                    language,
-                    dedicated_worker,
-                    priority,
-                    apply_preprocessor: !skip_preprocessor.unwrap_or(false)
-                        && has_preprocessor.unwrap_or(false),
-                },
-                tag,
-                delete_after_use,
-                timeout,
-                on_behalf_of,
-            )
-        };
+                apply_preprocessor: !skip_preprocessor.unwrap_or(false)
+                    && has_preprocessor.unwrap_or(false),
+            },
+            tag,
+            delete_after_use,
+            timeout,
+            on_behalf_of,
+        )
+    };
     Ok((
         job_payload,
         tag,

backend/windmill-common/src/lib.rs

@@ -62,6 +62,7 @@ pub mod utils;
 pub mod variables;
 pub mod worker;
 pub mod workspaces;
+pub mod triggers;
 
 pub const DEFAULT_MAX_CONNECTIONS_SERVER: u32 = 50;
 pub const DEFAULT_MAX_CONNECTIONS_WORKER: u32 = 5;

backend/windmill-common/src/s3_helpers.rs

@@ -16,10 +16,35 @@ use object_store::{aws::AmazonS3Builder, ClientOptions};
 use reqwest::header::HeaderMap;
 use serde::{Deserialize, Serialize};
 #[cfg(feature = "parquet")]
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 #[cfg(feature = "parquet")]
 use tokio::sync::RwLock;
 
+#[cfg(feature = "parquet")]
+use crate::error::to_anyhow;
+#[cfg(feature = "parquet")]
+use crate::utils::rd_string;
+#[cfg(feature = "parquet")]
+use bytes::Bytes;
+#[cfg(feature = "parquet")]
+use datafusion::arrow::array::{RecordBatch, RecordBatchWriter};
+#[cfg(feature = "parquet")]
+use datafusion::arrow::error::ArrowError;
+#[cfg(feature = "parquet")]
+use datafusion::arrow::json::writer::JsonArray;
+#[cfg(feature = "parquet")]
+use datafusion::arrow::{csv, json};
+#[cfg(feature = "parquet")]
+use datafusion::parquet::arrow::ArrowWriter;
+#[cfg(feature = "parquet")]
+use futures::TryStreamExt;
+#[cfg(feature = "parquet")]
+use std::io::Write;
+#[cfg(feature = "parquet")]
+use tokio::task;
+#[cfg(feature = "parquet")]
+use windmill_parser_sql::S3ModeFormat;
+
 #[cfg(feature = "parquet")]
 lazy_static::lazy_static! {
 
@@ -389,6 +414,15 @@ pub enum ObjectSettings {
     Azure(AzureBlobResource),
 }
 
+impl ObjectSettings {
+    pub fn get_bucket(&self) -> Option<&String> {
+        match self {
+            ObjectSettings::S3(s3_settings) => s3_settings.bucket.as_ref(),
+            ObjectSettings::Azure(azure_settings) => Some(&azure_settings.container_name),
+        }
+    }
+}
+
 #[cfg(feature = "parquet")]
 pub async fn build_object_store_from_settings(
     settings: ObjectSettings,
@@ -480,3 +514,184 @@ pub fn bundle(w_id: &str, hash: &str) -> String {
 pub fn raw_app(w_id: &str, version: &i64) -> String {
     format!("/home/rfiszel/raw_app/{}/{}", w_id, version)
 }
+
+// Originally used a Arc<Mutex<dyn RecordBatchWriter + Send>>
+// But cannot call .close() on it because it moves the value and the object is not Sized
+#[cfg(feature = "parquet")]
+enum RecordBatchWriterEnum {
+    Parquet(ArrowWriter<ChannelWriter>),
+    Csv(csv::Writer<ChannelWriter>),
+    Json(json::Writer<ChannelWriter, JsonArray>),
+}
+
+#[cfg(feature = "parquet")]
+impl RecordBatchWriter for RecordBatchWriterEnum {
+    fn write(&mut self, batch: &RecordBatch) -> Result<(), ArrowError> {
+        match self {
+            RecordBatchWriterEnum::Parquet(w) => w.write(batch).map_err(|e| e.into()),
+            RecordBatchWriterEnum::Csv(w) => w.write(batch),
+            RecordBatchWriterEnum::Json(w) => w.write(batch),
+        }
+    }
+
+    fn close(self) -> Result<(), ArrowError> {
+        match self {
+            RecordBatchWriterEnum::Parquet(w) => w.close().map_err(|e| e.into()).map(drop),
+            RecordBatchWriterEnum::Csv(w) => w.close(),
+            RecordBatchWriterEnum::Json(w) => w.close(),
+        }
+    }
+}
+
+#[cfg(feature = "parquet")]
+struct ChannelWriter {
+    sender: tokio::sync::mpsc::Sender<anyhow::Result<Bytes>>,
+}
+
+#[cfg(feature = "parquet")]
+impl Write for ChannelWriter {
+    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+        let data: Bytes = buf.to_vec().into();
+        self.sender.blocking_send(Ok(data)).map_err(|e| {
+            std::io::Error::new(
+                std::io::ErrorKind::BrokenPipe,
+                format!("Channel send error: {}", e),
+            )
+        })?;
+        Ok(buf.len())
+    }
+
+    fn flush(&mut self) -> std::io::Result<()> {
+        Ok(())
+    }
+}
+
+#[cfg(not(feature = "parquet"))]
+pub async fn convert_json_line_stream<E: Into<anyhow::Error>>(
+    mut _stream: impl futures::TryStreamExt<Item = Result<serde_json::Value, E>> + Unpin,
+    _output_format: windmill_parser_sql::S3ModeFormat,
+) -> anyhow::Result<impl futures::TryStreamExt<Item = anyhow::Result<bytes::Bytes>>> {
+    Ok(async_stream::stream! {
+        yield Err(anyhow::anyhow!("Parquet feature is not enabled. Cannot convert JSON line stream."));
+    })
+}
+
+#[cfg(feature = "parquet")]
+pub async fn convert_json_line_stream<E: Into<anyhow::Error>>(
+    mut stream: impl TryStreamExt<Item = Result<serde_json::Value, E>> + Unpin,
+    output_format: S3ModeFormat,
+) -> anyhow::Result<impl TryStreamExt<Item = anyhow::Result<bytes::Bytes>>> {
+    const MAX_MPSC_SIZE: usize = 1000;
+
+    use datafusion::{execution::context::SessionContext, prelude::NdJsonReadOptions};
+    use futures::StreamExt;
+    use std::path::PathBuf;
+    use tokio::io::AsyncWriteExt;
+
+    let mut path = PathBuf::from(std::env::temp_dir());
+    path.push(format!("{}.json", rd_string(8)));
+    let path_str = path
+        .to_str()
+        .ok_or_else(|| anyhow::anyhow!("Invalid path"))?;
+
+    // Write the stream to a temporary file
+    let mut file: tokio::fs::File = tokio::fs::File::create(&path).await.map_err(to_anyhow)?;
+
+    while let Some(chunk) = stream.next().await {
+        match chunk {
+            Ok(chunk) => {
+                // Convert the chunk to bytes and write it to the file
+                let b: bytes::Bytes = serde_json::to_string(&chunk)?.into();
+                file.write_all(&b).await?;
+                file.write_all(b"\n").await?;
+            }
+            Err(e) => {
+                tokio::fs::remove_file(&path).await?;
+                return Err(e.into());
+            }
+        }
+    }
+
+    file.flush().await?;
+    file.sync_all().await?;
+    drop(file);
+
+    let ctx = SessionContext::new();
+    ctx.register_json(
+        "my_table",
+        path_str,
+        NdJsonReadOptions { ..Default::default() },
+    )
+    .await
+    .map_err(to_anyhow)?;
+
+    let df = ctx.sql("SELECT * FROM my_table").await.map_err(to_anyhow)?;
+    let schema = df.schema().clone().into();
+    let mut datafusion_stream = df.execute_stream().await.map_err(to_anyhow)?;
+
+    let (tx, rx) = tokio::sync::mpsc::channel(MAX_MPSC_SIZE);
+    let writer: Arc<Mutex<Option<RecordBatchWriterEnum>>> =
+        Arc::new(Mutex::new(Some(match output_format {
+            S3ModeFormat::Parquet => RecordBatchWriterEnum::Parquet(
+                ArrowWriter::try_new(ChannelWriter { sender: tx.clone() }, Arc::new(schema), None)
+                    .map_err(to_anyhow)?,
+            ),
+
+            S3ModeFormat::Csv => {
+                RecordBatchWriterEnum::Csv(csv::Writer::new(ChannelWriter { sender: tx.clone() }))
+            }
+            S3ModeFormat::Json => {
+                RecordBatchWriterEnum::Json(json::Writer::<_, JsonArray>::new(ChannelWriter {
+                    sender: tx.clone(),
+                }))
+            }
+        })));
+
+    // This spawn is so that the data is sent in the background. Else the function would deadlock
+    // when hitting the mpsc channel limit
+    task::spawn(async move {
+        while let Some(batch_result) = datafusion_stream.next().await {
+            let batch: RecordBatch = match batch_result {
+                Ok(batch) => batch,
+                Err(e) => {
+                    tracing::error!("Error in datafusion stream: {:?}", &e);
+                    match tx.send(Err(e.into())).await {
+                        Ok(_) => {}
+                        Err(e) => tracing::error!("Failed to write error to channel: {:?}", &e),
+                    }
+                    break;
+                }
+            };
+            let writer = writer.clone();
+            // Writer calls blocking_send which would crash if called from the async context
+            let write_result = task::spawn_blocking(move || {
+                // SAFETY: We await so the code is actually sequential, lock unwrap cannot panic
+                // Second unwrap is ok because we initialized the option with Some
+                writer.lock().unwrap().as_mut().unwrap().write(&batch)
+            })
+            .await;
+            match write_result {
+                Ok(Ok(_)) => {}
+                Ok(Err(e)) => {
+                    tracing::error!("Error writing batch: {:?}", &e);
+                    match tx.send(Err(e.into())).await {
+                        Ok(_) => {}
+                        Err(e) => tracing::error!("Failed to write error to channel: {:?}", &e),
+                    }
+                }
+                Err(e) => tracing::error!("Error in blocking task: {:?}", &e),
+            };
+        }
+        task::spawn_blocking(move || {
+            writer.lock().unwrap().take().unwrap().close()?;
+            drop(writer);
+            Ok::<_, anyhow::Error>(())
+        })
+        .await??;
+        drop(ctx);
+        tokio::fs::remove_file(&path).await?;
+        Ok::<_, anyhow::Error>(())
+    });
+
+    Ok(tokio_stream::wrappers::ReceiverStream::new(rx))
+}

backend/windmill-common/src/scripts.rs

@@ -247,6 +247,7 @@ pub struct ListableScript {
     #[sqlx(default)]
     #[serde(skip_serializing_if = "Option::is_none")]
     pub deployment_msg: Option<String>,
+    pub kind: ScriptKind,
 }
 
 fn is_false(x: &bool) -> bool {

backend/windmill-common/src/triggers.rs

@@ -0,0 +1,79 @@
+use quick_cache::sync::Cache;
+use serde::{Deserialize, Serialize};
+use std::fmt;
+use strum::EnumIter;
+
+#[derive(Eq, PartialEq, Hash)]
+pub enum HubOrWorkspaceId {
+    Hub,
+    WorkspaceId(String),
+}
+
+type RunnableFormatCacheKey = (HubOrWorkspaceId, i64, TriggerKind);
+
+#[derive(Debug, Clone, Eq, PartialEq, Hash, Copy)]
+pub struct RunnableFormat {
+    pub version: RunnableFormatVersion,
+    pub has_preprocessor: bool,
+}
+
+#[derive(Debug, Clone, Eq, PartialEq, Hash, Copy)]
+pub enum RunnableFormatVersion {
+    V1,
+    V2,
+}
+
+lazy_static::lazy_static! {
+    pub static ref RUNNABLE_FORMAT_VERSION_CACHE: Cache<RunnableFormatCacheKey, RunnableFormat> = Cache::new(1000);
+}
+
+#[derive(sqlx::Type, Serialize, Deserialize, Debug, Clone, Eq, PartialEq, Hash, EnumIter)]
+#[sqlx(type_name = "TRIGGER_KIND", rename_all = "lowercase")]
+#[serde(rename_all = "lowercase")]
+pub enum TriggerKind {
+    Webhook,
+    Http,
+    Websocket,
+    Kafka,
+    Email,
+    Nats,
+    Mqtt,
+    Sqs,
+    Postgres,
+    Gcp,
+}
+
+impl TriggerKind {
+    pub fn to_key(&self) -> String {
+        match self {
+            TriggerKind::Webhook => "webhook".to_string(),
+            TriggerKind::Http => "http".to_string(),
+            TriggerKind::Websocket => "websocket".to_string(),
+            TriggerKind::Kafka => "kafka".to_string(),
+            TriggerKind::Email => "email".to_string(),
+            TriggerKind::Nats => "nats".to_string(),
+            TriggerKind::Mqtt => "mqtt".to_string(),
+            TriggerKind::Sqs => "sqs".to_string(),
+            TriggerKind::Postgres => "postgres".to_string(),
+            TriggerKind::Gcp => "gcp".to_string(),
+        }
+    }
+}
+
+impl fmt::Display for TriggerKind {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let s = match self {
+            TriggerKind::Webhook => "webhook",
+            TriggerKind::Http => "http",
+            TriggerKind::Websocket => "websocket",
+            TriggerKind::Kafka => "kafka",
+            TriggerKind::Email => "email",
+            TriggerKind::Nats => "nats",
+            TriggerKind::Mqtt => "mqtt",
+            TriggerKind::Sqs => "sqs",
+            TriggerKind::Postgres => "postgres",
+            TriggerKind::Gcp => "gcp",
+        };
+        write!(f, "{}", s)
+    }
+}

backend/windmill-common/src/utils.rs

@@ -719,7 +719,10 @@ impl<F: Future> Future for WarnAfterFuture<F> {
         // Poll the timeout future to check if it has elapsed.
         if !*this.warned {
             if this.timeout.poll(cx).is_ready() {
-                tracing::warn!(location = this.location, "SLOW_QUERY: query to db taking longer than expected (> {} seconds). This is a sign the database is under heavy load, query is too heavy or database is undersized",
+                tracing::warn!(
+                    location = this.location,
+                    "SLOW_QUERY: query {} to db taking longer than expected (> {} seconds)",
+                    this.location,
                     this.seconds,
                 );
                 *this.warned = true;
@@ -733,7 +736,8 @@ impl<F: Future> Future for WarnAfterFuture<F> {
                     let elapsed = this.start_time.elapsed();
                     tracing::warn!(
                         location = this.location,
-                        "SLOW_QUERY: completed with total duration: {:.2?}",
+                        "SLOW_QUERY: completed query {} with total duration: {:.2?}",
+                        this.location,
                         elapsed
                     );
                 }

backend/windmill-common/src/worker.rs

@@ -516,6 +516,7 @@ fn parse_file<T: FromStr>(path: &str) -> Option<T> {
 pub struct PythonAnnotations {
     pub no_cache: bool,
     pub no_postinstall: bool,
+    pub skip_result_postprocessing: bool,
     pub py310: bool,
     pub py311: bool,
     pub py312: bool,

backend/windmill-git-sync/src/lib.rs

@@ -27,6 +27,14 @@ pub enum DeployedObject {
     ResourceType { path: String },
     User { email: String },
     Group { name: String },
+    HttpTrigger { path: String },
+    WebsocketTrigger { path: String },
+    KafkaTrigger { path: String },
+    NatsTrigger { path: String },
+    PostgresTrigger { path: String },
+    MqttTrigger { path: String },
+    SqsTrigger { path: String },
+    GcpTrigger { path: String },
 }
 
 impl DeployedObject {
@@ -42,6 +50,14 @@ impl DeployedObject {
             DeployedObject::ResourceType { path, .. } => path.to_owned(),
             DeployedObject::User { email } => format!("users/{email}"),
             DeployedObject::Group { name } => format!("groups/{name}"),
+            DeployedObject::HttpTrigger { path } => path.to_owned(),
+            DeployedObject::WebsocketTrigger { path } => path.to_owned(),
+            DeployedObject::KafkaTrigger { path } => path.to_owned(),
+            DeployedObject::NatsTrigger { path } => path.to_owned(),
+            DeployedObject::PostgresTrigger { path } => path.to_owned(),
+            DeployedObject::MqttTrigger { path } => path.to_owned(),
+            DeployedObject::SqsTrigger { path } => path.to_owned(),
+            DeployedObject::GcpTrigger { path } => path.to_owned(),
         }
     }
 
@@ -64,6 +80,14 @@ impl DeployedObject {
             DeployedObject::ResourceType { .. } => None,
             DeployedObject::User { .. } => None,
             DeployedObject::Group { .. } => None,
+            DeployedObject::HttpTrigger { .. } => None,
+            DeployedObject::WebsocketTrigger { .. } => None,
+            DeployedObject::KafkaTrigger { .. } => None,
+            DeployedObject::NatsTrigger { .. } => None,
+            DeployedObject::PostgresTrigger { .. } => None,
+            DeployedObject::MqttTrigger { .. } => None,
+            DeployedObject::SqsTrigger { .. } => None,
+            DeployedObject::GcpTrigger { .. } => None,
         }
     }
 }

backend/windmill-queue/src/jobs.rs

@@ -6,7 +6,6 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
-use std::fmt;
 use std::{collections::HashMap, sync::Arc, vec};
 
 use anyhow::Context;
@@ -140,6 +139,7 @@ pub struct CanceledBy {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct JobCompleted {
     pub job: Arc<MiniPulledJob>,
+    pub preprocessed_args: Option<HashMap<String, Box<RawValue>>>,
     pub result: Arc<Box<RawValue>>,
     pub result_columns: Option<Vec<String>>,
     pub mem_peak: i32,
@@ -980,6 +980,7 @@ pub async fn add_completed_job<T: Serialize + Send + Sync + ValidableJson>(
             is_flow_step = queued_job.is_flow_step(),
             language = ?queued_job.script_lang,
             scheduled_for = ?queued_job.scheduled_for,
+            workspace_id = ?queued_job.workspace_id,
             success,
             "inserted completed job: {} (success: {success})",
             queued_job.id
@@ -1943,40 +1944,6 @@ async fn handle_successful_schedule<'a, 'c, T: Serialize + Send + Sync>(
     Ok(())
 }
 
-#[derive(sqlx::Type, Serialize, Deserialize, Debug, Clone, Eq, PartialEq, Hash)]
-#[sqlx(type_name = "TRIGGER_KIND", rename_all = "lowercase")]
-#[serde(rename_all = "lowercase")]
-pub enum TriggerKind {
-    Webhook,
-    Http,
-    Websocket,
-    Kafka,
-    Email,
-    Nats,
-    Mqtt,
-    Sqs,
-    Postgres,
-    Gcp
-}
-
-
-impl TriggerKind {
-    pub fn to_key(&self) -> String {
-        match self {
-            TriggerKind::Webhook => "webhook".to_string(),
-            TriggerKind::Http => "http".to_string(),
-            TriggerKind::Websocket => "websocket".to_string(),
-            TriggerKind::Kafka => "kafka".to_string(),
-            TriggerKind::Email => "email".to_string(),
-            TriggerKind::Nats => "nats".to_string(),
-            TriggerKind::Mqtt => "mqtt".to_string(),
-            TriggerKind::Sqs => "sqs".to_string(),
-            TriggerKind::Postgres => "postgres".to_string(),
-            TriggerKind::Gcp => "gcp".to_string(),
-        }
-    }
-}
-
 #[derive(sqlx::Type, Serialize, Deserialize, Debug, Clone)]
 #[sqlx(type_name = "JOB_TRIGGER_KIND", rename_all = "lowercase")]
 #[serde(rename_all = "lowercase")]
@@ -1994,23 +1961,6 @@ pub enum JobTriggerKind {
     Gcp
 }
 
-impl fmt::Display for TriggerKind {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        let s = match self {
-            TriggerKind::Webhook => "webhook",
-            TriggerKind::Http => "http",
-            TriggerKind::Websocket => "websocket",
-            TriggerKind::Kafka => "kafka",
-            TriggerKind::Email => "email",
-            TriggerKind::Nats => "nats",
-            TriggerKind::Mqtt => "mqtt",
-            TriggerKind::Sqs => "sqs",
-            TriggerKind::Postgres => "postgres",
-            TriggerKind::Gcp => "gcp",
-        };
-        write!(f, "{}", s)
-    }
-}
 
 #[derive(sqlx::FromRow, Debug, Clone, Serialize, Deserialize)]
 pub struct MiniPulledJob {
@@ -2664,7 +2614,7 @@ async fn concurrency_key(db: &Pool<Postgres>, id: &Uuid) -> windmill_common::err
     )
 }
 
-fn interpolate_args(x: String, args: &PushArgs, workspace_id: &str) -> String {
+pub fn interpolate_args(x: String, args: &PushArgs, workspace_id: &str) -> String {
     // Save this value to avoid parsing twice
     let workspaced = x.as_str().replace("$workspace", workspace_id).to_string();
     if RE_ARG_TAG.is_match(&workspaced) {
@@ -2702,7 +2652,6 @@ fn interpolate_args(x: String, args: &PushArgs, workspace_id: &str) -> String {
                     .trim_matches('"')
                     .to_string()
             };
-            tracing::error!("arg_value: {}", arg_value);
             interpolated =
                 interpolated.replace(format!("$args[{}]", arg_name).as_str(), &arg_value);
         }
@@ -3587,7 +3536,7 @@ pub async fn push<'c, 'd>(
             None,
             None,
         ),
-        JobPayload::ScriptHub { path } => {
+        JobPayload::ScriptHub { path, apply_preprocessor } => {
             if path == "hub/7771/slack" || path == "hub/7836/slack" || path == "hub/9084/slack" {
                 // these scripts send app reports to slack
                 // they use the slack bot token and should therefore be run with permissions to access it
@@ -3595,6 +3544,10 @@ pub async fn push<'c, 'd>(
                 email = SUPERADMIN_NOTIFICATION_EMAIL;
             }
 
+            if apply_preprocessor {
+                preprocessed = Some(false);
+            }
+
             let hub_script =
                 get_full_hub_script_by_path(StripPath(path.clone()), &HTTP_CLIENT, Some(_db))
                     .await?;
@@ -3887,11 +3840,13 @@ pub async fn push<'c, 'd>(
             let cache_ttl = value.cache_ttl.map(|x| x as i32);
             let custom_concurrency_key = value.concurrency_key.clone();
             let concurrency_time_window_s = value.concurrency_time_window_s;
-            let concurrent_limit = value.concurrent_limit;
+            let mut concurrent_limit = value.concurrent_limit;
 
             if !apply_preprocessor {
                 value.preprocessor_module = None;
             } else {
+                tag = None;
+                concurrent_limit = None;
                 preprocessed = Some(false);
             }
 
@@ -4173,26 +4128,7 @@ pub async fn push<'c, 'd>(
     };
 
     if concurrent_limit.is_some() {
-        let concurrency_key = custom_concurrency_key
-            .map(|x| interpolate_args(x, &args, workspace_id))
-            .unwrap_or(fullpath_with_workspace(
-                workspace_id,
-                script_path.as_ref(),
-                &job_kind,
-            ));
-        sqlx::query!(
-            "WITH inserted_concurrency_counter AS (
-                INSERT INTO concurrency_counter (concurrency_id, job_uuids) 
-                VALUES ($1, '{}'::jsonb)
-                ON CONFLICT DO NOTHING
-            )
-            INSERT INTO concurrency_key(key, job_id) VALUES ($1, $2)",
-            concurrency_key,
-            job_id,
-        )
-        .execute(&mut *tx)
-        .await
-        .map_err(|e| Error::internal_err(format!("Could not insert concurrency_key={concurrency_key} for job_id={job_id} script_path={script_path:?} workspace_id={workspace_id}: {e:#}")))?;
+        insert_concurrency_key(workspace_id, &args, &script_path, job_kind, custom_concurrency_key, &mut tx, job_id).await?;
     }
 
     let stringified_args = if *JOB_ARGS_AUDIT_LOGS {
@@ -4210,6 +4146,7 @@ pub async fn push<'c, 'd>(
         Some("preprocessor") => Some(false),
         _ => None,
     });
+    
 
     let job_authed = match authed {
         Some(authed)
@@ -4356,6 +4293,7 @@ pub async fn push<'c, 'd>(
             Json(flow_status) as Json<FlowStatus>,
         )
         .execute(&mut *tx)
+        .warn_after_seconds(1)
         .await?;
     }
 
@@ -4424,12 +4362,38 @@ pub async fn push<'c, 'd>(
             script_path.as_ref().map(|x| x.as_str()),
             Some(hm),
         )
+        .warn_after_seconds(1)
         .await?;
     }
 
     Ok((job_id, tx))
 }
 
+pub async fn insert_concurrency_key<'d, 'c>(workspace_id: &str, args: &PushArgs<'d>, script_path: &Option<String>, job_kind: JobKind, custom_concurrency_key: Option<String>, tx: &mut Transaction<'c, Postgres>, job_id: Uuid) -> Result<(), Error> {
+    let concurrency_key = custom_concurrency_key
+        .map(|x| interpolate_args(x, args, workspace_id))
+        .unwrap_or(fullpath_with_workspace(
+            workspace_id,
+            script_path.as_ref(),
+            &job_kind,
+        ));
+    sqlx::query!(
+        "WITH inserted_concurrency_counter AS (
+                INSERT INTO concurrency_counter (concurrency_id, job_uuids) 
+                VALUES ($1, '{}'::jsonb)
+                ON CONFLICT DO NOTHING
+            )
+            INSERT INTO concurrency_key(key, job_id) VALUES ($1, $2)",
+        concurrency_key,
+        job_id,
+    )
+    .execute(&mut **tx)
+    .warn_after_seconds(3)
+    .await
+    .map_err(|e| Error::internal_err(format!("Could not insert concurrency_key={concurrency_key} for job_id={job_id} script_path={script_path:?} workspace_id={workspace_id}: {e:#}")))?;
+    Ok(())
+}
+
 pub fn canceled_job_to_result(job: &MiniPulledJob) -> serde_json::Value {
     let reason = job
         .canceled_reason

backend/windmill-worker/Cargo.toml

@@ -57,6 +57,7 @@ sqlx.workspace = true
 uuid.workspace = true
 tracing.workspace = true
 tokio.workspace = true
+tokio-stream.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 futures.workspace = true
@@ -90,6 +91,7 @@ deno_tls = { workspace = true, optional = true }
 deno_permissions = { workspace = true, optional = true }
 deno_io = { workspace = true, optional = true }
 deno_error = { workspace = true, optional = true }
+async-stream.workspace = true
 
 postgres-native-tls.workspace = true
 native-tls.workspace = true

backend/windmill-worker/src/ansible_executor.rs

@@ -786,14 +786,30 @@ pub async fn handle_ansible_job(
         if let Ok(lockfile) = serde_json::from_str(s) {
             Some(lockfile)
         } else {
-            append_logs(
-                &job.id,
-                &job.workspace_id,
-                format!("WARN: lockfile could not be parsed: `{s}`"),
-                conn,
-            )
-            .await;
-            None
+            if !s.trim_start().starts_with('{') {
+                append_logs(
+                    &job.id,
+                    &job.workspace_id,
+                    format!("WARN: lockfile seems to be in an older version, roles and collections are therefore using the latest version and not the one locked at deployment. Redeploy the script to correct this"),
+                    conn,
+                )
+                .await;
+                Some(AnsibleDependencyLocks {
+                    python_lockfile: s.to_string(),
+                    git_repos: HashMap::new(),
+                    collections_and_roles: String::new(),
+                    collections_and_roles_logs: String::new(),
+                })
+            } else {
+                append_logs(
+                    &job.id,
+                    &job.workspace_id,
+                    format!("WARN: lockfile could not be parsed: {s}"),
+                    conn,
+                )
+                .await;
+                None
+            }
         }
     } else {
         None
@@ -948,7 +964,13 @@ pub async fn handle_ansible_job(
             let empty = String::new();
             let (lockfile, logs) = req_lockfiles
                 .as_ref()
-                .map(|r| (&r.collections_and_roles, &r.collections_and_roles_logs))
+                .and_then(|r| {
+                    if r.collections_and_roles.is_empty() {
+                        None
+                    } else {
+                        Some((&r.collections_and_roles, &r.collections_and_roles_logs))
+                    }
+                })
                 .unwrap_or((collections, &empty));
 
             if !logs.is_empty() {

backend/windmill-worker/src/bash_executor.rs

@@ -285,6 +285,8 @@ async fn handle_docker_job(
     occupancy_metrics: &mut OccupancyMetrics,
     killpill_rx: &mut tokio::sync::broadcast::Receiver<()>,
 ) -> Result<Box<RawValue>, Error> {
+    use crate::job_logger::append_logs_with_compaction;
+
     let client = bollard::Docker::connect_with_unix_defaults().map_err(to_anyhow)?;
 
     let container_id = job_id.to_string();
@@ -303,7 +305,7 @@ async fn handle_docker_job(
             .await
             .map_err(|e| {
                 tracing::error!("Error waiting for container: {:?}", e);
-                anyhow::anyhow!("Error waiting for container")
+                anyhow::anyhow!("Error waiting for container: {:?}", e)
             })?;
         let waited = wait.first().map(|x| x.status_code);
         Ok(waited)
@@ -313,6 +315,7 @@ async fn handle_docker_job(
     let w_id = workspace_id.to_string();
     let j_id = job_id.clone();
     let conn2 = conn.clone();
+    let worker_name2 = worker_name.to_string();
     let (tx, mut rx) = tokio::sync::broadcast::channel::<()>(1);
 
     let mut killpill_rx = killpill_rx.resubscribe();
@@ -334,7 +337,21 @@ async fn handle_docker_job(
                     log = log_stream.next() => {
                         match log {
                             Some(Ok(log)) => {
-                                append_logs(&j_id, w_id.clone(), log.to_string(), &conn2).await;
+                                match &conn2 {
+                                    Connection::Sql(db) => {
+                                        append_logs_with_compaction(
+                                            &j_id,
+                                            &w_id,
+                                            &log.to_string(),
+                                            &db,
+                                            &worker_name2,
+                                        )
+                                        .await;
+                                    }
+                                    c @ Connection::Http(_) => {
+                                        append_logs(&j_id, &w_id, &log.to_string(), &c).await;
+                                    }
+                                }
                             }
                             Some(Err(e)) => {
                                 tracing::error!("Error getting logs: {:?}", e);

backend/windmill-worker/src/bigquery_executor.rs

@@ -1,20 +1,24 @@
 use std::collections::HashMap;
 
 use futures::future::BoxFuture;
-use futures::FutureExt;
+use futures::{FutureExt, StreamExt};
 use reqwest::Client;
 use serde_json::{json, value::RawValue, Value};
 use windmill_common::error::to_anyhow;
+use windmill_common::s3_helpers::convert_json_line_stream;
 use windmill_common::worker::Connection;
 use windmill_common::{error::Error, worker::to_raw_value};
 use windmill_parser_sql::{
-    parse_bigquery_sig, parse_db_resource, parse_sql_blocks, parse_sql_statement_named_params,
+    parse_bigquery_sig, parse_db_resource, parse_s3_mode, parse_sql_blocks,
+    parse_sql_statement_named_params,
 };
 use windmill_queue::CanceledBy;
 
 use serde::Deserialize;
 
-use crate::common::{build_http_client, OccupancyMetrics};
+use crate::common::{
+    build_http_client, s3_mode_args_to_worker_data, OccupancyMetrics, S3ModeWorkerData,
+};
 use crate::handle_child::run_future_with_polling_update_job_poller;
 use crate::sanitized_sql_params::sanitize_and_interpolate_unsafe_sql_args;
 use crate::{
@@ -31,6 +35,16 @@ struct BigqueryResponse {
     totalRows: Option<Value>,
     schema: Option<BigqueryResponseSchema>,
     jobComplete: bool,
+    pageToken: Option<String>,
+    jobReference: Option<BigQueryResponseJobReference>,
+}
+
+#[allow(non_snake_case)]
+#[derive(Deserialize, Clone)]
+struct BigQueryResponseJobReference {
+    jobId: String,
+    projectId: String,
+    location: Option<String>,
 }
 
 #[derive(Deserialize)]
@@ -74,6 +88,7 @@ fn do_bigquery_inner<'a>(
     column_order: Option<&'a mut Option<Vec<String>>>,
     skip_collect: bool,
     http_client: &'a Client,
+    s3: Option<S3ModeWorkerData>,
 ) -> windmill_common::error::Result<BoxFuture<'a, windmill_common::error::Result<Box<RawValue>>>> {
     let param_names = parse_sql_statement_named_params(query, '@');
 
@@ -120,69 +135,80 @@ fn do_bigquery_inner<'a>(
                             e.to_string()
                         ))
                     })?;
+                    let rows = handle_bigquery_response(&result, &s3, column_order).await?;
 
-                    if !result.jobComplete {
-                        return Err(Error::ExecutionErr(
-                            "BigQuery API did not answer query in time".to_string(),
-                        ));
+                    if let Some(s3) = s3 {
+                        let cloned_s3 = s3.clone();
+                        let cloned_http_client = http_client.clone();
+                        let cloned_token = token.to_string();
+                        let rows_stream = async_stream::stream! {
+                            for row in rows.iter() {
+                                yield Ok::<_, windmill_common::error::Error>(row.clone());
+                            }
+                            let mut next_page_token = result.pageToken;
+                            let Some(job_reference) = result.jobReference.clone() else {
+                                return;
+                            };
+                            while let Some(ref next_page_token_value) = next_page_token {
+                                let response2 = cloned_http_client
+                                    .get(
+                                        format!("https://bigquery.googleapis.com/bigquery/v2/projects/{}/queries/{}", job_reference.projectId, job_reference.jobId),
+                                    )
+                                    .bearer_auth(cloned_token.as_str())
+                                    .query(&[
+                                        ("pageToken", next_page_token_value.as_str()),
+                                        ("maxResults", "10000"),
+                                        ("timeoutMs", timeout_ms.to_string().as_str()),
+                                        ("location", job_reference.location.as_ref().unwrap_or(&"US".to_string()).as_str()),
+                                    ])
+                                    .send()
+                                    .await
+                                    .map_err(|e| {
+                                        Error::ExecutionErr(format!("Could not send query to BigQuery API: {}", e))
+                                    })?;
+
+                                if let Err(e) = response2.error_for_status_ref() {
+                                    match response2.json::<BigqueryErrorResponse>().await {
+                                        Ok(bq_err) => {
+                                            yield Err(Error::ExecutionErr(format!(
+                                                "Error from BigQuery API: {}",
+                                                bq_err.error.message
+                                            )))
+                                            .map_err(to_anyhow)?;
+                                            return;
+                                    },
+                                        Err(_) => {
+                                            yield Err(Error::ExecutionErr(format!(
+                                                "Error from BigQuery API could not be parsed: {}",
+                                                e.to_string()
+                                            )))
+                                            .map_err(to_anyhow)?;
+                                            return;
+                                        },
+                                    }
+                                }
+
+                                let result2 = response2.json::<BigqueryResponse>().await.map_err(|e| {
+                                    Error::ExecutionErr(format!(
+                                        "BigQuery API response could not be parsed: {}",
+                                        e.to_string()
+                                    ))
+                                })?;
+                                let rows = handle_bigquery_response(&result2, &Some(cloned_s3.clone()), None).await?;
+                                for row in rows.into_iter() {
+                                    yield Ok::<_, windmill_common::error::Error>(row);
+                                }
+                                next_page_token = result2.pageToken;
+                            }
+                        };
+
+                        let stream =
+                            convert_json_line_stream(rows_stream.boxed(), s3.format).await?;
+                        s3.upload(stream.boxed()).await?;
+
+                        return Ok(to_raw_value(&s3.to_return_s3_obj()));
                     }
 
-                    if result.rows.is_none() || result.rows.as_ref().unwrap().len() == 0 {
-                        return Ok(serde_json::from_str("[]").unwrap());
-                    }
-
-                    if result.schema.is_none() {
-                        return Err(Error::ExecutionErr(
-                            "Incomplete response from BigQuery API".to_string(),
-                        ));
-                    }
-
-                    if result
-                        .totalRows
-                        .unwrap_or(json!(""))
-                        .as_str()
-                        .unwrap_or("")
-                        .parse::<i64>()
-                        .unwrap_or(0)
-                        > 10000
-                    {
-                        return Err(Error::ExecutionErr(
-                        "More than 10000 rows were requested, use LIMIT 10000 to limit the number of rows".to_string(),
-                    ));
-                    }
-
-                    if let Some(column_order) = column_order {
-                        *column_order = Some(
-                            result
-                                .schema
-                                .as_ref()
-                                .unwrap()
-                                .fields
-                                .iter()
-                                .map(|x| x.name.clone())
-                                .collect::<Vec<String>>(),
-                        );
-                    }
-
-                    let rows = result
-                        .rows
-                        .unwrap()
-                        .iter()
-                        .map(|row| {
-                            let mut row_map = serde_json::Map::new();
-                            row.f
-                                .iter()
-                                .zip(result.schema.as_ref().unwrap().fields.iter())
-                                .for_each(|(field, schema)| {
-                                    row_map.insert(
-                                        schema.name.clone(),
-                                        parse_val(&field.v, &schema.r#type, &schema),
-                                    );
-                                });
-                            Value::from(row_map)
-                        })
-                        .collect::<Vec<_>>();
-
                     Ok(to_raw_value(&rows))
                 }
             }
@@ -204,6 +230,79 @@ fn do_bigquery_inner<'a>(
     Ok(result_f.boxed())
 }
 
+async fn handle_bigquery_response<'a>(
+    result: &BigqueryResponse,
+    s3: &Option<S3ModeWorkerData>,
+    column_order: Option<&'a mut Option<Vec<String>>>,
+) -> windmill_common::error::Result<Vec<Value>> {
+    if !result.jobComplete {
+        return Err(Error::ExecutionErr(
+            "BigQuery API did not answer query in time".to_string(),
+        ));
+    }
+
+    if result.rows.is_none() || result.rows.as_ref().unwrap().len() == 0 {
+        return Ok(serde_json::from_str("[]").unwrap());
+    }
+
+    if result.schema.is_none() {
+        return Err(Error::ExecutionErr(
+            "Incomplete response from BigQuery API".to_string(),
+        ));
+    }
+
+    if s3.is_none()
+        && result
+            .totalRows
+            .as_ref()
+            .unwrap_or(&json!(""))
+            .as_str()
+            .unwrap_or("")
+            .parse::<i64>()
+            .unwrap_or(0)
+            > 10000
+    {
+        return Err(Error::ExecutionErr(
+            "More than 10000 rows were requested, use LIMIT 10000 to limit the number of rows"
+                .to_string(),
+        ));
+    }
+
+    if let Some(column_order) = column_order {
+        *column_order = Some(
+            result
+                .schema
+                .as_ref()
+                .unwrap()
+                .fields
+                .iter()
+                .map(|x| x.name.clone())
+                .collect::<Vec<String>>(),
+        );
+    }
+
+    let rows = result
+        .rows
+        .as_ref()
+        .unwrap()
+        .iter()
+        .map(|row| {
+            let mut row_map = serde_json::Map::new();
+            row.f
+                .iter()
+                .zip(result.schema.as_ref().unwrap().fields.iter())
+                .for_each(|(field, schema)| {
+                    row_map.insert(
+                        schema.name.clone(),
+                        parse_val(&field.v, &schema.r#type, &schema),
+                    );
+                });
+            Value::from(row_map)
+        })
+        .collect::<Vec<_>>();
+    Ok(rows)
+}
+
 use windmill_queue::MiniPulledJob;
 
 pub async fn do_bigquery(
@@ -220,6 +319,7 @@ pub async fn do_bigquery(
     let bigquery_args = build_args_values(job, client, conn).await?;
 
     let inline_db_res_path = parse_db_resource(&query);
+    let s3 = parse_s3_mode(&query)?.map(|s3| s3_mode_args_to_worker_data(s3, client.clone(), job));
 
     let db_arg = if let Some(inline_db_res_path) = inline_db_res_path {
         Some(
@@ -332,6 +432,7 @@ pub async fn do_bigquery(
                     None,
                     annotations.return_last_result && i < queries.len() - 1,
                     &http_client,
+                    s3.clone(),
                 )
             })
             .collect::<windmill_common::error::Result<Vec<_>>>()?;
@@ -361,6 +462,7 @@ pub async fn do_bigquery(
             Some(column_order),
             false,
             &http_client,
+            s3,
         )?
     };
 

backend/windmill-worker/src/common.rs

@@ -31,6 +31,7 @@ use windmill_common::{
 };
 
 use anyhow::{anyhow, bail, Result};
+use windmill_parser_sql::{s3_mode_extension, S3ModeArgs, S3ModeFormat};
 use windmill_queue::MiniPulledJob;
 
 use std::ops::AsyncFn;
@@ -1579,3 +1580,63 @@ pub async fn par_install_language_dependencies<'a>(
     }
     Ok(())
 }
+
+#[derive(Clone)]
+pub struct S3ModeWorkerData {
+    pub client: AuthedClient,
+    pub object_key: String,
+    pub format: S3ModeFormat,
+    pub storage: Option<String>,
+    pub workspace_id: String,
+}
+
+impl S3ModeWorkerData {
+    pub async fn upload<S>(&self, stream: S) -> error::Result<()>
+    where
+        S: futures::stream::TryStream + Send + 'static,
+        S::Error: Into<Box<dyn std::error::Error + Send + Sync>>,
+        bytes::Bytes: From<S::Ok>,
+    {
+        self.client
+            .upload_s3_file(
+                self.workspace_id.as_str(),
+                self.object_key.clone(),
+                self.storage.clone(),
+                stream,
+            )
+            .await
+    }
+
+    pub fn to_return_s3_obj(&self) -> windmill_common::s3_helpers::S3Object {
+        windmill_common::s3_helpers::S3Object {
+            s3: self.object_key.clone(),
+            storage: self.storage.clone(),
+            ..Default::default()
+        }
+    }
+}
+
+pub fn s3_mode_args_to_worker_data(
+    s3: S3ModeArgs,
+    client: AuthedClient,
+    job: &MiniPulledJob,
+) -> S3ModeWorkerData {
+    S3ModeWorkerData {
+        client,
+        storage: s3.storage,
+        format: s3.format,
+        object_key: format!(
+            "{}/{}.{}",
+            s3.prefix.unwrap_or_else(|| format!(
+                "wmill_datalake/{}",
+                job.runnable_path
+                    .as_ref()
+                    .map(|s| s.as_str())
+                    .unwrap_or("unknown_script")
+            )),
+            job.id,
+            s3_mode_extension(s3.format)
+        ),
+        workspace_id: job.workspace_id.clone(),
+    }
+}

backend/windmill-worker/src/dedicated_worker.rs

@@ -187,14 +187,14 @@ pub async fn handle_dedicated_process(
                                 let result = Arc::new(result);
                                 append_logs(&job.id, &job.workspace_id,  logs.clone(), &db.into()).await;
                                 if line.starts_with("wm_res[success]:") {
-                                    job_completed_tx.send_job(JobCompleted { job , result, result_columns: None, mem_peak: 0, canceled_by: None, success: true, cached_res_path: None, token: token.to_string(), duration: None }).await.unwrap()
+                                    job_completed_tx.send_job(JobCompleted { job , result, result_columns: None, mem_peak: 0, canceled_by: None, success: true, cached_res_path: None, token: token.to_string(), duration: None, preprocessed_args: None }, true).await.unwrap()
                                 } else {
-                                    job_completed_tx.send_job(JobCompleted { job , result, result_columns: None, mem_peak: 0, canceled_by: None, success: false, cached_res_path: None, token: token.to_string(), duration: None }).await.unwrap()
+                                    job_completed_tx.send_job(JobCompleted { job , result, result_columns: None, mem_peak: 0, canceled_by: None, success: false, cached_res_path: None, token: token.to_string(), duration: None, preprocessed_args: None }, true).await.unwrap()
                                 }
                             },
                             Err(e) => {
                                 tracing::error!("Could not deserialize job result `{line}`: {e:?}");
-                                job_completed_tx.send_job(JobCompleted { job , result: Arc::new(to_raw_value(&serde_json::json!({"error": format!("Could not deserialize job result `{line}`: {e:?}")}))), result_columns: None, mem_peak: 0, canceled_by: None, success: false, cached_res_path: None, token: token.to_string(), duration: None }).await.unwrap();
+                                job_completed_tx.send_job(JobCompleted { job , result: Arc::new(to_raw_value(&serde_json::json!({"error": format!("Could not deserialize job result `{line}`: {e:?}")}))), result_columns: None, mem_peak: 0, canceled_by: None, success: false, cached_res_path: None, token: token.to_string(), duration: None, preprocessed_args: None }, true).await.unwrap();
                             },
                         };
                         logs = init_log.clone();

backend/windmill-worker/src/handle_child.rs

@@ -130,13 +130,13 @@ pub async fn handle_child(
     } else {
         tracing::info!("could not get child pid");
     }
-    let (set_too_many_logs, mut too_many_logs) = watch::channel::<bool>(false);
+    let (mut set_too_many_logs, mut too_many_logs) = watch::channel::<bool>(false);
     let (tx, rx) = broadcast::channel::<()>(3);
-    let mut rx2 = tx.subscribe();
+    let mut rx2: broadcast::Receiver<()> = tx.subscribe();
 
-    let output = child_joined_output_stream(&mut child, job_id.clone());
+    let output = child_joined_output_stream(&mut child, job_id.clone(), w_id.to_string());
 
-    let job_id = job_id.clone();
+    let job_id: Uuid = job_id.clone();
 
     /* the cancellation future is polled on by `wait_on_child` while
      * waiting for the child to exit normally */
@@ -296,147 +296,19 @@ pub async fn handle_child(
     };
 
     /* a future that reads output from the child and appends to the database */
-    let lines = async move {
-
-        let max_log_size = if *CLOUD_HOSTED {
-            MAX_RESULT_SIZE
-        } else {
-            usize::MAX
-        };
-
-        /* log_remaining is zero when output limit was reached */
-        let mut log_remaining =  if *CLOUD_HOSTED {
-            max_log_size
-        } else {
-            usize::MAX
-        };
-        let mut result = io::Result::Ok(());
-        let mut output = output.take_until(async {
-            let _ = rx2.recv().await;
-            //wait at most 50ms after end of a script for output stream to end
-            tokio::time::sleep(Duration::from_millis(50)).await;
-         }).boxed();
-        /* `do_write` resolves the task, but does not contain the Result.
-         * It's useful to know if the task completed. */
-        let (mut do_write, mut write_result) = tokio::spawn(ready(())).remote_handle();
-
-        let mut log_total_size: u64 = 0;
-        let pg_log_total_size = Arc::new(AtomicU32::new(0));
-
-        let mut pipe_stdout = pipe_stdout;
-
-        while let Some(line) =  output.by_ref().next().await {
-
-            let do_write_ = do_write.shared();
-
-            let delay = if start.elapsed() < Duration::from_secs(10) {
-                Duration::from_millis(500)
-            } else if start.elapsed() < Duration::from_secs(60){
-                Duration::from_millis(2500)
-            } else {
-                Duration::from_millis(5000)
-            };
-
-            let delay = if *SLOW_LOGS {
-                delay * 10
-            } else {
-                delay
-            };
-
-            let mut read_lines = stream::once(async { line })
-                .chain(output.by_ref())
-                /* after receiving a line, continue until some delay has passed
-                 * _and_ the previous database write is complete */
-                .take_until(future::join(sleep(delay), do_write_.clone()))
-                .boxed();
-
-            /* Read up until an error is encountered,
-             * handle log lines first and then the error... */
-            let mut joined = String::new();
-
-            while let Some(line) = read_lines.next().await {
-
-                match line {
-                    Ok(line) => {
-                        if line.is_empty() {
-                            continue;
-                        }
-                        append_with_limit(&mut joined, &line, &mut log_remaining);
-                        if log_remaining == 0 {
-                            tracing::info!(%job_id, "Too many logs lines for job {job_id}");
-                            let _ = set_too_many_logs.send(true);
-                            joined.push_str(&format!(
-                                "Job logs or result reached character limit of {MAX_RESULT_SIZE}; killing job."
-                            ));
-                            /* stop reading and drop our streams fairly quickly */
-                            break;
-                        }
-                    }
-                    Err(err) => {
-                        result = Err(err);
-                        break;
-                    }
-                }
-            }
-
-
-            /* Ensure the last flush completed before starting a new one.
-             *
-             * This shouldn't pause since `take_until()` reads lines until `do_write`
-             * resolves. We only stop reading lines before `take_until()` resolves if we reach
-             * EOF or a read error.  In those cases, waiting on a database query to complete is
-             * fine because we're done. */
-
-            if let Some(Ok(p)) = do_write_
-                .then(|()| write_result)
-                .await
-                .err()
-                .map(|err| err.try_into_panic())
-            {
-                panic::resume_unwind(p);
-            }
-
-
-            let joined_len = joined.len() as u64;
-            log_total_size += joined_len;
-            let compact_logs = log_total_size > LARGE_LOG_THRESHOLD_SIZE as u64;
-            if compact_logs {
-                log_total_size = 0;
-            }
-
-            let worker_name = worker.to_string();
-            let w_id2 = w_id.to_string();
-
-
-            if let Some(buf) = &mut pipe_stdout {
-                buf.push_str(&joined);
-                (do_write, write_result) = tokio::spawn(async { }).remote_handle();
-            } else {
-                (do_write, write_result) = tokio::spawn(append_job_logs(job_id, w_id2, joined, conn.clone(), compact_logs, pg_log_total_size.clone(), worker_name)).remote_handle();
-            }
-
-            if let Err(err) = result {
-                tracing::error!(%job_id, %err, "error reading output for job {job_id} '{child_name}': {err}");
-                break;
-            }
-
-            if *set_too_many_logs.borrow() {
-                break;
-            }
-        }
-
-        /* drop our end of the pipe */
-        drop(output);
-
-        if let Some(Ok(p)) = do_write
-            .then(|()| write_result)
-            .await
-            .err()
-            .map(|err| err.try_into_panic())
-        {
-            panic::resume_unwind(p);
-        }
-    }.instrument(trace_span!("child_lines"));
+    let lines = write_lines(
+        output,
+        &job_id,
+        w_id,
+        worker,
+        conn,
+        &mut set_too_many_logs,
+        start,
+        pipe_stdout,
+        &mut rx2,
+        child_name,
+    )
+    .instrument(trace_span!("child_lines"));
 
     let (wait_result, _) = tokio::join!(wait_on_child, lines);
 
@@ -462,6 +334,169 @@ pub async fn handle_child(
     }
 }
 
+pub async fn write_lines(
+    output: impl stream::Stream<Item = io::Result<String>> + Send,
+    job_id: &Uuid,
+    w_id: &str,
+    worker: &str,
+    conn: &Connection,
+    set_too_many_logs: &mut watch::Sender<bool>,
+    start: Instant,
+    pipe_stdout: Option<&mut String>,
+    rx2: &mut broadcast::Receiver<()>,
+    child_name: &str,
+) {
+    let max_log_size = if *CLOUD_HOSTED {
+        MAX_RESULT_SIZE
+    } else {
+        usize::MAX
+    };
+
+    /* log_remaining is zero when output limit was reached */
+    let mut log_remaining = if *CLOUD_HOSTED {
+        max_log_size
+    } else {
+        usize::MAX
+    };
+    let mut result = io::Result::Ok(());
+    let mut output = output
+        .take_until(async {
+            let _ = rx2.recv().await;
+            //wait at most 50ms after end of a script for output stream to end
+            tokio::time::sleep(Duration::from_millis(50)).await;
+        })
+        .boxed();
+    /* `do_write` resolves the task, but does not contain the Result.
+     * It's useful to know if the task completed. */
+    let (mut do_write, mut write_result) = tokio::spawn(ready(())).remote_handle();
+
+    let mut log_total_size: u64 = 0;
+    let pg_log_total_size = Arc::new(AtomicU32::new(0));
+
+    let mut pipe_stdout = pipe_stdout;
+
+    while let Some(line) = output.by_ref().next().await {
+        let do_write_ = do_write.shared();
+
+        let delay = if start.elapsed() < Duration::from_secs(10) {
+            Duration::from_millis(500)
+        } else if start.elapsed() < Duration::from_secs(60) {
+            Duration::from_millis(2500)
+        } else {
+            Duration::from_millis(5000)
+        };
+
+        let delay = if *SLOW_LOGS { delay * 10 } else { delay };
+
+        let mut read_lines = stream::once(async { line })
+            .chain(output.by_ref())
+            /* after receiving a line, continue until some delay has passed
+             * _and_ the previous database write is complete */
+            .take_until(future::join(sleep(delay), do_write_.clone()))
+            .boxed();
+
+        /* Read up until an error is encountered,
+         * handle log lines first and then the error... */
+        let mut joined = String::new();
+
+        let job_id = job_id.clone();
+        while let Some(line) = read_lines.next().await {
+            match line {
+                Ok(line) => {
+                    if line.is_empty() {
+                        continue;
+                    }
+                    append_with_limit(&mut joined, &line, &mut log_remaining);
+                    if log_remaining == 0 {
+                        tracing::info!(%job_id, "Too many logs lines for job {job_id}");
+                        let _ = set_too_many_logs.send(true);
+                        joined.push_str(&format!(
+                                "Job logs or result reached character limit of {MAX_RESULT_SIZE}; killing job."
+                            ));
+                        /* stop reading and drop our streams fairly quickly */
+                        break;
+                    }
+                }
+                Err(err) => {
+                    result = Err(err);
+                    break;
+                }
+            }
+        }
+
+        /* Ensure the last flush completed before starting a new one.
+         *
+         * This shouldn't pause since `take_until()` reads lines until `do_write`
+         * resolves. We only stop reading lines before `take_until()` resolves if we reach
+         * EOF or a read error.  In those cases, waiting on a database query to complete is
+         * fine because we're done. */
+
+        if let Some(Ok(p)) = do_write_
+            .then(|()| write_result)
+            .await
+            .err()
+            .map(|err| err.try_into_panic())
+        {
+            panic::resume_unwind(p);
+        }
+
+        let joined_len = joined.len() as u64;
+        log_total_size += joined_len;
+        let compact_logs = log_total_size > LARGE_LOG_THRESHOLD_SIZE as u64;
+        if compact_logs {
+            log_total_size = 0;
+        }
+
+        let worker_name = worker.to_string();
+
+        if let Some(buf) = &mut pipe_stdout {
+            buf.push_str(&joined);
+            (do_write, write_result) = tokio::spawn(async {}).remote_handle();
+        } else {
+            let conn = conn.clone();
+            let worker_name = worker_name.to_string();
+            let w_id = w_id.to_string();
+            let job_id = job_id.clone();
+            let pg_log_total_size = pg_log_total_size.clone();
+
+            (do_write, write_result) = tokio::spawn(async move {
+                append_job_logs(
+                    &job_id,
+                    &w_id,
+                    &joined,
+                    &conn,
+                    compact_logs,
+                    pg_log_total_size,
+                    &worker_name,
+                )
+                .await;
+            })
+            .remote_handle();
+        }
+
+        if let Err(err) = result {
+            tracing::error!(%job_id, %err, "error reading output for job {job_id} '{child_name}': {err}");
+            break;
+        }
+
+        if *set_too_many_logs.borrow() {
+            break;
+        }
+    }
+
+    /* drop our end of the pipe */
+    drop(output);
+
+    if let Some(Ok(p)) = do_write
+        .then(|()| write_result)
+        .await
+        .err()
+        .map(|err| err.try_into_panic())
+    {
+        panic::resume_unwind(p);
+    }
+}
+
 pub(crate) async fn get_mem_peak(pid: Option<u32>, nsjail: bool) -> i32 {
     if pid.is_none() {
         return -1;
@@ -694,6 +729,7 @@ where
 fn child_joined_output_stream(
     child: &mut Child,
     job_id: Uuid,
+    w_id: String,
 ) -> impl stream::FusedStream<Item = io::Result<String>> {
     let stderr = child
         .stderr
@@ -708,8 +744,8 @@ fn child_joined_output_stream(
     let stdout = BufReader::new(stdout).lines();
     let stderr = BufReader::new(stderr).lines();
     stream::select(
-        lines_to_stream(stderr, true, job_id.clone()),
-        lines_to_stream(stdout, false, job_id),
+        lines_to_stream(stderr, true, job_id.clone(), w_id.clone()),
+        lines_to_stream(stdout, false, job_id, w_id),
     )
 }
 
@@ -717,11 +753,12 @@ pub fn lines_to_stream<R: tokio::io::AsyncBufRead + Unpin>(
     mut lines: tokio::io::Lines<R>,
     stderr: bool,
     job_id: Uuid,
+    w_id: String,
 ) -> impl futures::Stream<Item = io::Result<String>> {
     stream::poll_fn(move |cx| {
         std::pin::Pin::new(&mut lines)
             .poll_next_line(cx)
-            .map(|result| process_streaming_log_lines(result, stderr, &job_id))
+            .map(|result| process_streaming_log_lines(result, stderr, &job_id, &w_id))
     })
 }
 

backend/windmill-worker/src/job_logger.rs

@@ -1,8 +1,10 @@
 use regex::Regex;
 
 pub use windmill_common::jobs::LARGE_LOG_THRESHOLD_SIZE;
+use windmill_common::utils::WarnAfterExt;
 use windmill_common::worker::{Connection, CLOUD_HOSTED};
 
+use windmill_common::DB;
 use windmill_queue::append_logs;
 
 use std::sync::atomic::AtomicU32;
@@ -26,23 +28,23 @@ pub enum CompactLogs {
 }
 
 pub async fn append_job_logs(
-    job_id: Uuid,
-    w_id: String,
-    logs: String,
-    conn: Connection,
+    job_id: &Uuid,
+    w_id: &str,
+    logs: &str,
+    conn: &Connection,
     must_compact_logs: bool,
     total_size: Arc<AtomicU32>,
-    worker_name: String,
+    worker_name: &str,
 ) -> () {
     match conn {
         Connection::Sql(db) if must_compact_logs => {
             #[cfg(all(feature = "enterprise", feature = "parquet"))]
-            s3_storage(job_id, &w_id, &db, logs, total_size, &worker_name).await;
+            s3_storage(&job_id, &w_id, &db, logs, total_size, worker_name).await;
 
             #[cfg(not(all(feature = "enterprise", feature = "parquet")))]
             {
                 default_disk_log_storage(
-                    job_id,
+                    &job_id,
                     &w_id,
                     &db,
                     logs,
@@ -59,6 +61,45 @@ pub async fn append_job_logs(
     }
 }
 
+pub async fn append_logs_with_compaction(
+    job_id: &Uuid,
+    w_id: &str,
+    logs: &str,
+    db: &DB,
+    worker_name: &str,
+) {
+    let log_length = sqlx::query_scalar!(
+        "INSERT INTO job_logs (logs, job_id, workspace_id) VALUES ($1, $2, $3) ON CONFLICT (job_id) DO UPDATE SET logs = concat(job_logs.logs, $1::text) RETURNING length(logs)",
+        logs,
+        job_id,
+        &w_id,
+    )
+    .fetch_one(db)
+    .warn_after_seconds(1)
+    .await;
+    match log_length {
+        Ok(length) => {
+            let len = length.unwrap_or(0);
+            let conn: Connection = db.into();
+            if len > LARGE_LOG_THRESHOLD_SIZE as i32 {
+                append_job_logs(
+                    &job_id,
+                    w_id,
+                    "",
+                    &conn,
+                    true,
+                    Arc::new(AtomicU32::new(len as u32)),
+                    worker_name,
+                )
+                .await;
+            }
+        }
+        Err(err) => {
+            tracing::error!(%job_id, %err, "error updating logs for job {job_id}: {err}");
+        }
+    }
+}
+
 lazy_static::lazy_static! {
     static ref RE_00: Regex = Regex::new('\u{00}'.to_string().as_str()).unwrap();
     pub static ref NO_LOGS_AT_ALL: bool = std::env::var("NO_LOGS_AT_ALL").ok().is_some_and(|x| x == "1" || x == "true");

backend/windmill-worker/src/job_logger_ee.rs

@@ -9,22 +9,22 @@ use crate::job_logger::CompactLogs;
 
 #[cfg(all(feature = "enterprise", feature = "parquet"))]
 pub(crate) async fn s3_storage(
-    _job_id: Uuid,
-    _w_id: &String,
+    _job_id: &Uuid,
+    _w_id: &str,
     _db: &sqlx::Pool<sqlx::Postgres>,
-    _logs: String,
+    _logs: &str,
     _total_size: Arc<AtomicU32>,
-    _worker_name: &String,
+    _worker_name: &str,
 ) {
     tracing::info!("Logs length of {_job_id} has exceeded a threshold. Implementation to store excess on s3 in not OSS");
 }
 
 #[allow(dead_code)]
 pub(crate) async fn default_disk_log_storage(
-    job_id: Uuid,
+    job_id: &Uuid,
     _w_id: &str,
     _db: &DB,
-    _nlogs: String,
+    _logs: &str,
     _total_size: Arc<AtomicU32>,
     _compact_kind: CompactLogs,
     _worker_name: &str,
@@ -36,6 +36,7 @@ pub(crate) fn process_streaming_log_lines(
     r: Result<Option<String>, io::Error>,
     _stderr: bool,
     _job_id: &Uuid,
+    _w_id: &str,
 ) -> Option<Result<String, io::Error>> {
     r.transpose()
 }