update

* chore(main): release 1.496.3

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>

.github/workflows/backend-check.yml

@@ -53,7 +53,7 @@ jobs:
         timeout-minutes: 16
         run: |
           mkdir -p fake_frontend_build
-          FRONTEND_BUILD_DIR=$(pwd)/fake_frontend_build SQLX_OFFLINE=true cargo check --all-features
+          FRONTEND_BUILD_DIR=$(pwd)/fake_frontend_build SQLX_OFFLINE=true cargo check --features $(./all_features_oss.sh)
 
   check_ee:
     runs-on: ubicloud-standard-8

.github/workflows/build-publish-rh-image.yml

@@ -64,7 +64,7 @@ jobs:
           platforms: linux/amd64
           push: true
           build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,license,otel,http_trigger,zip,oauth2,kafka,sqs_trigger,nats,postgres_trigger,gcp_trigger,mqtt_trigger,websocket,smtp,static_frontend,all_languages,deno_core,mcp
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,license,otel,http_trigger,zip,oauth2,kafka,sqs_trigger,nats,postgres_trigger,gcp_trigger,mqtt_trigger,websocket,smtp,static_frontend,all_languages,deno_core,mcp,private
           secrets: |
             rh_username=${{ secrets.RH_USERNAME }}
             rh_password=${{ secrets.RH_PASSWORD }}
@@ -81,7 +81,7 @@ jobs:
           platforms: linux/arm64
           push: true
           build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,license,otel,http_trigger,zip,oauth2,kafka,sqs_trigger,nats,postgres_trigger,gcp_trigger,mqtt_trigger,websocket,smtp,static_frontend,all_languages,deno_core,mcp
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,license,otel,http_trigger,zip,oauth2,kafka,sqs_trigger,nats,postgres_trigger,gcp_trigger,mqtt_trigger,websocket,smtp,static_frontend,all_languages,deno_core,mcp,private
           secrets: |
             rh_username=${{ secrets.RH_USERNAME }}
             rh_password=${{ secrets.RH_PASSWORD }}

.github/workflows/build_windows_worker_.yml

@@ -51,7 +51,7 @@ jobs:
           $env:OPENSSL_DIR="${Env:VCPKG_INSTALLATION_ROOT}\installed\x64-windows-static"
           mkdir frontend/build && cd backend
           New-Item -Path . -Name "windmill-api/openapi-deref.yaml" -ItemType "File" -Force
-          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,license,http_trigger,zip,oauth2,kafka,nats,sqs_trigger,postgres_trigger,gcp_trigger,mqtt_trigger,websocket,smtp,static_frontend,all_languages,mcp
+          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,license,http_trigger,zip,oauth2,kafka,nats,sqs_trigger,postgres_trigger,gcp_trigger,mqtt_trigger,websocket,smtp,static_frontend,all_languages_windows,mcp,private
       - name: Rename binary with corresponding architecture
         run: |
           Rename-Item -Path ".\backend\target\release\windmill.exe" -NewName "windmill-ee.exe"

.github/workflows/discord-notification.yml

@@ -17,8 +17,11 @@ jobs:
       PR_AUTHOR: ${{ github.event.pull_request.user.login }}
       PR_STATUS: "opened"
       PR_NUMBER: ${{ github.event.pull_request.number }}
+      DISCORD_CHANNEL_ID: "1372204995868491786"
+      DISCORD_GUILD_ID: "930051556043276338"
     secrets:
       DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_PR_REVIEWS_WEBHOOK }}
+      DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_AI_BOT_TOKEN }}
 
   merge_success_emoji:
     if: github.event.pull_request.merged == true

.github/workflows/docker-image.yml

@@ -92,7 +92,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           build-args: |
-            features=embedding,parquet,openidconnect,jemalloc,license,http_trigger,zip,oauth2,dind,postgres_trigger,mqtt_trigger,websocket,smtp,static_frontend,agent_worker_server,all_languages,deno_core,mcp
+            features=embedding,parquet,openidconnect,jemalloc,license,http_trigger,zip,oauth2,dind,postgres_trigger,mqtt_trigger,websocket,smtp,static_frontend,agent_worker_server,all_languages,deno_core,mcp,private
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }}
             ${{ steps.meta-public.outputs.tags }}
@@ -154,7 +154,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,agent_worker_server,tantivy,license,http_trigger,zip,oauth2,kafka,sqs_trigger,nats,otel,dind,postgres_trigger,mqtt_trigger,gcp_trigger,websocket,smtp,static_frontend,all_languages,deno_core,mcp
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,agent_worker_server,tantivy,license,http_trigger,zip,oauth2,kafka,sqs_trigger,nats,otel,dind,postgres_trigger,mqtt_trigger,gcp_trigger,websocket,smtp,static_frontend,all_languages,private,deno_core,mcp
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
             ${{ steps.meta-ee-public.outputs.tags }}

.github/workflows/helmchart_on_release.yml

@@ -13,7 +13,7 @@ jobs:
         uses: actions/checkout@v3
         with:
           repository: windmill-labs/windmill-helm-charts
-          token: ${{ secrets.DOCS_TOKEN }}
+          token: ${{ secrets.HELM_CHART_TOKEN }}
 
       - name: Get version
         id: get_version
@@ -57,7 +57,7 @@ jobs:
 
       - name: Create PR
         env:
-          GH_TOKEN: ${{ secrets.DOCS_TOKEN }}
+          GH_TOKEN: ${{ secrets.HELM_CHART_TOKEN }}
         run: |
           gh pr create \
             --title "helm: bump version to ${{ env.VERSION }}" \

.github/workflows/publish_windows_worker.yml

@@ -53,7 +53,7 @@ jobs:
           $env:OPENSSL_DIR="${Env:VCPKG_INSTALLATION_ROOT}\installed\x64-windows-static"
           mkdir frontend/build && cd backend
           New-Item -Path . -Name "windmill-api/openapi-deref.yaml" -ItemType "File" -Force
-          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,license,http_trigger,zip,oauth2,kafka,sqs_trigger,nats,postgres_trigger,mqtt_trigger,gcp_trigger,websocket,smtp,static_frontend,all_languages,mcp
+          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,license,http_trigger,zip,oauth2,kafka,sqs_trigger,nats,postgres_trigger,mqtt_trigger,gcp_trigger,websocket,smtp,static_frontend,all_languages_windows,mcp,private
       - name: Rename binary with corresponding architecture
         run: |
           Rename-Item -Path ".\backend\target\release\windmill.exe" -NewName "windmill-ee.exe"

.github/workflows/shareable-discord-notification.yml

@@ -38,24 +38,45 @@ jobs:
       - name: Send Discord notification and start a thread
         env:
           WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          BOT_TOKEN: ${{ secrets.DISCORD_BOT_TOKEN }}
+          CHANNEL_ID: ${{ inputs.DISCORD_CHANNEL_ID }}
+          GUILD_ID: ${{ inputs.DISCORD_GUILD_ID }}
           PR_TITLE: ${{ inputs.PR_TITLE }}
           PR_NUMBER: ${{ inputs.PR_NUMBER }}
           PR_URL: ${{ inputs.PR_URL }}
           PR_AUTHOR: ${{ inputs.PR_AUTHOR }}
         run: |
-          payload=$(jq -n \
-            --arg content "${PR_URL}" \
-            --arg thread "#${PR_NUMBER}: $PR_TITLE by \`${PR_AUTHOR}\`" \
-            '{
-              content: $content,
-              thread_name: $thread,
-              auto_archive_duration: 10080
-            }'
-          )
-          curl -H "Content-Type: application/json" \
-            -X POST \
-            -d "$payload" \
-            "$WEBHOOK_URL"
+          # Check if thread already exists
+          thread_exists=false
+          if threads=$(curl -s -H "Authorization: Bot $BOT_TOKEN" "https://discord.com/api/v10/guilds/${GUILD_ID}/threads/active"); then
+            if thread_id=$(echo "$threads" | jq -r --arg cid "$CHANNEL_ID" --arg pref "#${PR_NUMBER}:" '.threads[] | select(.parent_id == $cid and (.name | startswith($pref))) | .id' 2>/dev/null); then
+              if [ -n "$thread_id" ]; then
+                thread_exists=true
+                echo "Thread already exists, skipping creation"
+              fi
+            fi
+          else
+            echo "Failed to check for existing threads, will create new thread"
+          fi
+
+          # Create thread if it doesn't exist or if check failed
+          if [ "$thread_exists" = false ]; then
+            echo "Creating new thread"
+            THREAD_TITLE="#${PR_NUMBER}: ${PR_TITLE} by \`${PR_AUTHOR}\`"
+            payload=$(jq -n \
+              --arg content "${PR_URL}" \
+              --arg thread "${THREAD_TITLE:0:99}" \
+              '{
+                content: $content,
+                thread_name: $thread,
+                auto_archive_duration: 10080
+              }'
+            )
+            curl -H "Content-Type: application/json" \
+              -X POST \
+              -d "$payload" \
+              "$WEBHOOK_URL"
+          fi
 
   merge_success_emoji:
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## [1.496.3](https://github.com/windmill-labs/windmill/compare/v1.496.2...v1.496.3) (2025-06-09)
+
+
+### Bug Fixes
+
+* improve concurrent job parallelism performance ([e8836a3](https://github.com/windmill-labs/windmill/commit/e8836a393a872bb91e68ba0037681caf24149470))
+* Prioritize diff contexts in script mode for ai chat ([#5888](https://github.com/windmill-labs/windmill/issues/5888)) ([a47939d](https://github.com/windmill-labs/windmill/commit/a47939d13c30e2d4b41efd539f845959174d4fb1))
+
+## [1.496.2](https://github.com/windmill-labs/windmill/compare/v1.496.1...v1.496.2) (2025-06-07)
+
+
+### Bug Fixes
+
+* add clearable by default for select ([#5900](https://github.com/windmill-labs/windmill/issues/5900)) ([b44b9c1](https://github.com/windmill-labs/windmill/commit/b44b9c1b82116ad5487af95d1f78226d56c75179))
+
+## [1.496.1](https://github.com/windmill-labs/windmill/compare/v1.496.0...v1.496.1) (2025-06-07)
+
+
+### Bug Fixes
+
+* never consider minor version for global site packages ([#5893](https://github.com/windmill-labs/windmill/issues/5893)) ([22b2f49](https://github.com/windmill-labs/windmill/commit/22b2f4988db9314f2403508933d0aa932187c668))
+
+## [1.496.0](https://github.com/windmill-labs/windmill/compare/v1.495.1...v1.496.0) (2025-06-06)
+
+
+### Features
+
+* generate http route triggers from openapi spec ([#5857](https://github.com/windmill-labs/windmill/issues/5857)) ([5713483](https://github.com/windmill-labs/windmill/commit/571348377b73d54b4d2a1c5775ab00b247b01910))
+
+
+### Bug Fixes
+
+* allow fileupload drag and drop in edit mode on full component without triggering file picker ([#5889](https://github.com/windmill-labs/windmill/issues/5889)) ([9ae3212](https://github.com/windmill-labs/windmill/commit/9ae3212a1e0f88a8297bf41ab53e3c1be4bcc56c))
+* **python:** account instance version when cli deploy and local lockfile ([#5894](https://github.com/windmill-labs/windmill/issues/5894)) ([ec552d5](https://github.com/windmill-labs/windmill/commit/ec552d5ef6fdb5e824e453f196f9cf16629ee2ea))
+* use full client side js library for route gen from openapi ([#5891](https://github.com/windmill-labs/windmill/issues/5891)) ([3c3fdbd](https://github.com/windmill-labs/windmill/commit/3c3fdbdf26a9581b815210839b91ebdedb924093))
+
+## [1.495.0](https://github.com/windmill-labs/windmill/compare/v1.494.0...v1.495.0) (2025-06-05)
+
+
+### Features
+
+* Add ask mode to AI chat ([#5878](https://github.com/windmill-labs/windmill/issues/5878)) ([67ab469](https://github.com/windmill-labs/windmill/commit/67ab46990ad0c9fad810a64c54297419c6151c79))
+* add navigator mode to AIChat and unify UI ([#5859](https://github.com/windmill-labs/windmill/issues/5859)) ([cbba829](https://github.com/windmill-labs/windmill/commit/cbba8297cd4c1caa21b96a8422bbbd5c306b8398))
+* ai flow chat ([#5842](https://github.com/windmill-labs/windmill/issues/5842)) ([68ebf66](https://github.com/windmill-labs/windmill/commit/68ebf667d5c0bc306329d0b55a3cc59e5b4862cb))
+* ai prompts improvements + o3/o4 support ([#5862](https://github.com/windmill-labs/windmill/issues/5862)) ([825422c](https://github.com/windmill-labs/windmill/commit/825422c48456b2c9b230e1a35914b3fbf7d1e836))
+* connect fix btn in flow editor to ai chat ([#5863](https://github.com/windmill-labs/windmill/issues/5863)) ([6247d15](https://github.com/windmill-labs/windmill/commit/6247d159ce25ae13f6fbc5c105df88305ce29451))
+* fix backward compatibility pg 14 for postgres trigger ([#5851](https://github.com/windmill-labs/windmill/issues/5851)) ([4cbcbdb](https://github.com/windmill-labs/windmill/commit/4cbcbdb960b469acf773d3943128b6c7d0dcb0b8))
+* ssh repl like direct to workers hosts machine ([#5809](https://github.com/windmill-labs/windmill/issues/5809)) ([f252657](https://github.com/windmill-labs/windmill/commit/f2526571a3614156b2b1e5cc91b15d0c57565d99))
+* use rust-postgres client instead of sqlx for postgres trigger ([#5853](https://github.com/windmill-labs/windmill/issues/5853)) ([39dbd64](https://github.com/windmill-labs/windmill/commit/39dbd646b9683e0ad8de047cca786ae468759e77))
+
+
+### Bug Fixes
+
+* broken event dispatch for simpleditor ([#5879](https://github.com/windmill-labs/windmill/issues/5879)) ([df4992a](https://github.com/windmill-labs/windmill/commit/df4992a9295ed188c2a2cb0a5dfd3e33ae2e2dcb))
+* cannot parse INSTANCE_PYTHON_VERSION ([#5874](https://github.com/windmill-labs/windmill/issues/5874)) ([a0b302d](https://github.com/windmill-labs/windmill/commit/a0b302d2c58d4245260376cf280bc866be91717c))
+* fix regex that extract workspaces from custom tags ([#5876](https://github.com/windmill-labs/windmill/issues/5876)) ([1551dc8](https://github.com/windmill-labs/windmill/commit/1551dc8af22f6ea41f68290ace4c58f936c47745))
+* nit ai flow prompt ([#5867](https://github.com/windmill-labs/windmill/issues/5867)) ([3e769f0](https://github.com/windmill-labs/windmill/commit/3e769f0c591b80138b3a356d147228675756452f))
+* **python:** assign PATCH version to python runtime only when needed ([#5866](https://github.com/windmill-labs/windmill/issues/5866)) ([50a5c1f](https://github.com/windmill-labs/windmill/commit/50a5c1f56a7e45882fa0095203de709571e149bb))
+* remove duplicate tools from script ai chat ([#5880](https://github.com/windmill-labs/windmill/issues/5880)) ([fe4a767](https://github.com/windmill-labs/windmill/commit/fe4a767df0e6f46fd0c0fd21b4116c7375978bf9))
+* replace crypto.randomUUID with generateRandomString for HTTP compatibility ([#5849](https://github.com/windmill-labs/windmill/issues/5849)) ([64f35d0](https://github.com/windmill-labs/windmill/commit/64f35d050fb0d1008ce7142fd62d500845e62c4a)), closes [#5847](https://github.com/windmill-labs/windmill/issues/5847)
+
 ## [1.494.0](https://github.com/windmill-labs/windmill/compare/v1.493.4...v1.494.0) (2025-05-31)
 
 

backend/.gitignore

@@ -6,4 +6,5 @@ tracing.folded
 heaptrack*
 index/
 windmill-api/openapi-*.*
-.duckdb/*
+.duckdb/*
+*ee.rs

backend/.ignore

@@ -0,0 +1 @@
+!*ee.rs

backend/.sqlx/query-0937e25e89959447e7cb1816c112bbc4718cbb8ad6e2f13eae6b14f129d12936.json

@@ -61,7 +61,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-13444bbd5547e101c41206c5f97ac4dded0536faf52c370d704ed9a451041caf.json

@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) FROM sqs_trigger WHERE script_path = $1 AND is_flow = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "13444bbd5547e101c41206c5f97ac4dded0536faf52c370d704ed9a451041caf"
+}

backend/.sqlx/query-19f0ccadd3ee44719a781ea0d73ea4e45f5b2c3d5c0aa5dbecf9ea9838881b74.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "CREATE INDEX CONCURRENTLY IF NOT EXISTS v2_job_queue_suspend ON v2_job_queue (workspace_id, suspend) WHERE suspend > 0;",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "19f0ccadd3ee44719a781ea0d73ea4e45f5b2c3d5c0aa5dbecf9ea9838881b74"
+}

backend/.sqlx/query-1d87f41fd1abb9361d795a899120e6b77e24bf5a9044fdc5284d0d7f1e14eafa.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usage (id, is_workspace, month_, usage) \n            VALUES ($1, TRUE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), $2) \n            ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Int4"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1d87f41fd1abb9361d795a899120e6b77e24bf5a9044fdc5284d0d7f1e14eafa"
-}

backend/.sqlx/query-2bf5f7f2cf9d85a5d23e5db2f7616fb41fece9b3d46fde2d546d70b46f9008e3.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usage (id, is_workspace, month_, usage) \n                    VALUES ($1, FALSE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), $2) \n                    ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2bf5f7f2cf9d85a5d23e5db2f7616fb41fece9b3d46fde2d546d70b46f9008e3"
+}

backend/.sqlx/query-2e9b3e718440f3c5269e9217a13076c565f3add98b6768b5476bd3afed11ea31.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usage (id, is_workspace, month_, usage)\n                    VALUES ($1, FALSE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)\n                    ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1 \n                    RETURNING usage.usage",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "usage",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Varchar"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "2e9b3e718440f3c5269e9217a13076c565f3add98b6768b5476bd3afed11ea31"
-}

backend/.sqlx/query-2ef25599ea0c9ef946d6cc70ae048af970aed2638a3f767e152b654aebf68e48.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SHOW WAL_LEVEL;",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "wal_level",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "2ef25599ea0c9ef946d6cc70ae048af970aed2638a3f767e152b654aebf68e48"
-}

backend/.sqlx/query-3e244a5057d4f1b4a18c0edac52cdf695c7e7aa0468d2686255de3d83719e6d0.json

@@ -1,22 +1,22 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT tag FROM v2_job WHERE id = $1",
+  "query": "SELECT path FROM script WHERE workspace_id = $1 AND archived = false",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "tag",
+        "name": "path",
         "type_info": "Varchar"
       }
     ],
     "parameters": {
       "Left": [
-        "Uuid"
+        "Text"
       ]
     },
     "nullable": [
       false
     ]
   },
-  "hash": "faf2c77242e0ab39b33886edf3b742531bf1351d0be1c3631bde0adfe375497a"
+  "hash": "3e244a5057d4f1b4a18c0edac52cdf695c7e7aa0468d2686255de3d83719e6d0"
 }

backend/.sqlx/query-4469ee6c206c46951980ea1bc73f126f339d2e3cf97f363be8921084b16dac45.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT pubname AS publication_name FROM pg_publication;",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "publication_name",
-        "type_info": "Name"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "4469ee6c206c46951980ea1bc73f126f339d2e3cf97f363be8921084b16dac45"
-}

backend/.sqlx/query-488dd591096b2b47787afdc3a1d73917ed13269f2ee20b86df79fca2c8efe672.json

@@ -70,7 +70,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-4aaab98ebdaa90f1edf49ac96fba6c391c4d0054a618b861464ee37239f1f1e0.json

@@ -137,7 +137,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-4e5273b9ce05f6ee2dfd5f14c8574a0cf43682480452f7dbe23012320fe7fe25.json

@@ -0,0 +1,58 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n    SELECT \n        tag, \n        script_lang AS \"script_lang!: _\"\n    FROM \n        v2_job\n    WHERE \n        id = $1\n    ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "script_lang!: _",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb"
+              ]
+            }
+          }
+        }
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "4e5273b9ce05f6ee2dfd5f14c8574a0cf43682480452f7dbe23012320fe7fe25"
+}

backend/.sqlx/query-4ee0017771f46f0272817d18edb821940cb5064e3f155b9630b131c09c9dba13.json

@@ -1,26 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT \n            slot_name,\n            active\n        FROM\n            pg_replication_slots \n        WHERE \n            plugin = 'pgoutput' AND\n            slot_type = 'logical';\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "slot_name",
-        "type_info": "Name"
-      },
-      {
-        "ordinal": 1,
-        "name": "active",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      true,
-      true
-    ]
-  },
-  "hash": "4ee0017771f46f0272817d18edb821940cb5064e3f155b9630b131c09c9dba13"
-}

backend/.sqlx/query-553108ba3c0b8d579800bc8b5a4f887d79fb4c13b60b19c4913a8db18521958c.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE v2_job_queue q SET suspend = 0\n                             FROM v2_job j, v2_job_status f\n                             WHERE parent_job = $1\n                                 AND f.id = j.id AND q.id = j.id\n                                 AND suspend = $2 AND (f.flow_status->'step')::int = 0",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Int4"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "553108ba3c0b8d579800bc8b5a4f887d79fb4c13b60b19c4913a8db18521958c"
-}

backend/.sqlx/query-56b2326015fde12b1a4efa226518566101dd27a0f3363884781071d417f8b7e7.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usage (id, is_workspace, month_, usage)\n                        VALUES ($1, FALSE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)\n                        ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1 \n                        RETURNING usage.usage",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "usage",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "56b2326015fde12b1a4efa226518566101dd27a0f3363884781071d417f8b7e7"
+}

backend/.sqlx/query-61c29d684e8e683e839a6d7210b3b9b96854e5bfd752e45922c358c42ebea0c4.json

@@ -61,7 +61,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-621e9a2a53187dac3ebed62f0d645b692815f1594bf302dbebd5f80d5d22b98e.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usage (id, is_workspace, month_, usage)\n                    VALUES ($1, TRUE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)\n                    ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1 \n                    RETURNING usage.usage",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "usage",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Varchar"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "621e9a2a53187dac3ebed62f0d645b692815f1594bf302dbebd5f80d5d22b98e"
-}

backend/.sqlx/query-6a19c440a7a8064f3969cf6f48adea0bfdb683de9555e374ce5731e0b3c379f9.json

@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) FROM gcp_trigger WHERE script_path = $1 AND is_flow = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "6a19c440a7a8064f3969cf6f48adea0bfdb683de9555e374ce5731e0b3c379f9"
+}

backend/.sqlx/query-6e2564dc37ee967c634deade67ceabc4c516418e595dee9cd7d651acc1f4af6e.json

@@ -147,7 +147,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-6f56acb985aa7141ea1891d7ad58a32c35d1b02fe7070c92a2e62c1a5339c396.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT slot_name FROM pg_replication_slots where slot_name = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "slot_name",
-        "type_info": "Name"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Name"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "6f56acb985aa7141ea1891d7ad58a32c35d1b02fe7070c92a2e62c1a5339c396"
-}

backend/.sqlx/query-7e64ba7e2362cc19d2aed9f34c9879983922e96a9baab7c1a2b09ed2b1c261e2.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT \n            active_pid \n        FROM \n            pg_replication_slots \n        WHERE \n            slot_name = $1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "active_pid",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Name"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "7e64ba7e2362cc19d2aed9f34c9879983922e96a9baab7c1a2b09ed2b1c261e2"
-}

backend/.sqlx/query-804fc11e35f4afc0db194b6fe2594f91df7e588d4d2431bc85f4d8734920c8bf.json

@@ -34,7 +34,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-83f64dd93b1ddc03b84681d65d9be69959987cbac1d83b64225fd1bf9ab047c9.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usage (id, is_workspace, month_, usage)\n                        VALUES ($1, TRUE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)\n                        ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1 \n                        RETURNING usage.usage",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "usage",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "83f64dd93b1ddc03b84681d65d9be69959987cbac1d83b64225fd1bf9ab047c9"
+}

backend/.sqlx/query-86ae16175ace0179e784aacfd381771f0137ecab6671d632febadede729e7783.json

@@ -1,40 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            puballtables AS all_table,\n            pubinsert AS insert,\n            pubupdate AS update,\n            pubdelete AS delete\n        FROM\n            pg_publication\n        WHERE\n            pubname = $1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "all_table",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 1,
-        "name": "insert",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 2,
-        "name": "update",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 3,
-        "name": "delete",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Name"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "86ae16175ace0179e784aacfd381771f0137ecab6671d632febadede729e7783"
-}

backend/.sqlx/query-997586ac14384db2c0eeee1bb3382cc6ae013695d0cda6da9ab848ca1b9a9606.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE worker_ping SET\nping_at = now(),\njobs_executed = 1,\ncurrent_job_id = $1,\ncurrent_job_workspace_id = 'admins'\nWHERE worker = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "997586ac14384db2c0eeee1bb3382cc6ae013695d0cda6da9ab848ca1b9a9606"
+}

backend/.sqlx/query-a8b470b463ca4b7c00c7ef6e9f36c23f8bbcefc288a56d61122bfd6fe5ca7e8d.json

@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) FROM mqtt_trigger WHERE script_path = $1 AND is_flow = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "a8b470b463ca4b7c00c7ef6e9f36c23f8bbcefc288a56d61122bfd6fe5ca7e8d"
+}

backend/.sqlx/query-a8bcae108af1eda6efe3a4b8c6f8807bc464a81c0883e68f5a69b89b94b0b34b.json

@@ -36,7 +36,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-a9db7b2f435bb82acb8c5eeb7f800b28f3256491fdaa168591adc7b4b9f3327a.json

@@ -41,7 +41,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-ab04cda71f8e2be9acbecabe1ee5ef756b8e5c1955fbe111df9ee171dc262338.json

@@ -65,7 +65,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-baa1dddc616419bf4b923715f0a863bc0ff69c98db0f0c8f55e4ac89fdde7a60.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT pubname FROM pg_publication WHERE pubname = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "pubname",
-        "type_info": "Name"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Name"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "baa1dddc616419bf4b923715f0a863bc0ff69c98db0f0c8f55e4ac89fdde7a60"
-}

backend/.sqlx/query-c3025cdb6e421e1225d420e8b1efd18d1dd3bb2fac53c1f2df648b61fb7488aa.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE worker_ping SET \nping_at = now(), \njobs_executed = 1, \ncurrent_job_id = $1, \ncurrent_job_workspace_id = 'admins' \nWHERE worker = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "c3025cdb6e421e1225d420e8b1efd18d1dd3bb2fac53c1f2df648b61fb7488aa"
-}

backend/.sqlx/query-ca3ba808e020c8c7a35eaef842b20cfeee64fd47ded72fce55cc75e0bbb291a8.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usage (id, is_workspace, month_, usage) \n                VALUES ($1, TRUE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), $2) \n                ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ca3ba808e020c8c7a35eaef842b20cfeee64fd47ded72fce55cc75e0bbb291a8"
+}

backend/.sqlx/query-cccdcb7fe7968eadfc04d8957a8e98b2f2d92a6d7f687a9dd5a70edb3d5a63e6.json

@@ -70,7 +70,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-d15f02f090b8d1a7e816fe11b2e0867540ab6bb02ac6bf82decc220dce0ab048.json

@@ -42,7 +42,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-e38240e6d50bfe60e1c2b649588eb41dcef121ed161db04b2568ac2d990aed7c.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usage (id, is_workspace, month_, usage) \n                VALUES ($1, FALSE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), $2) \n                ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Int4"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "e38240e6d50bfe60e1c2b649588eb41dcef121ed161db04b2568ac2d990aed7c"
-}

backend/.sqlx/query-f1dbcb6e6d82d17c19eb88c0e67dc1cb8baf5bd40b75a2a9cd3ebac440fda632.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_queue q SET suspend = 0\n                             FROM v2_job j, v2_job_status f\n                             WHERE q.workspace_id = $1 AND q.suspend = $3 AND j.parent_job = $2\n                                 AND f.id = j.id AND q.id = j.id\n                                 AND (f.flow_status->'step')::int = 0",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid",
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f1dbcb6e6d82d17c19eb88c0e67dc1cb8baf5bd40b75a2a9cd3ebac440fda632"
+}

backend/.sqlx/query-f22964772dc2d67aee437bbbd08b64792c00da1d713d7ca8f9904ccce7bfdae7.json

@@ -147,7 +147,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/.sqlx/query-fd5754fe3c6346ae28818a9d60d144a40f8884f47e5bbdd2824e939dafd8f154.json

@@ -1,40 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT\n            schemaname AS schema_name,\n            tablename AS table_name,\n            CASE\n                WHEN array_length(attnames, 1) = (SELECT COUNT(*) FROM information_schema.columns WHERE table_schema = pg_publication_tables.schemaname AND table_name = pg_publication_tables.tablename)\n                THEN NULL\n                ELSE attnames\n            END AS columns,\n            rowfilter AS where_clause\n            FROM\n                pg_publication_tables\n            WHERE\n                pubname = $1;\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "schema_name",
-        "type_info": "Name"
-      },
-      {
-        "ordinal": 1,
-        "name": "table_name",
-        "type_info": "Name"
-      },
-      {
-        "ordinal": 2,
-        "name": "columns",
-        "type_info": "NameArray"
-      },
-      {
-        "ordinal": 3,
-        "name": "where_clause",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Name"
-      ]
-    },
-    "nullable": [
-      true,
-      true,
-      null,
-      true
-    ]
-  },
-  "hash": "fd5754fe3c6346ae28818a9d60d144a40f8884f47e5bbdd2824e939dafd8f154"
-}

backend/.sqlx/query-ff0403790674cdb07022af71c2377afbd8b3a660b3be27514b517c077c63c238.json

@@ -65,7 +65,8 @@
                 "csharp",
                 "oracledb",
                 "nu",
-                "java"
+                "java",
+                "duckdb"
               ]
             }
           }

backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.494.0"
+version = "1.496.3"
 authors.workspace = true
 edition.workspace = true
 
@@ -32,7 +32,7 @@ members = [
 ]
 
 [workspace.package]
-version = "1.494.0"
+version = "1.496.3"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -49,6 +49,7 @@ lto = "thin"
 
 [features]
 default = []
+private = ["windmill-api/private", "windmill-autoscaling/private", "windmill-common/private", "windmill-git-sync/private", "windmill-indexer/private", "windmill-queue/private", "windmill-worker/private"]
 agent_worker_server = ["windmill-api/agent_worker_server"]
 enterprise = ["windmill-worker/enterprise", "windmill-queue/enterprise", "windmill-api/enterprise", "dep:windmill-autoscaling", "windmill-autoscaling/enterprise", "windmill-git-sync/enterprise", "windmill-common/prometheus", "windmill-common/enterprise"]
 enterprise_saml = ["windmill-api/enterprise_saml", "oauth2"]
@@ -94,8 +95,10 @@ php = ["windmill-worker/php"]
 csharp = ["windmill-worker/csharp"]
 nu = ["windmill-worker/nu"]
 java = ["windmill-worker/java"]
-all_languages = [ "python", "deno_core", "rust", "mysql", "oracledb", "duckdb", "mssql", "bigquery", "csharp", "nu", "php", "java"]
-
+all_languages = ["python", "deno_core", "rust", "mysql", "oracledb", "duckdb", "mssql", "bigquery", "csharp", "nu", "php", "java"]
+# For windows we have another set of languages enabled
+# NOTE: DuckDB is ignored because of compilation problems
+all_languages_windows = ["python", "deno_core", "rust", "mysql", "oracledb", "mssql", "bigquery", "csharp", "nu", "php", "java"]
 
 [patch.crates-io]
 object_store = { git = "https://github.com/apache/arrow-rs-object-store", rev = "36752c975d4f29e20b57c91f81a10872dcd48ae7" } 

backend/all_features_oss.sh

@@ -0,0 +1,20 @@
+# This script outputs all features except private. Usage :
+#  > cargo build --features $(./all_features_oss.sh)
+
+#!/bin/bash
+
+# Path to the Cargo.toml file
+CARGO_TOML_PATH="./Cargo.toml"
+
+# Extract features from Cargo.toml and output them separated by commas
+if [[ -f "$CARGO_TOML_PATH" ]]; then
+    grep -A 100 '\[features\]' "$CARGO_TOML_PATH" | \
+    sed -n '/\[features\]/,/^\[/p' | \
+    grep -E '^[a-zA-Z0-9_-]+' | \
+    grep -v 'private' | \
+    cut -d' ' -f1 | \
+    paste -sd ',' -
+else
+    echo "Cargo.toml not found at $CARGO_TOML_PATH"
+    exit 1
+fi

backend/ee-repo-ref.txt

@@ -1 +1 @@
-8a2506e86b923c00522cb83b052586f705f7aa8e
+ab4f856708a056973faea19f10eda5efff546176

backend/migrations/20250604181226_auth_cache_invalidation.down.sql

@@ -0,0 +1,4 @@
+-- Remove token invalidation notification trigger
+
+DROP TRIGGER IF EXISTS token_invalidation_trigger ON token;
+DROP FUNCTION IF EXISTS notify_token_invalidation();

backend/migrations/20250604181226_auth_cache_invalidation.up.sql

@@ -0,0 +1,17 @@
+-- Add token invalidation notification trigger
+
+CREATE OR REPLACE FUNCTION notify_token_invalidation()
+RETURNS TRIGGER AS $$
+BEGIN
+    -- Only notify for session token deletions when the invalidation settings are enabled
+    IF OLD.label = 'session' AND OLD.email IS NOT NULL THEN
+        PERFORM pg_notify('notify_token_invalidation', OLD.token);
+    END IF;
+    RETURN OLD;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER token_invalidation_trigger
+AFTER DELETE ON token
+FOR EACH ROW
+EXECUTE FUNCTION notify_token_invalidation();

backend/src/ee_oss.rs

@@ -1,8 +1,13 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::ee::*;
+
+#[cfg(not(feature = "private"))]
 pub async fn set_license_key(_license_key: String) -> () {
     // Implementation is not open source
 }
 
-#[cfg(feature = "enterprise")]
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
 pub async fn verify_license_key() -> () {
     // Implementation is not open source
 }

backend/src/main.rs

@@ -28,7 +28,9 @@ use uuid::Uuid;
 use windmill_api::HTTP_CLIENT;
 
 #[cfg(feature = "enterprise")]
-use windmill_common::ee::{maybe_renew_license_key_on_start, LICENSE_KEY_ID, LICENSE_KEY_VALID};
+use windmill_common::ee_oss::{
+    maybe_renew_license_key_on_start, LICENSE_KEY_ID, LICENSE_KEY_VALID,
+};
 
 use windmill_common::{
     agent_workers::build_agent_http_client,
@@ -49,9 +51,12 @@ use windmill_common::{
         TIMEOUT_WAIT_RESULT_SETTING,
     },
     scripts::ScriptLang,
-    stats_ee::schedule_stats,
+    stats_oss::schedule_stats,
     triggers::TriggerKind,
-    utils::{hostname, rd_string, Mode, GIT_VERSION, MODE_AND_ADDONS},
+    utils::{
+        create_default_worker_suffix, create_ssh_agent_worker_suffix, worker_name_with_suffix,
+        Mode, GIT_VERSION, HOSTNAME, MODE_AND_ADDONS,
+    },
     worker::{
         reload_custom_tags_setting, Connection, HUB_CACHE_DIR, TMP_DIR, TMP_LOGS_DIR, WORKER_GROUP,
     },
@@ -75,8 +80,7 @@ use windmill_worker::{
     get_hub_script_content_and_requirements, BUN_BUNDLE_CACHE_DIR, BUN_CACHE_DIR, CSHARP_CACHE_DIR,
     DENO_CACHE_DIR, DENO_CACHE_DIR_DEPS, DENO_CACHE_DIR_NPM, GO_BIN_CACHE_DIR, GO_CACHE_DIR,
     JAVA_CACHE_DIR, NU_CACHE_DIR, POWERSHELL_CACHE_DIR, PY310_CACHE_DIR, PY311_CACHE_DIR,
-    PY312_CACHE_DIR, PY313_CACHE_DIR, RUST_CACHE_DIR, TAR_JAVA_CACHE_DIR, TAR_PY310_CACHE_DIR,
-    TAR_PY311_CACHE_DIR, TAR_PY312_CACHE_DIR, TAR_PY313_CACHE_DIR, UV_CACHE_DIR,
+    PY312_CACHE_DIR, PY313_CACHE_DIR, RUST_CACHE_DIR, TAR_JAVA_CACHE_DIR, UV_CACHE_DIR,
 };
 
 use crate::monitor::{
@@ -98,7 +102,9 @@ const DEFAULT_NUM_WORKERS: usize = 1;
 const DEFAULT_PORT: u16 = 8000;
 const DEFAULT_SERVER_BIND_ADDR: Ipv4Addr = Ipv4Addr::new(0, 0, 0, 0);
 
-mod ee;
+#[cfg(feature = "private")]
+pub mod ee;
+mod ee_oss;
 mod monitor;
 
 pub fn setup_deno_runtime() -> anyhow::Result<()> {
@@ -261,7 +267,7 @@ async fn windmill_main() -> anyhow::Result<()> {
         tracing::error!("Failed to install rustls crypto provider");
     }
 
-    let hostname = hostname();
+    let hostname = HOSTNAME.to_owned();
 
     let mode_and_addons = MODE_AND_ADDONS.clone();
     let mode = mode_and_addons.mode;
@@ -340,7 +346,7 @@ async fn windmill_main() -> anyhow::Result<()> {
             "Creating http client for cluster using base internal url {}",
             std::env::var("BASE_INTERNAL_URL").unwrap_or_default()
         );
-        let suffix = windmill_common::utils::worker_suffix(&hostname, &rd_string(5));
+        let suffix = create_ssh_agent_worker_suffix(&hostname);
         (
             Connection::Http(build_agent_http_client(&suffix)),
             Some(suffix),
@@ -552,7 +558,7 @@ Windmill Community Edition {GIT_VERSION}
                 _ = indexer_rx.recv() => {
                     tracing::info!("Received killpill, aborting index initialization");
                 },
-                res = windmill_indexer::completed_runs_ee::init_index(&db) => {
+                res = windmill_indexer::completed_runs_oss::init_index(&db) => {
                         let res = res?;
                         reader = Some(res.0);
                         writer = Some(res.1);
@@ -574,7 +580,7 @@ Windmill Community Edition {GIT_VERSION}
             async {
                 if let Some(db) = conn.as_sql() {
                     if let Some(index_writer) = index_writer2 {
-                        windmill_indexer::completed_runs_ee::run_indexer(
+                        windmill_indexer::completed_runs_oss::run_indexer(
                             db.clone(),
                             index_writer,
                             indexer_rx,
@@ -596,7 +602,7 @@ Windmill Community Edition {GIT_VERSION}
                     _ = indexer_rx.recv() => {
                         tracing::info!("Received killpill, aborting index initialization");
                     },
-                    res = windmill_indexer::service_logs_ee::init_index(&db, killpill_tx.clone()) => {
+                    res = windmill_indexer::service_logs_oss::init_index(&db, killpill_tx.clone()) => {
                             let res = res?;
                             reader = Some(res.0);
                             writer = Some(res.1);
@@ -618,7 +624,7 @@ Windmill Community Edition {GIT_VERSION}
             async {
                 if let Some(db) = conn.as_sql() {
                     if let Some(log_index_writer) = log_index_writer2 {
-                        windmill_indexer::service_logs_ee::run_indexer(
+                        windmill_indexer::service_logs_oss::run_indexer(
                             db.clone(),
                             log_index_writer,
                             log_indexer_rx,
@@ -675,19 +681,21 @@ Windmill Community Edition {GIT_VERSION}
                 let base_internal_url = base_internal_rx.await?;
                 if worker_mode {
                     let mut workers = vec![];
+
                     for i in 0..num_workers {
-                        let suffix: String = if i == 0 && first_suffix.as_ref().is_some() {
+                        let suffix = if i == 0 && first_suffix.is_some() {
                             first_suffix.as_ref().unwrap().clone()
                         } else {
-                            windmill_common::utils::worker_suffix(&hostname, &rd_string(5))
+                            create_default_worker_suffix(&hostname)
                         };
+
                         let worker_conn = WorkerConn {
                             conn: if i == 0 || mode != Mode::Agent {
                                 conn.clone()
                             } else {
                                 Connection::Http(build_agent_http_client(&suffix))
                             },
-                            worker_name: windmill_common::utils::worker_name_with_suffix(
+                            worker_name: worker_name_with_suffix(
                                 mode == Mode::Agent,
                                 WORKER_GROUP.as_str(),
                                 &suffix,
@@ -852,6 +860,11 @@ Windmill Community Edition {GIT_VERSION}
                                                         }
                                                     };
                                                 },
+                                                "notify_token_invalidation" => {
+                                                    let token = n.payload();
+                                                    tracing::info!("Token invalidation detected for token: {}...", &token[..token.len().min(8)]);
+                                                    windmill_api::auth::invalidate_token_from_cache(token);
+                                                },
                                                 "notify_global_setting_change" => {
                                                     tracing::info!("Global setting change detected: {}", n.payload());
                                                     match n.payload() {
@@ -884,7 +897,7 @@ Windmill Community Edition {GIT_VERSION}
                                                             if let Err(e) = load_tag_per_workspace_workspaces(&db).await {
                                                                 tracing::error!("Error loading default tag per workspace workspaces: {e:#}");
                                                             }
-                                                        }
+                                                        },
                                                         SMTP_SETTING => {
                                                             reload_smtp_config(&db).await;
                                                         },
@@ -1001,7 +1014,6 @@ Windmill Community Edition {GIT_VERSION}
                                                                 tracing::error!(error = %e, "Could not reload critical alert UI setting");
                                                             }
                                                         },
-
                                                         a @_ => {
                                                             tracing::info!("Unrecognized Global Setting Change Payload: {:?}", a);
                                                         }
@@ -1086,7 +1098,7 @@ Windmill Community Edition {GIT_VERSION}
                             tracing::info!("Reloading config after 12 hours");
                             initial_load(&conn, tx.clone(), worker_mode, server_mode, #[cfg(feature = "parquet")] disable_s3_store).await;
                             #[cfg(feature = "enterprise")]
-                            ee::verify_license_key().await;
+                            ee_oss::verify_license_key().await;
                         }
                     }
                 },
@@ -1174,6 +1186,7 @@ async fn listen_pg(url: &str) -> Option<PgListener> {
         "notify_webhook_change",
         "notify_workspace_envs_change",
         "notify_runnable_version_change",
+        "notify_token_invalidation",
     ];
 
     #[cfg(feature = "http_trigger")]
@@ -1267,10 +1280,6 @@ pub async fn run_workers(
         PY311_CACHE_DIR,
         PY312_CACHE_DIR,
         PY313_CACHE_DIR,
-        TAR_PY310_CACHE_DIR,
-        TAR_PY311_CACHE_DIR,
-        TAR_PY312_CACHE_DIR,
-        TAR_PY313_CACHE_DIR,
         BUN_BUNDLE_CACHE_DIR,
         GO_CACHE_DIR,
         GO_BIN_CACHE_DIR,

backend/src/monitor.rs

@@ -29,9 +29,9 @@ use windmill_api::{
 };
 
 #[cfg(feature = "enterprise")]
-use windmill_common::ee::low_disk_alerts;
+use windmill_common::ee_oss::low_disk_alerts;
 #[cfg(feature = "enterprise")]
-use windmill_common::ee::{jobs_waiting_alerts, worker_groups_alerts};
+use windmill_common::ee_oss::{jobs_waiting_alerts, worker_groups_alerts};
 
 use windmill_common::client::AuthedClient;
 #[cfg(feature = "oauth2")]
@@ -41,7 +41,7 @@ use windmill_common::s3_helpers::reload_object_store_setting;
 use windmill_common::{
     agent_workers::DECODED_AGENT_TOKEN,
     auth::create_token_for_owner,
-    ee::CriticalErrorChannel,
+    ee_oss::CriticalErrorChannel,
     error,
     flow_status::{FlowStatus, FlowStatusModule},
     global_settings::{
@@ -87,9 +87,9 @@ use windmill_worker::{
 use windmill_common::s3_helpers::ObjectStoreReload;
 
 #[cfg(feature = "enterprise")]
-use crate::ee::verify_license_key;
+use crate::ee_oss::verify_license_key;
 
-use crate::ee::set_license_key;
+use crate::ee_oss::set_license_key;
 
 #[cfg(feature = "prometheus")]
 lazy_static::lazy_static! {
@@ -1609,7 +1609,7 @@ pub async fn reload_base_url_setting(conn: &Connection) -> error::Result<()> {
 
         if let Some(q) = q_oauth {
             if let Ok(v) = serde_json::from_value::<
-                Option<HashMap<String, windmill_api::oauth2_ee::OAuthClient>>,
+                Option<HashMap<String, windmill_api::oauth2_oss::OAuthClient>>,
             >(q.clone())
             {
                 v
@@ -1630,7 +1630,7 @@ pub async fn reload_base_url_setting(conn: &Connection) -> error::Result<()> {
     {
         if let Some(db) = conn.as_sql() {
             let mut l = windmill_api::OAUTH_CLIENTS.write().await;
-            *l = windmill_api::oauth2_ee::build_oauth_clients(&base_url, oauths, db).await
+            *l = windmill_api::oauth2_oss::build_oauth_clients(&base_url, oauths, db).await
             .map_err(|e| tracing::error!("Error building oauth clients (is the oauth.json mounted and in correct format? Use '{}' as minimal oauth.json): {}", "{}", e))
             .unwrap();
         }
@@ -1914,12 +1914,12 @@ async fn handle_zombie_jobs(db: &Pool<Postgres>, base_internal_url: &str, worker
         .await
         .expect("could not create job token");
 
-        let client = AuthedClient {
-            base_internal_url: base_internal_url.to_string(),
+        let client = AuthedClient::new(
+            base_internal_url.to_string(),
+            job.workspace_id.to_string(),
             token,
-            workspace: job.workspace_id.to_string(),
-            force_client: None,
-        };
+            None,
+        );
 
         let last_ping = job.last_ping.clone();
         let error_message = format!(
@@ -1938,7 +1938,7 @@ async fn handle_zombie_jobs(db: &Pool<Postgres>, base_internal_url: &str, worker
             None,
             error::Error::ExecutionErr(error_message),
             true,
-            same_worker_tx_never_used,
+            Some(&same_worker_tx_never_used),
             "",
             worker_name,
             send_result_never_used,

backend/substitute_ee_code.sh

@@ -4,8 +4,8 @@ script_dirpath="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 root_dirpath="$(cd "${script_dirpath}/.." && pwd)"
 
 REVERT="NO"
-REVERT_PREVIOUS="NO"
 COPY="NO"
+MOVE_NEW_FILES="NO"
 EE_CODE_DIR="../windmill-ee-private/"
 
 while [[ $# -gt 0 ]]; do
@@ -16,13 +16,7 @@ while [[ $# -gt 0 ]]; do
       # this to work (commit hooks should prevent this from happening, as well as the fact
       # that we're using symlinks by default).
       REVERT="YES"
-      shift
-      ;;
-    --revert-previous)
-      # This is a special case of --revert that will revert to the previous commit.
-      REVERT="YES"
-      REVERT_PREVIOUS="YES"
-      echo "Reverting to previous commit"
+      MOVE_NEW_FILES="YES"
       shift
       ;;
     -c|--copy)
@@ -33,6 +27,11 @@ while [[ $# -gt 0 ]]; do
       COPY="YES"
       shift # past argument
       ;;
+    -m|--move-new-files)
+      # This moves all new EE files from the public repository to the private repository.
+      MOVE_NEW_FILES="YES"
+      shift # past argument
+      ;;
     -d|--dir)
       # Path to the local directory of the windmill-ee-private repository. By defaults, it
       # assumes it is cloned next to the Windmill OSS repo.
@@ -70,29 +69,34 @@ if [ "$REVERT" == "YES" ]; then
   for ee_file in $(find ${EE_CODE_DIR} -name "*ee.rs"); do
     ce_file="${ee_file/${EE_CODE_DIR}/}"
     ce_file="${root_dirpath}/backend/${ce_file}"
-    if [ "$REVERT_PREVIOUS" == "YES" ]; then
-      git checkout HEAD@{3} ${ce_file} || true
-    else
-      git restore --staged ${ce_file} || true
-      git restore ${ce_file} || true
-    fi
+    rm ${ce_file} || true
   done
-else
+elif [ "$MOVE_NEW_FILES" == "NO" ]; then
   # This replaces all files in current repo with alternative EE files in windmill-ee-private
   for ee_file in $(find "${EE_CODE_DIR}" -name "*ee.rs"); do
-    ce_file="${ee_file/${EE_CODE_DIR}/}"
-    ce_file="${root_dirpath}/backend/${ce_file}"
-    if [[ -f "${ce_file}" ]]; then
-      rm "${ce_file}"
-      if [ "$COPY" == "YES" ]; then
-        cp "${ee_file}" "${ce_file}"
-        echo "File copied '${ee_file}' -->> '${ce_file}'"
-      else
-        ln -s "${ee_file}" "${ce_file}"
-        echo "Symlink created '${ee_file}' -->> '${ce_file}'"
-      fi
+  ce_file="${ee_file/${EE_CODE_DIR}/}"
+  ce_file="${root_dirpath}/backend/${ce_file}"
+    if [ "$COPY" == "YES" ]; then
+      cp "${ee_file}" "${ce_file}"
+      echo "File copied '${ee_file}' -->> '${ce_file}'"
     else
-      echo "File ${ce_file} is not a file, ignoring"
+      ln -s "${ee_file}" "${ce_file}" || true
+      echo "Symlink created '${ee_file}' -->> '${ce_file}'"
     fi
   done
 fi
+
+if [ "$MOVE_NEW_FILES" == "YES" ]; then
+  for ce_file in $(find "${root_dirpath}"/backend/windmill-*/src/ -name "*ee.rs"); do
+    backend_dirpath="${root_dirpath}/backend/"
+    ee_file="${ce_file/${backend_dirpath}/}"
+    ee_file="${EE_CODE_DIR}${ee_file}"
+    if [ ! -f "${ee_file}" ]; then
+      mv "${ce_file}" "${ee_file}"
+      if [ ! "$REVERT" == "YES" ]; then
+        ln -s "${ee_file}" "${ce_file}"
+      fi
+      echo "File moved '${ce_file}' -->> '${ee_file}'"
+    fi
+  done
+fi

backend/tests/worker.rs

@@ -3969,8 +3969,7 @@ async fn assert_lockfile(
 #[cfg(feature = "python")]
 #[sqlx::test(fixtures("base", "lockfile_python"))]
 async fn test_requirements_python(db: Pool<Postgres>) {
-    let content = r#"
-# py: 3.11.11
+    let content = r#"# py: ==3.11.11
 # requirements:
 # tiny==0.1.3
 
@@ -3997,8 +3996,7 @@ def main():
 #[sqlx::test(fixtures("base", "lockfile_python"))]
 async fn test_extra_requirements_python(db: Pool<Postgres>) {
     {
-        let content = r#"
-# py: ==3.11.11
+        let content = r#"# py: ==3.11.11
 # extra_requirements:
 # tiny
 
@@ -4025,8 +4023,7 @@ def main():
 #[cfg(feature = "python")]
 #[sqlx::test(fixtures("base", "lockfile_python"))]
 async fn test_extra_requirements_python2(db: Pool<Postgres>) {
-    let content = r#"
-# py: ==3.11.11
+    let content = r#"# py: ==3.11.11
 # extra_requirements:
 # tiny==0.1.3
 
@@ -4048,8 +4045,7 @@ def main():
 #[cfg(feature = "python")]
 #[sqlx::test(fixtures("base", "lockfile_python"))]
 async fn test_pins_python(db: Pool<Postgres>) {
-    let content = r#"
-# py: ==3.11.11
+    let content = r#"# py: ==3.11.11
 # extra_requirements:
 # tiny==0.1.3
 # bottle==0.13.2

backend/update_sqlx.sh

@@ -10,7 +10,6 @@ if [[ "$(uname)" == "Darwin" ]]; then
 fi
 
 cargo sqlx prepare --workspace -- --all-targets --all-features
-./substitute_ee_code.sh -r --dir ../windmill-ee-private
 
 # Undo the samael changes on macOS
 if [[ "$(uname)" == "Darwin" ]]; then

backend/windmill-api/Cargo.toml

@@ -10,6 +10,7 @@ path = "src/lib.rs"
 
 [features]
 default = []
+private = ["windmill-audit/private"]
 enterprise = ["windmill-queue/enterprise", "windmill-audit/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker/enterprise"]
 stripe = []
 agent_worker_server = []

backend/windmill-api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.494.0
+  version: 1.496.3
   title: Windmill API
 
   contact:
@@ -4501,6 +4501,13 @@ paths:
           in: query
           schema:
             type: boolean
+        - name: languages
+          in: query
+          description: |
+            Filter to only include scripts written in the given languages.
+            Accepts multiple values as a comma-separated list.
+          schema:
+            type: string
       responses:
         "200":
           description: All scripts
@@ -8444,6 +8451,31 @@ paths:
         "201":
           description: default error handler set
 
+  /w/{workspace}/http_triggers/create_many:
+    post:
+      summary: create many HTTP triggers
+      operationId: createHttpTriggers
+      tags:
+        - http_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        description: new http trigger
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                $ref: "#/components/schemas/NewHttpTrigger"
+      responses:
+        "201":
+          description: http trigger created
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/http_triggers/create:
     post:
       summary: create http trigger
@@ -8595,8 +8627,7 @@ paths:
                 route_path:
                   type: string
                 http_method:
-                  type: string
-                  enum: ["get", "post", "put", "delete", "patch"]
+                  $ref: "#/components/schemas/HttpMethod"
                 trigger_path:
                   type: string
                 workspaced_route:
@@ -9821,6 +9852,23 @@ paths:
                 items:
                   type: string
 
+  /w/{workspace}/postgres_triggers/postgres/version/{path}:
+    get:
+      summary: get postgres version
+      operationId: getPostgresVersion
+      tags:
+        - postgres_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: postgres version
+          content:
+            application/json:
+              schema:
+                type: string
+  
   /w/{workspace}/postgres_triggers/is_valid_postgres_configuration/{path}:
     get:
       summary: check if postgres configuration is set to logical
@@ -13168,6 +13216,8 @@ components:
     # NOTE: Not so many generators and validators support this format:
     # $ref: "../../openflow.openapi.yaml#/components/schemas"
     # This is why it is better to inline each of schemas for better compat
+    # Do not change next line. It is used by python-client for pre-processing
+    # -- INLINE START --
     OpenFlow:
       $ref: "../../openflow.openapi.yaml#/components/schemas/OpenFlow"
     FlowValue:
@@ -13206,6 +13256,8 @@ components:
       $ref: "../../openflow.openapi.yaml#/components/schemas/FlowStatus"
     FlowStatusModule:
       $ref: "../../openflow.openapi.yaml#/components/schemas/FlowStatusModule"
+    # -- INLINE END --
+    # Do not change line above
 
     AIProvider:
       type: string
@@ -14702,6 +14754,15 @@ components:
         - custom_script
         - signature
 
+    HttpMethod:
+      type: string
+      enum:
+        - get
+        - post
+        - put
+        - delete
+        - patch
+
     HttpTrigger:
       allOf:
         - $ref: "#/components/schemas/TriggerExtraProperty"
@@ -14721,13 +14782,7 @@ components:
           required:
             - s3
         http_method:
-          type: string
-          enum:
-            - get
-            - post
-            - put
-            - delete
-            - patch
+          $ref: "#/components/schemas/HttpMethod"
         authentication_resource_path:
           type: string
         is_async:
@@ -14778,13 +14833,7 @@ components:
         is_flow:
           type: boolean
         http_method:
-          type: string
-          enum:
-            - get
-            - post
-            - put
-            - delete
-            - patch
+          $ref: "#/components/schemas/HttpMethod"
         authentication_resource_path:
           type: string
         is_async:
@@ -14835,13 +14884,7 @@ components:
         is_flow:
           type: boolean
         http_method:
-          type: string
-          enum:
-            - get
-            - post
-            - put
-            - delete
-            - patch
+          $ref: "#/components/schemas/HttpMethod"
         is_async:
           type: boolean
         authentication_method:

backend/windmill-api/src/agent_workers_oss.rs

@@ -1,3 +1,7 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::agent_workers_ee::*;
+
 /*
  * Author: Ruben Fiszel
  * Copyright: Windmill Labs, Inc 2042
@@ -6,16 +10,21 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
+#[cfg(not(feature = "private"))]
 use crate::db::DB;
 
+#[cfg(not(feature = "private"))]
 use axum::Router;
 
+#[cfg(not(feature = "private"))]
 use serde::{Deserialize, Serialize};
 
+#[cfg(not(feature = "private"))]
 pub fn global_service() -> Router {
     Router::new()
 }
 
+#[cfg(not(feature = "private"))]
 pub fn workspaced_service(
     db: DB,
     _base_internal_url: String,
@@ -36,6 +45,7 @@ pub fn workspaced_service(
 }
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
+#[cfg(not(feature = "private"))]
 pub struct AgentAuth {
     pub worker_group: String,
     pub suffix: Option<String>,
@@ -43,8 +53,10 @@ pub struct AgentAuth {
     pub exp: Option<usize>,
 }
 
+#[cfg(not(feature = "private"))]
 pub struct AgentCache {}
 
+#[cfg(not(feature = "private"))]
 impl AgentCache {
     pub fn new() -> Self {
         AgentCache {}

backend/windmill-api/src/ai.rs

@@ -10,7 +10,7 @@ use reqwest::{Client, RequestBuilder};
 use serde::{Deserialize, Serialize};
 use serde_json::value::RawValue;
 use std::collections::HashMap;
-use windmill_audit::{audit_ee::audit_log, ActionKind};
+use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_common::error::{to_anyhow, Error, Result};
 
 lazy_static::lazy_static! {

backend/windmill-api/src/apps.rs

@@ -18,7 +18,7 @@ use crate::{
 };
 #[cfg(feature = "parquet")]
 use crate::{
-    job_helpers_ee::{
+    job_helpers_oss::{
         download_s3_file_internal, get_random_file_name, get_s3_resource,
         get_workspace_s3_resource, upload_file_from_req, DownloadFileQuery,
     },
@@ -48,7 +48,7 @@ use sha2::{Digest, Sha256};
 use sql_builder::{bind::Bind, SqlBuilder};
 use sqlx::{types::Uuid, FromRow};
 use std::str;
-use windmill_audit::audit_ee::audit_log;
+use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::{
     apps::{AppScriptId, ListAppQuery},

backend/windmill-api/src/apps_ee.rs

@@ -1,5 +0,0 @@
-use axum::Router;
-
-pub fn global_unauthed_service() -> Router {
-    Router::new()
-}

backend/windmill-api/src/apps_oss.rs

@@ -0,0 +1,11 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::apps_ee::*;
+
+#[cfg(not(feature = "private"))]
+use axum::Router;
+
+#[cfg(not(feature = "private"))]
+pub fn global_unauthed_service() -> Router {
+    Router::new()
+}

backend/windmill-api/src/args.rs

@@ -85,7 +85,7 @@ impl RawWebhookArgs {
         db: &DB,
         w_id: &str,
     ) -> Result<HashMap<String, Box<RawValue>>, Error> {
-        use crate::job_helpers_ee::{
+        use crate::job_helpers_oss::{
             get_random_file_name, get_workspace_s3_resource, upload_file_internal,
         };
         use futures::TryStreamExt;

backend/windmill-api/src/audit.rs

@@ -28,7 +28,7 @@ async fn get_audit(
     Path((w_id, id)): Path<(String, i32)>,
 ) -> JsonResult<AuditLog> {
     let tx = user_db.begin(&authed).await?;
-    let audit = windmill_audit::audit_ee::get_audit(tx, id, &w_id).await?;
+    let audit = windmill_audit::audit_oss::get_audit(tx, id, &w_id).await?;
     Ok(Json(audit))
 }
 async fn list_audit(
@@ -39,6 +39,6 @@ async fn list_audit(
     Query(lq): Query<ListAuditLogQuery>,
 ) -> JsonResult<Vec<AuditLog>> {
     let tx = user_db.begin(&authed).await?;
-    let rows = windmill_audit::audit_ee::list_audit(tx, w_id, pagination, lq).await?;
+    let rows = windmill_audit::audit_oss::list_audit(tx, w_id, pagination, lq).await?;
     Ok(Json(rows))
 }

backend/windmill-api/src/auth.rs

@@ -1,5 +1,5 @@
 #[cfg(feature = "enterprise")]
-use crate::ee::ExternalJwks;
+use crate::ee_oss::ExternalJwks;
 use axum::{
     async_trait,
     extract::{FromRequestParts, OriginalUri, Query},
@@ -26,6 +26,20 @@ use windmill_common::{
     users::{COOKIE_NAME, SUPERADMIN_SECRET_EMAIL},
 };
 
+lazy_static::lazy_static! {
+    // Global auth cache accessible from main.rs for direct invalidation
+    pub static ref AUTH_CACHE: Cache<(String, String), ExpiringAuthCache> = Cache::new(300);
+}
+
+// Global function to invalidate a specific token from cache
+pub fn invalidate_token_from_cache(token: &str) {
+    // Remove all cache entries for this token (across all workspaces)
+    AUTH_CACHE.retain(|(_workspace_id, cached_token), _cached_value| {
+        cached_token != token
+    });
+    tracing::info!("Invalidated token from auth cache: {}...", &token[..token.len().min(8)]);
+}
+
 #[derive(Clone)]
 pub struct ExpiringAuthCache {
     pub authed: ApiAuthed,
@@ -33,7 +47,6 @@ pub struct ExpiringAuthCache {
 }
 
 pub struct AuthCache {
-    cache: Cache<(String, String), ExpiringAuthCache>,
     db: DB,
     superadmin_secret: Option<String>,
     #[cfg(feature = "enterprise")]
@@ -47,7 +60,6 @@ impl AuthCache {
         #[cfg(feature = "enterprise")] ext_jwks: Option<Arc<RwLock<ExternalJwks>>>,
     ) -> Self {
         AuthCache {
-            cache: Cache::new(300),
             db,
             superadmin_secret,
             #[cfg(feature = "enterprise")]
@@ -56,7 +68,7 @@ impl AuthCache {
     }
 
     pub async fn invalidate(&self, w_id: &str, token: String) {
-        self.cache.remove(&(w_id.to_string(), token));
+        AUTH_CACHE.remove(&(w_id.to_string(), token));
     }
 
     pub async fn get_authed(&self, w_id: Option<String>, token: &str) -> Option<ApiAuthed> {
@@ -64,14 +76,14 @@ impl AuthCache {
             w_id.as_ref().unwrap_or(&"".to_string()).to_string(),
             token.to_string(),
         );
-        let s = self.cache.get(&key).map(|c| c.to_owned());
+        let s = AUTH_CACHE.get(&key).map(|c| c.to_owned());
         match s {
             Some(ExpiringAuthCache { authed, expiry }) if expiry > chrono::Utc::now() => {
                 Some(authed)
             }
             #[cfg(feature = "enterprise")]
             _ if token.starts_with("jwt_ext_") => {
-                let authed_and_exp = match crate::ee::jwt_ext_auth(
+                let authed_and_exp = match crate::ee_oss::jwt_ext_auth(
                     w_id.as_ref(),
                     token.trim_start_matches("jwt_ext_"),
                     self.ext_jwks.clone(),
@@ -86,7 +98,7 @@ impl AuthCache {
                 };
 
                 if let Some((authed, exp)) = authed_and_exp.clone() {
-                    self.cache.insert(
+                    AUTH_CACHE.insert(
                         key,
                         ExpiringAuthCache {
                             authed: authed.clone(),
@@ -123,7 +135,7 @@ impl AuthCache {
                             username_override,
                         };
 
-                        self.cache.insert(
+                        AUTH_CACHE.insert(
                             key,
                             ExpiringAuthCache {
                                 authed: authed.clone(),
@@ -317,7 +329,7 @@ impl AuthCache {
                         }
                     };
                     if let Some(authed) = authed_o.as_ref() {
-                        self.cache.insert(
+                        AUTH_CACHE.insert(
                             key,
                             ExpiringAuthCache {
                                 authed: authed.clone(),

backend/windmill-api/src/capture.rs

@@ -15,7 +15,7 @@ use {
 
 #[cfg(all(feature = "enterprise", feature = "gcp_trigger"))]
 use {
-    crate::gcp_triggers_ee::{
+    crate::gcp_triggers_oss::{
         manage_google_subscription, process_google_push_request, validate_jwt_token,
         CreateUpdateConfig, SubscriptionMode,
     },
@@ -23,7 +23,10 @@ use {
     http::HeaderMap,
 };
 
-#[cfg(all(feature = "enterprise", feature = "gcp_trigger"))]
+#[cfg(any(
+    all(feature = "enterprise", feature = "gcp_trigger"),
+    feature = "postgres_trigger"
+))]
 use windmill_common::utils::empty_as_none;
 
 #[cfg(all(feature = "enterprise", feature = "sqs_trigger"))]
@@ -33,25 +36,28 @@ use windmill_common::auth::aws::AwsAuthResourceType;
     feature = "http_trigger",
     all(feature = "enterprise", feature = "gcp_trigger")
 ))]
-use {serde::de::DeserializeOwned, windmill_common::error::Error};
+use serde::de::DeserializeOwned;
+
+#[cfg(any(
+    feature = "http_trigger",
+    feature = "postgres_trigger",
+    all(feature = "enterprise", feature = "gcp_trigger")
+))]
+use windmill_common::error::Error;
 
 #[cfg(all(feature = "enterprise", feature = "kafka"))]
-use crate::kafka_triggers_ee::KafkaTriggerConfigConnection;
+use crate::kafka_triggers_oss::KafkaTriggerConfigConnection;
 
 #[cfg(feature = "mqtt_trigger")]
 use crate::mqtt_triggers::{MqttClientVersion, MqttV3Config, MqttV5Config, SubscribeTopic};
 
 #[cfg(all(feature = "enterprise", feature = "nats"))]
-use crate::nats_triggers_ee::NatsTriggerConfigConnection;
+use crate::nats_triggers_oss::NatsTriggerConfigConnection;
 
 #[cfg(feature = "postgres_trigger")]
-use {
-    crate::postgres_triggers::{
-        create_logical_replication_slot_query, create_publication_query, drop_publication_query,
-        generate_random_string, get_database_connection, PublicationData,
-    },
-    itertools::Itertools,
-    pg_escape::quote_literal,
+use crate::postgres_triggers::{
+    create_logical_replication_slot, create_pg_publication, generate_random_string,
+    get_default_pg_connection, PublicationData,
 };
 
 use crate::{
@@ -200,9 +206,12 @@ pub struct MqttTriggerConfig {
 #[derive(Serialize, Deserialize, Debug)]
 pub struct PostgresTriggerConfig {
     pub postgres_resource_path: String,
+    #[serde(default, deserialize_with = "empty_as_none")]
     pub publication_name: Option<String>,
+    #[serde(default, deserialize_with = "empty_as_none")]
     pub replication_slot_name: Option<String>,
     pub publication: PublicationData,
+    pub basic_mode: Option<bool>,
 }
 
 #[cfg(feature = "websocket")]
@@ -292,57 +301,55 @@ async fn set_postgres_trigger_config(
     user_db: UserDB,
     mut capture_config: NewCaptureConfig,
 ) -> Result<NewCaptureConfig> {
-    let Some(TriggerConfig::Postgres(mut postgres_config)) = capture_config.trigger_config else {
-        return Err(windmill_common::error::Error::BadRequest(
-            "Invalid postgres config".to_string(),
-        ));
+    use windmill_common::error::to_anyhow;
+
+    let Some(TriggerConfig::Postgres(postgres_config)) = capture_config.trigger_config.as_mut()
+    else {
+        return Err(Error::BadRequest("Invalid postgres config".to_string()));
     };
 
-    let mut connection = get_database_connection(
-        authed,
-        Some(user_db),
-        &db,
-        &postgres_config.postgres_resource_path,
-        &w_id,
-    )
-    .await?;
+    if postgres_config.basic_mode.unwrap_or(false) {
+        let mut pg_connection = get_default_pg_connection(
+            authed,
+            Some(user_db),
+            &db,
+            &postgres_config.postgres_resource_path,
+            &w_id,
+        )
+        .await?;
 
-    let publication_name = postgres_config
-        .publication_name
-        .get_or_insert(format!("windmill_capture_{}", generate_random_string()));
-    let replication_slot_name = postgres_config
-        .replication_slot_name
-        .get_or_insert(publication_name.clone());
+        let tx = pg_connection.transaction().await.map_err(to_anyhow)?;
 
-    let query = drop_publication_query(&publication_name);
+        let publication_name = format!("windmill_capture_{}", generate_random_string());
+        let replication_slot_name = publication_name.clone();
 
-    sqlx::query(&query).execute(&mut connection).await?;
+        create_logical_replication_slot(tx.client(), &replication_slot_name)
+            .await
+            .map_err(to_anyhow)?;
 
-    let query = create_publication_query(
-        &publication_name,
-        postgres_config.publication.table_to_track.as_deref(),
-        &postgres_config
-            .publication
-            .transaction_to_track
-            .iter()
-            .map(AsRef::as_ref)
-            .collect_vec(),
-    );
+        create_pg_publication(
+            tx.client(),
+            &publication_name,
+            postgres_config.publication.table_to_track.as_deref(),
+            &postgres_config.publication.transaction_to_track,
+        )
+        .await
+        .map_err(to_anyhow)?;
 
-    sqlx::query(&query).execute(&mut connection).await?;
+        tx.commit().await.map_err(to_anyhow)?;
 
-    let query = format!(
-        "SELECT 1 from pg_replication_slots WHERE slot_name = {}",
-        quote_literal(replication_slot_name)
-    );
-
-    let row = sqlx::query(&query).fetch_optional(&mut connection).await?;
-
-    if row.is_none() {
-        let query = create_logical_replication_slot_query(&replication_slot_name);
-        sqlx::query(&query).execute(&mut connection).await?;
+        postgres_config.publication_name = Some(publication_name);
+        postgres_config.replication_slot_name = Some(replication_slot_name);
+    } else {
+        if postgres_config.publication_name.is_none()
+            || postgres_config.replication_slot_name.is_none()
+        {
+            return Err(Error::BadRequest(
+                "Publication name and slot name required in advanced mode".to_string(),
+            ));
+        }
     }
-    capture_config.trigger_config = Some(TriggerConfig::Postgres(postgres_config));
+
     Ok(capture_config)
 }
 
@@ -366,9 +373,7 @@ async fn set_gcp_trigger_config(
     mut capture_config: NewCaptureConfig,
 ) -> Result<NewCaptureConfig> {
     let Some(TriggerConfig::Gcp(mut gcp_config)) = capture_config.trigger_config else {
-        return Err(windmill_common::error::Error::BadRequest(
-            "Invalid GCP Pub/Sub config".to_string(),
-        ));
+        return Err(Error::BadRequest("Invalid GCP Pub/Sub config".to_string()));
     };
 
     let config = manage_google_subscription(
@@ -903,7 +908,7 @@ async fn gcp_payload(
     headers: HeaderMap,
     request: Request,
 ) -> Result<StatusCode> {
-    use crate::{gcp_triggers_ee::GcpTrigger, trigger_helpers::TriggerJobArgs};
+    use crate::{gcp_triggers_oss::GcpTrigger, trigger_helpers::TriggerJobArgs};
 
     let is_flow = matches!(runnable_kind, RunnableKind::Flow);
     let (gcp_trigger_config, owner, email): (GcpTriggerConfig, _, _) =

backend/windmill-api/src/configs.rs

@@ -14,7 +14,7 @@ use axum::{
 
 use serde::{Deserialize, Serialize};
 use sqlx::FromRow;
-use windmill_audit::audit_ee::audit_log;
+use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::{
     error::{self},

backend/windmill-api/src/db.rs

@@ -16,7 +16,7 @@ use sqlx::{
 };
 
 use tokio::task::JoinHandle;
-use windmill_audit::audit_ee::{AuditAuthor, AuditAuthorable};
+use windmill_audit::audit_oss::{AuditAuthor, AuditAuthorable};
 use windmill_common::{
     db::{Authable, Authed},
     error::Error,
@@ -804,6 +804,14 @@ async fn fix_job_completed_index(db: &DB) -> Result<(), Error> {
             .execute(db)
             .await?;
     });
+
+    run_windmill_migration!("v2_job_queue_suspend", db, |tx| {
+        sqlx::query!(
+            "CREATE INDEX CONCURRENTLY IF NOT EXISTS v2_job_queue_suspend ON v2_job_queue (workspace_id, suspend) WHERE suspend > 0;"
+        )
+        .execute(db)
+        .await?;
+    });
     Ok(())
 }
 

backend/windmill-api/src/ee_oss.rs

@@ -1,15 +1,21 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::ee::*;
+
+#[cfg(not(feature = "private"))]
 use anyhow::anyhow;
-#[cfg(feature = "enterprise")]
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
 use std::sync::Arc;
-#[cfg(feature = "enterprise")]
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
 use tokio::sync::RwLock;
 
+#[cfg(not(feature = "private"))]
 pub async fn validate_license_key(_license_key: String) -> anyhow::Result<(String, bool)> {
     // Implementation is not open source
     Err(anyhow!("License can't be validated in Windmill CE"))
 }
 
-#[cfg(feature = "enterprise")]
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
 pub async fn jwt_ext_auth(
     _w_id: Option<&String>,
     _token: &str,
@@ -20,10 +26,10 @@ pub async fn jwt_ext_auth(
     Err(anyhow!("External JWT auth is not open source"))
 }
 
-#[cfg(feature = "enterprise")]
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
 pub struct ExternalJwks;
 
-#[cfg(feature = "enterprise")]
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
 impl ExternalJwks {
     pub async fn load() -> Option<Arc<RwLock<Self>>> {
         // Implementation is not open source

backend/windmill-api/src/flows.rs

@@ -31,7 +31,7 @@ use hyper::StatusCode;
 use serde::{Deserialize, Serialize};
 use sql_builder::prelude::*;
 use sqlx::{FromRow, Postgres, Transaction};
-use windmill_audit::audit_ee::audit_log;
+use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::utils::query_elems_from_hub;
 use windmill_common::worker::to_raw_value;

backend/windmill-api/src/folders.rs

@@ -23,7 +23,7 @@ use axum::{
 };
 use lazy_static::lazy_static;
 use regex::Regex;
-use windmill_audit::audit_ee::audit_log;
+use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::{
     db::UserDB,

backend/windmill-api/src/gcp_triggers_oss.rs

@@ -1,29 +1,38 @@
-use crate::db::{ApiAuthed, DB};
-use crate::trigger_helpers::TriggerJobArgs;
-use axum::{extract::Request, Router};
-use http::HeaderMap;
-use serde::{Deserialize, Serialize};
-use serde_json::value::RawValue;
-use sqlx::prelude::FromRow;
-use sqlx::types::Json as SqlxJson;
-use std::collections::HashMap;
-use windmill_common::db::UserDB;
-use windmill_common::worker::to_raw_value;
-use windmill_common::{
-    error::{Error as WindmillError, Result as WindmillResult},
-    triggers::TriggerKind,
-    utils::empty_as_none,
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::gcp_triggers_ee::*;
+
+#[cfg(not(feature = "private"))]
+use {
+    crate::db::{ApiAuthed, DB},
+    crate::trigger_helpers::TriggerJobArgs,
+    axum::{extract::Request, Router},
+    http::HeaderMap,
+    serde::{Deserialize, Serialize},
+    serde_json::value::RawValue,
+    sqlx::prelude::FromRow,
+    sqlx::types::Json as SqlxJson,
+    std::collections::HashMap,
+    windmill_common::db::UserDB,
+    windmill_common::worker::to_raw_value,
+    windmill_common::{
+        error::{Error as WindmillError, Result as WindmillResult},
+        triggers::TriggerKind,
+        utils::empty_as_none,
+    },
 };
 
 #[derive(sqlx::Type, Debug, Deserialize, Serialize)]
 #[serde(rename_all(serialize = "lowercase", deserialize = "lowercase"))]
 #[sqlx(type_name = "DELIVERY_MODE", rename_all = "lowercase")]
 #[allow(unused)]
+#[cfg(not(feature = "private"))]
 pub enum DeliveryType {
     Pull,
     Push,
 }
 
+#[cfg(not(feature = "private"))]
 impl Default for DeliveryType {
     fn default() -> Self {
         Self::Pull
@@ -32,6 +41,7 @@ impl Default for DeliveryType {
 
 #[derive(FromRow, Deserialize, Serialize, Debug)]
 #[allow(unused)]
+#[cfg(not(feature = "private"))]
 pub struct PushConfig {
     #[serde(deserialize_with = "empty_as_none")]
     route_path: Option<String>,
@@ -42,6 +52,7 @@ pub struct PushConfig {
 }
 #[derive(Default, Debug, Serialize, Deserialize)]
 #[allow(unused)]
+#[cfg(not(feature = "private"))]
 pub struct CreateUpdateConfig {
     pub delivery_type: DeliveryType,
     #[serde(default, deserialize_with = "empty_as_none")]
@@ -50,6 +61,7 @@ pub struct CreateUpdateConfig {
 }
 
 #[derive(Debug, Deserialize, Serialize)]
+#[cfg(not(feature = "private"))]
 pub struct ExistingGcpSubscription {
     pub subscription_id: String,
     pub base_endpoint: String,
@@ -58,15 +70,18 @@ pub struct ExistingGcpSubscription {
 #[derive(Debug, Deserialize, Serialize, sqlx::Type)]
 #[serde(rename_all = "snake_case")]
 #[sqlx(type_name = "GCP_SUBSCRIPTION_MODE", rename_all = "snake_case")]
+#[cfg(not(feature = "private"))]
 pub enum SubscriptionMode {
     Existing,
     CreateUpdate,
 }
 
+#[cfg(not(feature = "private"))]
 pub fn workspaced_service() -> Router {
     Router::new()
 }
 
+#[cfg(not(feature = "private"))]
 pub fn start_consuming_gcp_pubsub_event(
     _db: DB,
     mut _killpill_rx: tokio::sync::broadcast::Receiver<()>,
@@ -74,6 +89,7 @@ pub fn start_consuming_gcp_pubsub_event(
     // implementation is not open source
 }
 
+#[cfg(not(feature = "private"))]
 pub async fn manage_google_subscription(
     _authed: ApiAuthed,
     _db: &DB,
@@ -91,6 +107,7 @@ pub async fn manage_google_subscription(
     Ok(CreateUpdateConfig::default())
 }
 
+#[cfg(not(feature = "private"))]
 pub async fn process_google_push_request(
     _headers: HeaderMap,
     _request: Request,
@@ -98,6 +115,7 @@ pub async fn process_google_push_request(
     Ok((String::new(), HashMap::new()))
 }
 
+#[cfg(not(feature = "private"))]
 pub async fn validate_jwt_token(
     _db: &DB,
     _user_db: UserDB,
@@ -110,11 +128,13 @@ pub async fn validate_jwt_token(
     Ok(())
 }
 
+#[cfg(not(feature = "private"))]
 pub fn gcp_push_route_handler() -> Router {
     Router::new()
 }
 
 #[derive(FromRow, Deserialize, Serialize, Debug)]
+#[cfg(not(feature = "private"))]
 pub struct GcpTrigger {
     pub gcp_resource_path: String,
     pub subscription_id: String,
@@ -135,7 +155,7 @@ pub struct GcpTrigger {
     pub last_server_ping: Option<chrono::DateTime<chrono::Utc>>,
     pub enabled: bool,
 }
-
+#[cfg(not(feature = "private"))]
 impl TriggerJobArgs<String> for GcpTrigger {
     fn v1_payload_fn(payload: String) -> HashMap<String, Box<RawValue>> {
         HashMap::from([("payload".to_string(), to_raw_value(&payload))])

backend/windmill-api/src/git_sync_ee.rs

@@ -1,9 +0,0 @@
-use axum::routing::Router;
-
-pub fn workspaced_service() -> Router {
-    Router::new()
-}
-
-pub fn global_service() -> Router {
-    Router::new()
-}

backend/windmill-api/src/git_sync_oss.rs

@@ -0,0 +1,16 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::git_sync_ee::*;
+
+#[cfg(not(feature = "private"))]
+use axum::routing::Router;
+
+#[cfg(not(feature = "private"))]
+pub fn workspaced_service() -> Router {
+    Router::new()
+}
+
+#[cfg(not(feature = "private"))]
+pub fn global_service() -> Router {
+    Router::new()
+}

backend/windmill-api/src/groups.rs

@@ -14,7 +14,7 @@ use axum::{
     routing::{delete, get, post},
     Json, Router,
 };
-use windmill_audit::audit_ee::audit_log;
+use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::worker::CLOUD_HOSTED;
 use windmill_common::{

backend/windmill-api/src/http_trigger_args.rs

@@ -21,7 +21,7 @@ use crate::{
 
 pub struct RawHttpTriggerArgs(pub RawWebhookArgs);
 
-#[derive(Serialize, Deserialize, sqlx::Type, Debug, Clone, Hash, Eq, PartialEq)]
+#[derive(Serialize, Deserialize, sqlx::Type, Debug, Clone, Copy, Hash, Eq, PartialEq)]
 #[sqlx(type_name = "HTTP_METHOD", rename_all = "lowercase")]
 #[serde(rename_all = "lowercase")]
 pub enum HttpMethod {

backend/windmill-api/src/http_triggers.rs

@@ -1,7 +1,7 @@
 #[cfg(feature = "http_trigger")]
 use crate::http_trigger_args::{HttpMethod, RawHttpTriggerArgs};
 #[cfg(feature = "parquet")]
-use crate::job_helpers_ee::get_workspace_s3_resource;
+use crate::job_helpers_oss::get_workspace_s3_resource;
 use crate::resources::try_get_resource_from_db_as;
 use crate::trigger_helpers::{get_runnable_format, RunnableId};
 use crate::utils::{non_empty_str, ExpiringCacheEntry};
@@ -14,6 +14,7 @@ use crate::{
     },
     users::fetch_api_authed,
 };
+use anyhow::anyhow;
 use axum::response::Response;
 use axum::{
     extract::{Path, Query},
@@ -28,13 +29,14 @@ use quick_cache::sync::Cache;
 use serde::{Deserialize, Serialize};
 use sql_builder::{bind::Bind, SqlBuilder};
 use sqlx::prelude::FromRow;
-use sqlx::PgTransaction;
+use sqlx::PgConnection;
 use std::borrow::Cow;
+use std::collections::HashSet;
 use std::{collections::HashMap, sync::Arc};
 use tokio::sync::{RwLock, RwLockReadGuard};
 use tower_http::cors::CorsLayer;
-use windmill_audit::{audit_ee::audit_log, ActionKind};
-use windmill_common::error::Error;
+use windmill_audit::{audit_oss::audit_log, ActionKind};
+use windmill_common::error::{Error, Result as WindmillResult};
 #[cfg(feature = "parquet")]
 use windmill_common::s3_helpers::build_object_store_client;
 use windmill_common::{
@@ -79,6 +81,7 @@ pub fn routes_global_service() -> Router {
 pub fn workspaced_service() -> Router {
     Router::new()
         .route("/create", post(create_trigger))
+        .route("/create_many", post(create_many_http_trigger))
         .route("/list", get(list_triggers))
         .route("/get/*path", get(get_trigger))
         .route("/update/*path", post(update_trigger))
@@ -273,7 +276,7 @@ async fn get_trigger(
 fn validate_authentication_method(
     authentication_method: AuthenticationMethod,
     raw_string: Option<bool>,
-) -> error::Result<()> {
+) -> WindmillResult<()> {
     match (authentication_method, raw_string) {
         (AuthenticationMethod::CustomScript, raw) if !raw.unwrap_or(false) == true => {
             return Err(Error::BadRequest(
@@ -287,57 +290,21 @@ fn validate_authentication_method(
     Ok(())
 }
 
-async fn increase_trigger_version_and_commit(mut tx: PgTransaction<'_>) -> error::Result<()> {
+async fn increase_trigger_version(tx: &mut PgConnection) -> WindmillResult<()> {
     sqlx::query!("SELECT nextval('http_trigger_version_seq')",)
-        .fetch_one(&mut *tx)
+        .fetch_one(tx)
         .await?;
 
-    tx.commit().await?;
-
     Ok(())
 }
 
-async fn create_trigger(
-    authed: ApiAuthed,
-    Extension(db): Extension<DB>,
-    Extension(user_db): Extension<UserDB>,
-    Path(w_id): Path<String>,
-    Json(ct): Json<NewTrigger>,
-) -> error::Result<(StatusCode, String)> {
-    require_admin(authed.is_admin, &authed.username)?;
-
-    if !VALID_ROUTE_PATH_RE.is_match(&ct.route_path) {
-        return Err(error::Error::BadRequest("Invalid route path".to_string()));
-    }
-
-    validate_authentication_method(ct.authentication_method, ct.raw_string)?;
-
-    // route path key is extracted from the route path to check for uniqueness
-    // it replaces /?:{key} with :key
-    // it will also remove the leading / if present, not an issue as we only allow : after slashes
-    let route_path_key = ROUTE_PATH_KEY_RE.replace_all(&ct.route_path, ":key");
-    let exists = route_path_key_exists(
-        &route_path_key,
-        &ct.http_method,
-        &w_id,
-        None,
-        ct.workspaced_route,
-        &db,
-    )
-    .await?;
-    if exists {
-        return Err(error::Error::BadRequest(
-            "A route already exists with this path".to_string(),
-        ));
-    }
-
-    if *CLOUD_HOSTED && (ct.is_static_website || ct.static_asset_config.is_some()) {
-        return Err(error::Error::BadRequest(
-            "Static website and static asset are not supported on cloud".to_string(),
-        ));
-    }
-
-    let mut tx = user_db.begin(&authed).await?;
+async fn create_trigger_inner(
+    tx: &mut PgConnection,
+    w_id: &str,
+    authed: &ApiAuthed,
+    new_http_trigger: &NewTrigger,
+    route_path_key: &str,
+) -> WindmillResult<()> {
     sqlx::query!(
         r#"
         INSERT INTO http_trigger (
@@ -365,51 +332,199 @@ async fn create_trigger(
         )
         "#,
         w_id,
-        ct.path,
-        ct.route_path,
+        new_http_trigger.path,
+        new_http_trigger.route_path,
         &route_path_key,
-        ct.workspaced_route,
-        ct.authentication_resource_path,
-        ct.wrap_body.unwrap_or(false),
-        ct.raw_string.unwrap_or(false),
-        ct.script_path,
-        ct.is_flow,
-        ct.is_async,
-        ct.authentication_method as _,
-        ct.http_method as _,
-        ct.static_asset_config as _,
+        new_http_trigger.workspaced_route,
+        new_http_trigger.authentication_resource_path,
+        new_http_trigger.wrap_body.unwrap_or(false),
+        new_http_trigger.raw_string.unwrap_or(false),
+        new_http_trigger.script_path,
+        new_http_trigger.is_flow,
+        new_http_trigger.is_async,
+        new_http_trigger.authentication_method as _,
+        new_http_trigger.http_method as _,
+        new_http_trigger.static_asset_config as _,
         &authed.username,
         &authed.email,
-        ct.is_static_website
+        new_http_trigger.is_static_website
     )
     .execute(&mut *tx)
     .await?;
 
     audit_log(
         &mut *tx,
-        &authed,
+        authed,
         "http_triggers.create",
         ActionKind::Create,
         &w_id,
-        Some(ct.path.as_str()),
+        Some(new_http_trigger.path.as_str()),
         None,
     )
     .await?;
 
-    increase_trigger_version_and_commit(tx).await?;
+    increase_trigger_version(tx).await?;
+
+    Ok(())
+}
+
+fn check_no_duplicates<'trigger>(
+    new_http_triggers: &[NewTrigger],
+    route_path_key: &[Cow<'trigger, str>],
+) -> Result<(), Error> {
+    let mut seen = HashSet::with_capacity(new_http_triggers.len());
+
+    for (i, trigger) in new_http_triggers.iter().enumerate() {
+        if !seen.insert((&route_path_key[i], trigger.http_method, trigger.workspaced_route)) {
+            return Err(Error::BadRequest(format!(
+            "Duplicate HTTP route detected: '{}'. Each HTTP route must have a unique 'route_path'.",
+            &trigger.route_path
+        )));
+        }
+    }
+
+    Ok(())
+}
+
+async fn create_many_http_trigger(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path(w_id): Path<String>,
+    Json(new_http_triggers): Json<Vec<NewTrigger>>,
+) -> WindmillResult<(StatusCode, String)> {
+    require_admin(authed.is_admin, &authed.username)?;
+
+    let error_wrapper = |path: &str, error: Error| -> Error {
+        anyhow!(
+            "Error occurred for HTTP route at route path: {}, error: {}",
+            path,
+            error
+        )
+        .into()
+    };
+
+    let mut route_path_keys = Vec::with_capacity(new_http_triggers.len());
+
+    for new_http_trigger in new_http_triggers.iter() {
+        let route_path_key = validate_http_trigger(&db, &w_id, new_http_trigger)
+            .await
+            .map_err(|err| error_wrapper(&new_http_trigger.route_path, err))?;
+
+        route_path_keys.push(route_path_key);
+    }
+
+    check_no_duplicates(&new_http_triggers, &route_path_keys)?;
+
+    let mut tx = user_db.begin(&authed).await?;
+
+    for (i, new_http_trigger) in new_http_triggers.iter().enumerate() {
+        create_trigger_inner(
+            &mut tx,
+            &w_id,
+            &authed,
+            new_http_trigger,
+            &route_path_keys[i],
+        )
+        .await
+        .map_err(|err| error_wrapper(&new_http_trigger.route_path, err))?;
+    }
+
+    tx.commit().await?;
+
+    for http_trigger in new_http_triggers.into_iter() {
+        handle_deployment_metadata(
+            &authed.email,
+            &authed.username,
+            &db,
+            &w_id,
+            windmill_git_sync::DeployedObject::HttpTrigger { path: http_trigger.path.clone() },
+            Some(format!("HTTP route '{}' created", http_trigger.path)),
+            true,
+        )
+        .await?;
+    }
+
+    Ok((StatusCode::CREATED, format!("Created all HTTP routes")))
+}
+
+async fn validate_http_trigger<'trigger>(
+    db: &DB,
+    w_id: &str,
+    new_http_trigger: &'trigger NewTrigger,
+) -> WindmillResult<Cow<'trigger, str>> {
+    if !VALID_ROUTE_PATH_RE.is_match(&new_http_trigger.route_path) {
+        return Err(error::Error::BadRequest("Invalid route path".to_string()));
+    }
+
+    validate_authentication_method(
+        new_http_trigger.authentication_method,
+        new_http_trigger.raw_string,
+    )?;
+
+    // route path key is extracted from the route path to check for uniqueness
+    // it replaces /?:{key} with :key
+    // it will also remove the leading / if present, not an issue as we only allow : after slashes
+    let route_path_key = ROUTE_PATH_KEY_RE.replace_all(&new_http_trigger.route_path, ":key");
+
+    let exists = route_path_key_exists(
+        &route_path_key,
+        &new_http_trigger.http_method,
+        &w_id,
+        None,
+        new_http_trigger.workspaced_route,
+        db,
+    )
+    .await?;
+
+    if exists {
+        return Err(error::Error::BadRequest(
+            "A route already exists with this path".to_string(),
+        ));
+    }
+
+    if *CLOUD_HOSTED
+        && (new_http_trigger.is_static_website || new_http_trigger.static_asset_config.is_some())
+    {
+        return Err(error::Error::BadRequest(
+            "Static website and static asset are not supported on cloud".to_string(),
+        ));
+    }
+
+    Ok(route_path_key)
+}
+
+async fn create_trigger(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path(w_id): Path<String>,
+    Json(new_http_trigger): Json<NewTrigger>,
+) -> WindmillResult<(StatusCode, String)> {
+    require_admin(authed.is_admin, &authed.username)?;
+
+    let route_path_key = validate_http_trigger(&db, &w_id, &new_http_trigger).await?;
+
+    let mut tx = user_db.begin(&authed).await?;
+
+    let http_trigger_path = new_http_trigger.path.clone();
+
+    create_trigger_inner(&mut tx, &w_id, &authed, &new_http_trigger, &route_path_key).await?;
+
+    tx.commit().await?;
 
     handle_deployment_metadata(
         &authed.email,
         &authed.username,
         &db,
         &w_id,
-        windmill_git_sync::DeployedObject::HttpTrigger { path: ct.path.clone() },
-        Some(format!("HTTP trigger '{}' created", ct.path)),
+        windmill_git_sync::DeployedObject::HttpTrigger { path: new_http_trigger.path.clone() },
+        Some(format!("HTTP route '{}' created", new_http_trigger.path)),
         true,
     )
     .await?;
 
-    Ok((StatusCode::CREATED, format!("{}", ct.path)))
+    Ok((StatusCode::CREATED, format!("{}", http_trigger_path)))
 }
 
 async fn update_trigger(
@@ -418,8 +533,9 @@ async fn update_trigger(
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
     Json(ct): Json<EditTrigger>,
-) -> error::Result<String> {
+) -> WindmillResult<String> {
     let path = path.to_path();
+
     if *CLOUD_HOSTED && (ct.is_static_website || ct.static_asset_config.is_some()) {
         return Err(error::Error::BadRequest(
             "Static website and static asset are not supported on cloud".to_string(),
@@ -563,7 +679,9 @@ async fn update_trigger(
     )
     .await?;
 
-    increase_trigger_version_and_commit(tx).await?;
+    increase_trigger_version(&mut tx).await?;
+
+    tx.commit().await?;
 
     handle_deployment_metadata(
         &authed.email,
@@ -571,7 +689,7 @@ async fn update_trigger(
         &db,
         &w_id,
         windmill_git_sync::DeployedObject::HttpTrigger { path: ct.path.clone() },
-        Some(format!("HTTP trigger '{}' updated", ct.path)),
+        Some(format!("HTTP route '{}' updated", ct.path)),
         true,
     )
     .await?;
@@ -584,7 +702,7 @@ async fn delete_trigger(
     Extension(db): Extension<DB>,
     Extension(user_db): Extension<UserDB>,
     Path((w_id, path)): Path<(String, StripPath)>,
-) -> error::Result<String> {
+) -> WindmillResult<String> {
     require_admin(authed.is_admin, &authed.username)?;
     let path = path.to_path();
     let mut tx = user_db.begin(&authed).await?;
@@ -609,7 +727,9 @@ async fn delete_trigger(
     )
     .await?;
 
-    increase_trigger_version_and_commit(tx).await?;
+    increase_trigger_version(&mut tx).await?;
+
+    tx.commit().await?;
 
     handle_deployment_metadata(
         &authed.email,
@@ -617,12 +737,12 @@ async fn delete_trigger(
         &db,
         &w_id,
         windmill_git_sync::DeployedObject::HttpTrigger { path: path.to_string() },
-        Some(format!("HTTP trigger '{}' deleted", path)),
+        Some(format!("HTTP route '{}' deleted", path)),
         true,
     )
     .await?;
 
-    Ok(format!("HTTP trigger {path} deleted"))
+    Ok(format!("HTTP route {path} deleted"))
 }
 
 async fn exists_trigger(
@@ -660,7 +780,7 @@ async fn route_path_key_exists(
     trigger_path: Option<&str>,
     workspaced_route: Option<bool>,
     db: &DB,
-) -> error::Result<bool> {
+) -> WindmillResult<bool> {
     let exists = if *CLOUD_HOSTED {
         sqlx::query_scalar!(
             r#"
@@ -861,7 +981,7 @@ pub async fn refresh_routers(db: &DB) -> Result<(bool, RwLockReadGuard<'_, Route
                         .insert(format!("{}/*wm_subpath", full_path), trigger.clone())
                         .unwrap_or_else(|e| {
                             tracing::warn!(
-                                "Failed to consider http trigger route {}/*wm_subpath: {:?}",
+                                "Failed to consider HTTP route {}/*wm_subpath: {:?}",
                                 full_path,
                                 e,
                             );
@@ -870,11 +990,7 @@ pub async fn refresh_routers(db: &DB) -> Result<(bool, RwLockReadGuard<'_, Route
                 router
                     .insert(full_path.clone(), trigger.clone())
                     .unwrap_or_else(|e| {
-                        tracing::warn!(
-                            "Failed to consider http trigger route {}: {:?}",
-                            full_path,
-                            e,
-                        );
+                        tracing::warn!("Failed to consider HTTP route {}: {:?}", full_path, e,);
                     });
             }
 
@@ -898,7 +1014,7 @@ async fn get_http_route_trigger(
     db: &DB,
     user_db: UserDB,
     method: &http::Method,
-) -> error::Result<(TriggerRoute, String, HashMap<String, String>, ApiAuthed)> {
+) -> WindmillResult<(TriggerRoute, String, HashMap<String, String>, ApiAuthed)> {
     let http_method: HttpMethod = method.try_into()?;
 
     let requested_path = format!("/{}", route_path);
@@ -947,11 +1063,11 @@ async fn get_http_route_trigger(
             );
             let exists = match HTTP_ACCESS_CACHE.get(&cache_key) {
                 Some(cache_entry) if cache_entry.expiry > std::time::Instant::now() => {
-                    tracing::debug!("HTTP access cache hit for trigger {}", trigger.path);
+                    tracing::debug!("HTTP access cache hit for route {}", trigger.path);
                     true
                 }
                 _ => {
-                    tracing::debug!("HTTP access cache miss for trigger {}", trigger.path);
+                    tracing::debug!("HTTP access cache miss for route {}", trigger.path);
                     let mut tx = user_db.begin(&authed).await?;
                     let exists = sqlx::query_scalar!(
                         r#"
@@ -1002,7 +1118,7 @@ async fn get_http_route_trigger(
         trigger.email.clone(),
         &trigger.workspace_id,
         &db,
-        Some(username_override.unwrap_or(format!("http-{}", trigger.path))),
+        Some(username_override.unwrap_or(format!("HTTP-{}", trigger.path))),
     )
     .await?;
 
@@ -1030,6 +1146,14 @@ async fn route_job(
     .await
     .map_err(|e| e.into_response())?;
 
+    if trigger.script_path.is_empty() && trigger.static_asset_config.is_none() {
+        return Err(Error::BadRequest(format!(
+            "Script path of HTTP route at path: {} must not be empty",
+            trigger.path
+        ))
+        .into_response());
+    }
+
     let args = args
         .process_args(
             &authed,
@@ -1066,11 +1190,11 @@ async fn route_job(
 
             let authentication_method = match HTTP_AUTH_CACHE.get(&cache_key) {
                 Some(cache_entry) if cache_entry.expiry > std::time::Instant::now() => {
-                    tracing::debug!("HTTP auth method cache hit for trigger {}", trigger.path);
+                    tracing::debug!("HTTP auth method cache hit for route {}", trigger.path);
                     cache_entry.value
                 }
                 _ => {
-                    tracing::debug!("HTTP auth method cache miss for trigger {}", trigger.path);
+                    tracing::debug!("HTTP auth method cache miss for route {}", trigger.path);
                     let auth_method = try_get_resource_from_db_as::<
                         crate::http_trigger_auth::AuthenticationMethod,
                     >(

backend/windmill-api/src/indexer_ee.rs

@@ -1,9 +0,0 @@
-use axum::Router;
-
-pub fn workspaced_service() -> Router {
-    Router::new()
-}
-
-pub fn global_service() -> Router {
-    Router::new()
-}

backend/windmill-api/src/indexer_oss.rs

@@ -0,0 +1,16 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::indexer_ee::*;
+
+#[cfg(not(feature = "private"))]
+use axum::Router;
+
+#[cfg(not(feature = "private"))]
+pub fn workspaced_service() -> Router {
+    Router::new()
+}
+
+#[cfg(not(feature = "private"))]
+pub fn global_service() -> Router {
+    Router::new()
+}

backend/windmill-api/src/inkeep_oss.rs

@@ -0,0 +1,11 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::inkeep_ee::*;
+
+#[cfg(not(feature = "private"))]
+use axum::Router;
+
+#[cfg(not(feature = "private"))]
+pub fn global_service() -> Router {
+    Router::new()
+}

backend/windmill-api/src/job_helpers_oss.rs

@@ -1,34 +1,45 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::job_helpers_ee::*;
+
+#[cfg(not(feature = "private"))]
 use axum::Router;
+#[cfg(not(feature = "private"))]
 use serde::Serialize;
+#[cfg(not(feature = "private"))]
 use uuid::Uuid;
+#[cfg(not(feature = "private"))]
 use windmill_common::s3_helpers::StorageResourceType;
 
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 use crate::db::{ApiAuthed, DB};
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 use object_store::{ObjectStore, PutMultipartOpts};
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 use std::sync::Arc;
+#[cfg(not(feature = "private"))]
 use windmill_common::error;
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 use windmill_common::{db::UserDB, s3_helpers::ObjectStoreResource};
 
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 use bytes::Bytes;
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 use futures::Stream;
 
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 use axum::response::Response;
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 use serde::Deserialize;
 
 #[derive(Serialize)]
+#[cfg(not(feature = "private"))]
 pub struct UploadFileResponse {
     pub file_key: String,
 }
 
 #[derive(Deserialize)]
+#[cfg(not(feature = "private"))]
 pub struct LoadImagePreviewQuery {
     #[allow(dead_code)]
     pub file_key: String,
@@ -37,6 +48,7 @@ pub struct LoadImagePreviewQuery {
 }
 
 #[derive(Deserialize)]
+#[cfg(not(feature = "private"))]
 pub struct DownloadFileQuery {
     #[allow(dead_code)]
     pub file_key: String,
@@ -46,11 +58,12 @@ pub struct DownloadFileQuery {
     pub s3_resource_path: Option<String>,
 }
 
+#[cfg(not(feature = "private"))]
 pub fn workspaced_service() -> Router {
     Router::new()
 }
 
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 pub async fn get_workspace_s3_resource<'c>(
     _authed: &ApiAuthed,
     _db: &DB,
@@ -63,10 +76,12 @@ pub async fn get_workspace_s3_resource<'c>(
     Ok((None, None))
 }
 
+#[cfg(not(feature = "private"))]
 pub fn get_random_file_name(_file_extension: Option<String>) -> String {
     unimplemented!("Not implemented in Windmill's Open Source repository")
 }
 
+#[cfg(not(feature = "private"))]
 pub async fn get_s3_resource<'c>(
     _authed: &ApiAuthed,
     _db: &DB,
@@ -82,7 +97,7 @@ pub async fn get_s3_resource<'c>(
     ))
 }
 
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 pub async fn upload_file_from_req(
     _s3_client: Arc<dyn ObjectStore>,
     _file_key: &str,
@@ -94,7 +109,7 @@ pub async fn upload_file_from_req(
     ))
 }
 
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 pub async fn upload_file_internal(
     _s3_client: Arc<dyn ObjectStore>,
     _file_key: &str,
@@ -106,7 +121,7 @@ pub async fn upload_file_internal(
     ))
 }
 
-#[cfg(feature = "parquet")]
+#[cfg(all(feature = "parquet", not(feature = "private")))]
 pub async fn download_s3_file_internal(
     _authed: ApiAuthed,
     _db: &DB,

backend/windmill-api/src/jobs.rs

@@ -26,6 +26,7 @@ use tokio::io::AsyncReadExt;
 #[cfg(feature = "prometheus")]
 use tokio::time::Instant;
 use tower::ServiceBuilder;
+use windmill_common::auth::is_super_admin_email;
 use windmill_common::error::JsonResult;
 use windmill_common::flow_status::{JobResult, RestartedFrom};
 use windmill_common::jobs::{format_completed_job_result, format_result, ENTRYPOINT_OVERRIDE};
@@ -64,7 +65,7 @@ use sqlx::types::JsonRawValue;
 use sqlx::{types::Uuid, FromRow, Postgres, Transaction};
 use tower_http::cors::{Any, CorsLayer};
 use urlencoding::encode;
-use windmill_audit::audit_ee::{audit_log, AuditAuthor};
+use windmill_audit::audit_oss::{audit_log, AuditAuthor};
 use windmill_audit::ActionKind;
 use windmill_common::worker::{to_raw_value, CUSTOM_TAGS_PER_WORKSPACE};
 use windmill_common::{
@@ -3140,28 +3141,27 @@ pub fn add_raw_string(
 }
 
 async fn check_tag_available_for_workspace(
+    db: &DB,
     w_id: &str,
     tag: &Option<String>,
     authed: &ApiAuthed,
 ) -> error::Result<()> {
     if let Some(tag) = tag {
-        if tag == "" {
+        if tag.is_empty() {
             return Ok(());
         }
 
         let tags = get_scope_tags(authed);
+        let mut is_tag_available_in_workspace = None;
+        let mut is_tag_in_workspace_custom_tags = false;
 
-        if let Some(tags) = tags {
-            if !tags.contains(&tag.as_str()) {
-                return Err(Error::BadRequest(format!(
-                    "Tag {tag} is not available in your scope"
-                )));
-            }
+        if let Some(tags) = tags.as_ref() {
+            is_tag_available_in_workspace = Some(tags.contains(&tag.as_str()));
         }
 
         let custom_tags_per_w = CUSTOM_TAGS_PER_WORKSPACE.read().await;
         if custom_tags_per_w.0.contains(&tag.to_string()) {
-            Ok(())
+            is_tag_in_workspace_custom_tags = true;
         } else if custom_tags_per_w.1.contains_key(tag)
             && custom_tags_per_w
                 .1
@@ -3169,21 +3169,38 @@ async fn check_tag_available_for_workspace(
                 .unwrap()
                 .contains(&w_id.to_string())
         {
-            Ok(())
-        } else {
+            is_tag_in_workspace_custom_tags = true;
+        }
+
+        match is_tag_available_in_workspace {
+            Some(true) | None => {
+                if is_tag_in_workspace_custom_tags {
+                    return Ok(());
+                }
+            }
+            _ => {}
+        }
+
+        if !is_super_admin_email(db, &authed.email).await? {
+            if tags.is_some() && is_tag_available_in_workspace.is_some() {
+                return Err(Error::BadRequest(format!(
+                    "Tag {tag} is not available in your scope"
+                )));
+            }
+
             return Err(error::Error::BadRequest(format!(
-                "Tag {tag} cannot be used on workspace {w_id}: (CUSTOM_TAGS: {:?})",
+                "Only super admins are allowed to use tags that are not included in the allowed CUSTOM_TAGS: {:?}",
                 custom_tags_per_w
             )));
         }
-    } else {
-        Ok(())
     }
+
+    return Ok(());
 }
 
 #[cfg(feature = "enterprise")]
 pub async fn check_license_key_valid() -> error::Result<()> {
-    use windmill_common::ee::LICENSE_KEY_VALID;
+    use windmill_common::ee_oss::LICENSE_KEY_VALID;
 
     let valid = *LICENSE_KEY_VALID.read().await;
     if !valid {
@@ -3509,7 +3526,7 @@ pub async fn run_flow_by_path_inner(
 
     let tag = run_query.tag.clone().or(tag);
 
-    check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
+    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
 
     let (email, permissioned_as, push_authed, tx) =
@@ -3701,7 +3718,7 @@ pub async fn run_script_by_path_inner(
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
 
     let tag = run_query.tag.clone().or(tag);
-    check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
+    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
 
     let (email, permissioned_as, push_authed, tx) =
         if let Some(on_behalf_of) = on_behalf_of.as_ref() {
@@ -3772,7 +3789,7 @@ pub async fn run_workflow_as_code(
 
     #[cfg(feature = "enterprise")]
     check_license_key_valid().await?;
-    check_tag_available_for_workspace(&w_id, &run_query.tag, &authed).await?;
+    check_tag_available_for_workspace(&db, &w_id, &run_query.tag, &authed).await?;
 
     if *CLOUD_HOSTED {
         tracing::info!("workflow_as_code_tracing id {i} ");
@@ -4369,7 +4386,7 @@ pub async fn run_wait_result_job_by_path_get(
     drop(tx);
 
     let tag = run_query.tag.clone().or(tag);
-    check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
+    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
 
     let (email, permissioned_as, push_authed, tx) =
         if let Some(on_behalf_of) = on_behalf_authed.as_ref() {
@@ -4509,7 +4526,7 @@ pub async fn run_wait_result_script_by_path_internal(
     drop(tx);
 
     let tag = run_query.tag.clone().or(tag);
-    check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
+    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
 
     let (email, permissioned_as, push_authed, tx) =
         if let Some(on_behalf_of) = on_behalf_of.as_ref() {
@@ -4610,7 +4627,7 @@ pub async fn run_wait_result_script_by_hash(
     check_scopes(&authed, || format!("run:script/{path}"))?;
 
     let tag = run_query.tag.clone().or(tag);
-    check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
+    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
 
     let (email, permissioned_as, push_authed, tx) = if let Some(email) = on_behalf_of_email.as_ref()
     {
@@ -4730,7 +4747,7 @@ pub async fn run_wait_result_flow_by_path_internal(
     drop(tx);
 
     let tag = run_query.tag.clone().or(tag);
-    check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
+    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
 
     let (email, permissioned_as, push_authed, tx) =
         if let Some(on_behalf_of_email) = on_behalf_of_email.as_ref() {
@@ -4804,7 +4821,7 @@ async fn run_preview_script(
     }
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
     let tag = run_query.tag.clone().or(preview.tag.clone());
-    check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
+    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
     let tx = PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into());
 
     let (uuid, tx) = push(
@@ -4886,7 +4903,7 @@ async fn run_bundle_preview_script(
 
             let scheduled_for = run_query.get_scheduled_for(&db).await?;
             let tag = run_query.tag.clone().or(preview.tag.clone());
-            check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
+            check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
             let ltx = PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into());
 
             let args = preview.args.unwrap_or_default();
@@ -5470,7 +5487,7 @@ async fn run_preview_flow_job(
     }
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
     let tag = run_query.tag.clone().or(raw_flow.tag.clone());
-    check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
+    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
     let tx = PushIsolationLevel::Isolated(user_db.clone(), authed.clone().into());
 
     let (uuid, tx) = push(
@@ -5565,7 +5582,7 @@ pub async fn run_job_by_hash_inner(
     let scheduled_for = run_query.get_scheduled_for(&db).await?;
     let tag = run_query.tag.clone().or(tag);
 
-    check_tag_available_for_workspace(&w_id, &tag, &authed).await?;
+    check_tag_available_for_workspace(&db, &w_id, &tag, &authed).await?;
 
     let (email, permissioned_as, push_authed, tx) = if let Some(email) = on_behalf_of_email.as_ref()
     {

backend/windmill-api/src/kafka_triggers_oss.rs

@@ -1,14 +1,24 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::kafka_triggers_ee::*;
+
+#[cfg(not(feature = "private"))]
 use crate::db::DB;
+#[cfg(not(feature = "private"))]
 use axum::Router;
+#[cfg(not(feature = "private"))]
 use serde::{Deserialize, Serialize};
 
 #[derive(Serialize, Deserialize)]
+#[cfg(not(feature = "private"))]
 pub struct KafkaResourceSecurity {}
 
+#[cfg(not(feature = "private"))]
 pub fn workspaced_service() -> Router {
     Router::new()
 }
 
+#[cfg(not(feature = "private"))]
 pub fn start_kafka_consumers(
     _db: DB,
     mut _killpill_rx: tokio::sync::broadcast::Receiver<()>,
@@ -17,9 +27,11 @@ pub fn start_kafka_consumers(
 }
 
 #[derive(Serialize, Deserialize)]
+#[cfg(not(feature = "private"))]
 pub enum KafkaTriggerConfigConnection {}
 
 #[derive(Serialize, Clone)]
+#[cfg(not(feature = "private"))]
 pub struct KafkaTrigger {
     pub workspace_id: String,
     pub path: String,
@@ -39,4 +51,4 @@ pub struct KafkaTrigger {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub error: Option<String>,
     pub enabled: bool,
-}
+}

backend/windmill-api/src/lib.rs

@@ -8,15 +8,15 @@
 
 use crate::db::ApiAuthed;
 #[cfg(feature = "enterprise")]
-use crate::ee::ExternalJwks;
+use crate::ee_oss::ExternalJwks;
 #[cfg(feature = "embedding")]
 use crate::embeddings::load_embeddings_db;
 #[cfg(feature = "oauth2")]
-use crate::oauth2_ee::AllClients;
+use crate::oauth2_oss::AllClients;
 #[cfg(feature = "oauth2")]
-use crate::oauth2_ee::SlackVerifier;
+use crate::oauth2_oss::SlackVerifier;
 #[cfg(feature = "smtp")]
-use crate::smtp_server_ee::SmtpServer;
+use crate::smtp_server_oss::SmtpServer;
 
 #[cfg(feature = "mcp")]
 use crate::mcp::{setup_mcp_server, Runner as McpRunner};
@@ -28,7 +28,7 @@ use crate::{
 };
 
 #[cfg(feature = "agent_worker_server")]
-use agent_workers_ee::AgentCache;
+use agent_workers_oss::AgentCache;
 
 use anyhow::Context;
 use argon2::Argon2;
@@ -58,22 +58,26 @@ use windmill_common::db::UserDB;
 use windmill_common::worker::CLOUD_HOSTED;
 use windmill_common::{utils::GIT_VERSION, BASE_URL, INSTANCE_NAME};
 
-use crate::scim_ee::has_scim_token;
+use crate::scim_oss::has_scim_token;
 use windmill_common::error::AppError;
 
+#[cfg(all(feature = "agent_worker_server", feature = "private"))]
+pub mod agent_workers_ee;
 #[cfg(feature = "agent_worker_server")]
-mod agent_workers_ee;
+mod agent_workers_oss;
 mod ai;
 mod apps;
 pub mod args;
 mod audit;
-mod auth;
+pub mod auth;
 mod capture;
 mod concurrency_groups;
 mod configs;
 mod db;
 mod drafts;
+#[cfg(feature = "private")]
 pub mod ee;
+pub mod ee_oss;
 pub mod embeddings;
 mod favorite;
 mod flows;
@@ -86,56 +90,93 @@ mod http_trigger_args;
 mod http_trigger_auth;
 #[cfg(feature = "http_trigger")]
 pub mod http_triggers;
-mod indexer_ee;
+#[cfg(feature = "private")]
+pub mod indexer_ee;
+mod indexer_oss;
+#[cfg(feature = "private")]
+mod inkeep_ee;
+mod inkeep_oss;
 mod inputs;
 mod integration;
 #[cfg(feature = "postgres_trigger")]
 mod postgres_triggers;
 
 mod approvals;
+#[cfg(all(feature = "enterprise", feature = "private"))]
+pub mod apps_ee;
 #[cfg(feature = "enterprise")]
-mod apps_ee;
+mod apps_oss;
+#[cfg(all(feature = "enterprise", feature = "gcp_trigger", feature = "private"))]
+pub mod gcp_triggers_ee;
 #[cfg(all(feature = "enterprise", feature = "gcp_trigger"))]
-mod gcp_triggers_ee;
+mod gcp_triggers_oss;
+#[cfg(all(feature = "enterprise", feature = "private"))]
+pub mod git_sync_ee;
 #[cfg(feature = "enterprise")]
-mod git_sync_ee;
+mod git_sync_oss;
+#[cfg(all(feature = "parquet", feature = "private"))]
+pub mod job_helpers_ee;
 #[cfg(feature = "parquet")]
-mod job_helpers_ee;
+mod job_helpers_oss;
 pub mod job_metrics;
 pub mod jobs;
+#[cfg(all(feature = "enterprise", feature = "kafka", feature = "private"))]
+pub mod kafka_triggers_ee;
 #[cfg(all(feature = "enterprise", feature = "kafka"))]
-mod kafka_triggers_ee;
+mod kafka_triggers_oss;
 #[cfg(feature = "mqtt_trigger")]
 mod mqtt_triggers;
+#[cfg(all(feature = "enterprise", feature = "nats", feature = "private"))]
+pub mod nats_triggers_ee;
 #[cfg(all(feature = "enterprise", feature = "nats"))]
-mod nats_triggers_ee;
-#[cfg(feature = "oauth2")]
+mod nats_triggers_oss;
+#[cfg(all(feature = "oauth2", feature = "private"))]
 pub mod oauth2_ee;
-mod oidc_ee;
+#[cfg(feature = "oauth2")]
+pub mod oauth2_oss;
+#[cfg(feature = "private")]
+pub mod oidc_ee;
+mod oidc_oss;
 mod raw_apps;
 mod resources;
-mod saml_ee;
+#[cfg(feature = "private")]
+pub mod saml_ee;
+mod saml_oss;
 mod schedule;
-mod scim_ee;
+#[cfg(feature = "private")]
+pub mod scim_ee;
+mod scim_oss;
 mod scripts;
 mod service_logs;
 mod settings;
 mod slack_approvals;
+#[cfg(all(feature = "smtp", feature = "private"))]
+pub mod smtp_server_ee;
 #[cfg(feature = "smtp")]
-mod smtp_server_ee;
+mod smtp_server_oss;
+#[cfg(all(feature = "enterprise", feature = "sqs_trigger", feature = "private"))]
+pub mod sqs_triggers_ee;
 #[cfg(all(feature = "enterprise", feature = "sqs_trigger"))]
-mod sqs_triggers_ee;
-mod teams_approvals_ee;
+mod sqs_triggers_oss;
+#[cfg(feature = "private")]
+pub mod teams_approvals_ee;
+mod teams_approvals_oss;
 mod trigger_helpers;
 
 mod static_assets;
+#[cfg(all(feature = "stripe", feature = "enterprise", feature = "private"))]
+pub mod stripe_ee;
 #[cfg(all(feature = "stripe", feature = "enterprise"))]
-mod stripe_ee;
-mod teams_ee;
+mod stripe_oss;
+#[cfg(feature = "private")]
+pub mod teams_ee;
+mod teams_oss;
 mod tracing_init;
 mod triggers;
 mod users;
-mod users_ee;
+#[cfg(feature = "private")]
+pub mod users_ee;
+mod users_oss;
 mod utils;
 mod variables;
 pub mod webhook_util;
@@ -143,9 +184,11 @@ pub mod webhook_util;
 mod websocket_triggers;
 mod workers;
 mod workspaces;
-mod workspaces_ee;
+#[cfg(feature = "private")]
+pub mod workspaces_ee;
 mod workspaces_export;
 mod workspaces_extra;
+mod workspaces_oss;
 
 #[cfg(feature = "mcp")]
 mod mcp;
@@ -218,9 +261,9 @@ type IndexReader = ();
 type ServiceLogIndexReader = ();
 
 #[cfg(feature = "tantivy")]
-type IndexReader = windmill_indexer::completed_runs_ee::IndexReader;
+type IndexReader = windmill_indexer::completed_runs_oss::IndexReader;
 #[cfg(feature = "tantivy")]
-type ServiceLogIndexReader = windmill_indexer::service_logs_ee::ServiceLogIndexReader;
+type ServiceLogIndexReader = windmill_indexer::service_logs_oss::ServiceLogIndexReader;
 
 pub async fn run_server(
     db: DB,
@@ -278,7 +321,7 @@ pub async fn run_server(
         .allow_headers([http::header::CONTENT_TYPE, http::header::AUTHORIZATION])
         .allow_origin(Any);
 
-    let sp_extension = Arc::new(saml_ee::build_sp_extension().await?);
+    let sp_extension = Arc::new(saml_oss::build_sp_extension().await?);
 
     if server_mode {
         #[cfg(feature = "embedding")]
@@ -317,7 +360,7 @@ pub async fn run_server(
     let job_helpers_service = {
         #[cfg(feature = "parquet")]
         {
-            job_helpers_ee::workspaced_service()
+            job_helpers_oss::workspaced_service()
         }
 
         #[cfg(not(feature = "parquet"))]
@@ -329,7 +372,7 @@ pub async fn run_server(
     let kafka_triggers_service = {
         #[cfg(all(feature = "enterprise", feature = "kafka"))]
         {
-            kafka_triggers_ee::workspaced_service()
+            kafka_triggers_oss::workspaced_service()
         }
 
         #[cfg(not(all(feature = "enterprise", feature = "kafka")))]
@@ -341,7 +384,7 @@ pub async fn run_server(
     let nats_triggers_service = {
         #[cfg(all(feature = "enterprise", feature = "nats"))]
         {
-            nats_triggers_ee::workspaced_service()
+            nats_triggers_oss::workspaced_service()
         }
 
         #[cfg(not(all(feature = "enterprise", feature = "nats")))]
@@ -365,7 +408,7 @@ pub async fn run_server(
     let gcp_triggers_service = {
         #[cfg(all(feature = "enterprise", feature = "gcp_trigger"))]
         {
-            gcp_triggers_ee::workspaced_service()
+            gcp_triggers_oss::workspaced_service()
         }
 
         #[cfg(not(all(feature = "enterprise", feature = "gcp_trigger")))]
@@ -377,7 +420,7 @@ pub async fn run_server(
     let sqs_triggers_service = {
         #[cfg(all(feature = "enterprise", feature = "sqs_trigger"))]
         {
-            sqs_triggers_ee::workspaced_service()
+            sqs_triggers_oss::workspaced_service()
         }
 
         #[cfg(not(all(feature = "enterprise", feature = "sqs_trigger")))]
@@ -432,13 +475,13 @@ pub async fn run_server(
         #[cfg(all(feature = "enterprise", feature = "kafka"))]
         {
             let kafka_killpill_rx = killpill_rx.resubscribe();
-            kafka_triggers_ee::start_kafka_consumers(db.clone(), kafka_killpill_rx);
+            kafka_triggers_oss::start_kafka_consumers(db.clone(), kafka_killpill_rx);
         }
 
         #[cfg(all(feature = "enterprise", feature = "nats"))]
         {
             let nats_killpill_rx = killpill_rx.resubscribe();
-            nats_triggers_ee::start_nats_consumers(db.clone(), nats_killpill_rx);
+            nats_triggers_oss::start_nats_consumers(db.clone(), nats_killpill_rx);
         }
 
         #[cfg(feature = "postgres_trigger")]
@@ -456,13 +499,13 @@ pub async fn run_server(
         #[cfg(all(feature = "enterprise", feature = "sqs_trigger"))]
         {
             let sqs_killpill_rx = killpill_rx.resubscribe();
-            sqs_triggers_ee::start_sqs(db.clone(), sqs_killpill_rx);
+            sqs_triggers_oss::start_sqs(db.clone(), sqs_killpill_rx);
         }
 
         #[cfg(all(feature = "enterprise", feature = "gcp_trigger"))]
         {
             let gcp_killpill_rx = killpill_rx.resubscribe();
-            gcp_triggers_ee::start_consuming_gcp_pubsub_event(db.clone(), gcp_killpill_rx);
+            gcp_triggers_oss::start_consuming_gcp_pubsub_event(db.clone(), gcp_killpill_rx);
         }
     }
 
@@ -497,7 +540,7 @@ pub async fn run_server(
     #[cfg(feature = "agent_worker_server")]
     let (agent_workers_router, agent_workers_bg_processor, agent_workers_killpill_tx) =
         if server_mode {
-            agent_workers_ee::workspaced_service(db.clone(), _base_internal_url.clone())
+            agent_workers_oss::workspaced_service(db.clone(), _base_internal_url.clone())
         } else {
             (Router::new(), vec![], None)
         };
@@ -535,7 +578,7 @@ pub async fn run_server(
                         .nest("/oauth", {
                             #[cfg(feature = "oauth2")]
                             {
-                                oauth2_ee::workspaced_service()
+                                oauth2_oss::workspaced_service()
                             }
 
                             #[cfg(not(feature = "oauth2"))]
@@ -552,7 +595,7 @@ pub async fn run_server(
                         )
                         .nest("/variables", variables::workspaced_service())
                         .nest("/workspaces", workspaces::workspaced_service())
-                        .nest("/oidc", oidc_ee::workspaced_service())
+                        .nest("/oidc", oidc_oss::workspaced_service())
                         .nest("/http_triggers", http_triggers_service)
                         .nest("/websocket_triggers", websocket_triggers_service)
                         .nest("/kafka_triggers", kafka_triggers_service)
@@ -579,22 +622,23 @@ pub async fn run_server(
                 .nest("/schedules", schedule::global_service())
                 .nest("/embeddings", embeddings::global_service())
                 .nest("/ai", ai::global_service())
+                .nest("/inkeep", inkeep_oss::global_service())
                 .route_layer(from_extractor::<ApiAuthed>())
                 .route_layer(from_extractor::<users::Tokened>())
                 .nest("/jobs", jobs::global_root_service())
                 .nest(
                     "/srch/w/:workspace_id/index",
-                    indexer_ee::workspaced_service(),
+                    indexer_oss::workspaced_service(),
                 )
-                .nest("/srch/index", indexer_ee::global_service())
-                .nest("/oidc", oidc_ee::global_service())
+                .nest("/srch/index", indexer_oss::global_service())
+                .nest("/oidc", oidc_oss::global_service())
                 .nest(
                     "/saml",
-                    saml_ee::global_service().layer(Extension(Arc::clone(&sp_extension))),
+                    saml_oss::global_service().layer(Extension(Arc::clone(&sp_extension))),
                 )
                 .nest(
                     "/scim",
-                    scim_ee::global_service()
+                    scim_oss::global_service()
                         .route_layer(axum::middleware::from_fn(has_scim_token)),
                 )
                 .nest("/concurrency_groups", concurrency_groups::global_service())
@@ -602,7 +646,7 @@ pub async fn run_server(
                 .nest("/apps_u", {
                     #[cfg(feature = "enterprise")]
                     {
-                        apps_ee::global_unauthed_service()
+                        apps_oss::global_unauthed_service()
                     }
 
                     #[cfg(not(feature = "enterprise"))]
@@ -621,7 +665,7 @@ pub async fn run_server(
                 .nest("/agent_workers", {
                     #[cfg(feature = "agent_worker_server")]
                     {
-                        agent_workers_ee::global_service().layer(Extension(agent_cache.clone()))
+                        agent_workers_oss::global_service().layer(Extension(agent_cache.clone()))
                     }
                     #[cfg(not(feature = "agent_worker_server"))]
                     {
@@ -646,7 +690,7 @@ pub async fn run_server(
                 .nest("/teams", {
                     #[cfg(feature = "enterprise")]
                     {
-                        teams_ee::teams_service()
+                        teams_oss::teams_service()
                     }
 
                     #[cfg(not(feature = "enterprise"))]
@@ -660,12 +704,12 @@ pub async fn run_server(
                 )
                 .route(
                     "/w/:workspace_id/jobs/teams_approval/:job_id",
-                    get(teams_approvals_ee::request_teams_approval),
+                    get(teams_approvals_oss::request_teams_approval),
                 )
                 .nest("/w/:workspace_id/github_app", {
                     #[cfg(feature = "enterprise")]
                     {
-                        git_sync_ee::workspaced_service()
+                        git_sync_oss::workspaced_service()
                     }
 
                     #[cfg(not(feature = "enterprise"))]
@@ -674,7 +718,7 @@ pub async fn run_server(
                 .nest("/github_app", {
                     #[cfg(feature = "enterprise")]
                     {
-                        git_sync_ee::global_service()
+                        git_sync_oss::global_service()
                     }
 
                     #[cfg(not(feature = "enterprise"))]
@@ -695,7 +739,7 @@ pub async fn run_server(
                 .nest("/oauth", {
                     #[cfg(feature = "oauth2")]
                     {
-                        oauth2_ee::global_service().layer(Extension(Arc::clone(&sp_extension)))
+                        oauth2_oss::global_service().layer(Extension(Arc::clone(&sp_extension)))
                     }
 
                     #[cfg(not(feature = "oauth2"))]
@@ -721,7 +765,7 @@ pub async fn run_server(
                     {
                         #[cfg(all(feature = "enterprise", feature = "gcp_trigger"))]
                         {
-                            gcp_triggers_ee::gcp_push_route_handler()
+                            gcp_triggers_oss::gcp_push_route_handler()
                         }
                         #[cfg(not(all(feature = "enterprise", feature = "gcp_trigger")))]
                         {
@@ -842,7 +886,7 @@ async fn ee_license() -> &'static str {
 
 #[cfg(feature = "enterprise")]
 async fn ee_license() -> String {
-    use windmill_common::ee::{LICENSE_KEY_ID, LICENSE_KEY_VALID};
+    use windmill_common::ee_oss::{LICENSE_KEY_ID, LICENSE_KEY_VALID};
 
     if *LICENSE_KEY_VALID.read().await {
         LICENSE_KEY_ID.read().await.clone()

backend/windmill-api/src/mqtt_triggers.rs

@@ -39,7 +39,7 @@ use sql_builder::{bind::Bind, SqlBuilder};
 use sqlx::{FromRow, Type};
 use std::collections::HashMap;
 use std::time::Duration;
-use windmill_audit::{audit_ee::audit_log, ActionKind};
+use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_common::{
     db::UserDB,
     error::{self, JsonResult},

backend/windmill-api/src/nats_triggers_oss.rs

@@ -1,22 +1,34 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::nats_triggers_ee::*;
+
+#[cfg(not(feature = "private"))]
 use crate::db::DB;
+#[cfg(not(feature = "private"))]
 use axum::Router;
+#[cfg(not(feature = "private"))]
 use serde::{Deserialize, Serialize};
 
+#[cfg(not(feature = "private"))]
 #[derive(Serialize, Deserialize)]
 pub struct NatsResourceAuth {}
 
+#[cfg(not(feature = "private"))]
 pub fn workspaced_service() -> Router {
     Router::new()
 }
 
+#[cfg(not(feature = "private"))]
 pub fn start_nats_consumers(_db: DB, mut _killpill_rx: tokio::sync::broadcast::Receiver<()>) -> () {
     // implementation is not open source
 }
 
 #[derive(Serialize, Deserialize)]
+#[cfg(not(feature = "private"))]
 pub enum NatsTriggerConfigConnection {}
 
 #[derive(Serialize, Clone)]
+#[cfg(not(feature = "private"))]
 pub struct NatsTrigger {
     pub workspace_id: String,
     pub path: String,
@@ -40,4 +52,4 @@ pub struct NatsTrigger {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub error: Option<String>,
     pub enabled: bool,
-}
+}

backend/windmill-api/src/oauth2_oss.rs

@@ -1,3 +1,7 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::oauth2_ee::*;
+
 /*
  * Author: Ruben Fiszel
  * Copyright: Windmill Labs, Inc 2022
@@ -6,39 +10,50 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
+#[cfg(not(feature = "private"))]
 use std::{collections::HashMap, fmt::Debug};
 
+#[cfg(not(feature = "private"))]
 use axum::{routing::get, Json, Router};
+#[cfg(not(feature = "private"))]
 use hmac::Mac;
 
-#[cfg(feature = "oauth2")]
+#[cfg(all(feature = "oauth2", not(feature = "private")))]
 use itertools::Itertools;
-#[cfg(feature = "oauth2")]
+#[cfg(all(feature = "oauth2", not(feature = "private")))]
 use oauth2::{Client as OClient, *};
+#[cfg(not(feature = "private"))]
 use serde::{Deserialize, Serialize};
+#[cfg(not(feature = "private"))]
 use sqlx::{Postgres, Transaction};
-#[cfg(feature = "oauth2")]
+#[cfg(all(feature = "oauth2", not(feature = "private")))]
 use windmill_common::more_serde::maybe_number_opt;
 
-#[cfg(feature = "oauth2")]
+#[cfg(all(feature = "oauth2", not(feature = "private")))]
 use crate::OAUTH_CLIENTS;
+#[cfg(not(feature = "private"))]
 use windmill_common::error;
+#[cfg(not(feature = "private"))]
 use windmill_common::oauth2::*;
 
+#[cfg(not(feature = "private"))]
 use crate::db::DB;
+#[cfg(not(feature = "private"))]
 use std::str;
 
+#[cfg(not(feature = "private"))]
 pub fn global_service() -> Router {
     Router::new()
         .route("/list_logins", get(list_logins))
         .route("/list_connects", get(list_connects))
 }
 
+#[cfg(not(feature = "private"))]
 pub fn workspaced_service() -> Router {
     Router::new()
 }
 
-#[cfg(feature = "oauth2")]
+#[cfg(all(feature = "oauth2", not(feature = "private")))]
 #[derive(Debug, Clone)]
 pub struct ClientWithScopes {
     _client: OClient,
@@ -48,9 +63,10 @@ pub struct ClientWithScopes {
     _allowed_domains: Option<Vec<String>>,
     _userinfo_url: Option<String>,
 }
-#[cfg(feature = "oauth2")]
+#[cfg(all(feature = "oauth2", not(feature = "private")))]
 pub type BasicClientsMap = HashMap<String, ClientWithScopes>;
 
+#[cfg(not(feature = "private"))]
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct OAuthConfig {
     auth_url: String,
@@ -62,6 +78,7 @@ pub struct OAuthConfig {
     req_body_auth: Option<bool>,
 }
 
+#[cfg(not(feature = "private"))]
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct OAuthClient {
     id: String,
@@ -71,7 +88,7 @@ pub struct OAuthClient {
     login_config: Option<OAuthConfig>,
 }
 
-#[cfg(feature = "oauth2")]
+#[cfg(all(feature = "oauth2", not(feature = "private")))]
 #[derive(Debug)]
 pub struct AllClients {
     pub logins: BasicClientsMap,
@@ -79,7 +96,7 @@ pub struct AllClients {
     pub slack: Option<OClient>,
 }
 
-#[cfg(feature = "oauth2")]
+#[cfg(all(feature = "oauth2", not(feature = "private")))]
 pub async fn build_oauth_clients(
     _base_url: &str,
     _oauths_from_config: Option<HashMap<String, OAuthClient>>,
@@ -93,7 +110,7 @@ pub async fn build_oauth_clients(
     });
 }
 
-#[cfg(feature = "oauth2")]
+#[cfg(all(feature = "oauth2", not(feature = "private")))]
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct TokenResponse {
     access_token: AccessToken,
@@ -107,17 +124,20 @@ pub struct TokenResponse {
     scope: Option<Vec<Scope>>,
 }
 
+#[cfg(not(feature = "private"))]
 #[derive(Serialize)]
 struct Logins {
     oauth: Vec<String>,
     saml: Option<String>,
 }
+#[cfg(not(feature = "private"))]
 async fn list_logins() -> error::JsonResult<Logins> {
     // Implementation is not open source
     return Ok(Json(Logins { oauth: vec![], saml: None }));
 }
 
-#[cfg(feature = "oauth2")]
+#[allow(unused)]
+#[cfg(all(feature = "oauth2", not(feature = "private")))]
 async fn list_connects() -> error::JsonResult<Vec<String>> {
     Ok(Json(
         (&OAUTH_CLIENTS.read().await.connects)
@@ -127,12 +147,14 @@ async fn list_connects() -> error::JsonResult<Vec<String>> {
     ))
 }
 
-#[cfg(not(feature = "oauth2"))]
-async fn list_connects() -> error::JsonResult<Vec<String>> {
+#[allow(unused)]
+#[cfg(not(all(feature = "oauth2", not(feature = "private"))))]
+async fn list_connects() -> windmill_common::error::JsonResult<Vec<String>> {
     // Implementation is not open source
-    return Ok(Json(vec![]));
+    return Ok(axum::Json(vec![]));
 }
 
+#[cfg(not(feature = "private"))]
 pub async fn _refresh_token<'c>(
     _tx: Transaction<'c, Postgres>,
     _path: &str,
@@ -146,6 +168,7 @@ pub async fn _refresh_token<'c>(
     ))
 }
 
+#[cfg(not(feature = "private"))]
 pub async fn check_nb_of_user(db: &DB) -> error::Result<()> {
     let nb_users_sso =
         sqlx::query_scalar!("SELECT COUNT(*) FROM password WHERE login_type != 'password'",)
@@ -171,10 +194,11 @@ pub async fn check_nb_of_user(db: &DB) -> error::Result<()> {
 }
 
 #[derive(Clone, Debug)]
+#[cfg(not(feature = "private"))]
 pub struct SlackVerifier {
     _mac: HmacSha256,
 }
-
+#[cfg(not(feature = "private"))]
 impl SlackVerifier {
     pub fn new<S: AsRef<[u8]>>(secret: S) -> anyhow::Result<SlackVerifier> {
         HmacSha256::new_from_slice(secret.as_ref())

backend/windmill-api/src/oidc_oss.rs

@@ -1,3 +1,7 @@
+#[cfg(feature = "private")]
+#[allow(unused)]
+pub use crate::oidc_ee::*;
+
 /*
  * Author: Ruben Fiszel
  * Copyright: Windmill Labs, Inc 2023
@@ -6,12 +10,15 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
+#[cfg(not(feature = "private"))]
 use axum::Router;
 
+#[cfg(not(feature = "private"))]
 pub fn global_service() -> Router {
     Router::new()
 }
 
+#[cfg(not(feature = "private"))]
 pub fn workspaced_service() -> Router {
     Router::new()
 }

backend/windmill-api/src/postgres_triggers/mod.rs

@@ -7,15 +7,13 @@ use crate::{
 };
 use chrono::Utc;
 use itertools::Itertools;
-use pg_escape::{quote_identifier, quote_literal};
+use native_tls::{Certificate, TlsConnector};
+use pg_escape::quote_identifier;
 use rand::Rng;
+use rust_postgres::{config::SslMode, Client, Config, NoTls};
+use rust_postgres_native_tls::MakeTlsConnector;
 use serde_json::value::RawValue;
-use sqlx::{
-    postgres::{PgConnectOptions, PgSslMode},
-    Connection, PgConnection,
-};
 use std::collections::HashMap;
-use std::str::FromStr;
 
 use axum::{
     routing::{delete, get, post},
@@ -25,12 +23,17 @@ pub use handler::PostgresTrigger;
 use handler::{
     alter_publication, create_postgres_trigger, create_publication, create_slot,
     create_template_script, delete_postgres_trigger, delete_publication, drop_slot_name,
-    exists_postgres_trigger, get_postgres_trigger, get_publication_info, get_template_script,
+    exists_postgres_trigger, get_postgres_trigger, get_postgres_version,
+    get_postgres_version_internal, get_publication_info, get_template_script,
     is_database_in_logical_level, list_database_publication, list_postgres_triggers,
     list_slot_name, set_enabled, test_postgres_connection, update_postgres_trigger, Postgres,
     Relations,
 };
-use windmill_common::{db::UserDB, error::Error, utils::StripPath};
+use windmill_common::{
+    db::UserDB,
+    error::{to_anyhow, Error, Result},
+    utils::StripPath,
+};
 mod bool;
 mod converter;
 mod handler;
@@ -47,76 +50,184 @@ const ERROR_REPLICATION_SLOT_NOT_EXISTS: &str = r#"The replication slot associat
 
 const ERROR_PUBLICATION_NAME_NOT_EXISTS: &str = r#"The publication associated with this trigger no longer exists. Recreate a new publication or select an existing one in the advanced tab, or delete and recreate a new trigger"#;
 
-pub async fn get_database_connection(
+fn build_tls_connector(
+    ssl_mode: SslMode,
+    root_certificate_pem: Option<&String>,
+) -> Result<Option<MakeTlsConnector>> {
+    let get_tls_builder_for_verify = |root_certificate: Option<&String>| {
+        let mut builder = TlsConnector::builder();
+        if let Some(root_certificate) = root_certificate {
+            let root_certificate_pem =
+                Certificate::from_pem(root_certificate.as_bytes()).map_err(to_anyhow)?;
+            builder.add_root_certificate(root_certificate_pem);
+        }
+        Ok::<_, Error>(builder)
+    };
+    let connector = match ssl_mode {
+        SslMode::Disable => return Ok(None),
+        SslMode::Require | SslMode::Prefer => {
+            let mut builder = TlsConnector::builder();
+            builder.danger_accept_invalid_certs(true);
+            builder.danger_accept_invalid_hostnames(true);
+            builder
+        }
+
+        SslMode::VerifyCa => {
+            let mut builder = get_tls_builder_for_verify(root_certificate_pem)?;
+            builder.danger_accept_invalid_hostnames(true);
+            builder
+        }
+
+        SslMode::VerifyFull => {
+            let builder = get_tls_builder_for_verify(root_certificate_pem)?;
+            builder
+        }
+        _ => unreachable!(),
+    };
+
+    Ok(Some(MakeTlsConnector::new(
+        connector.build().map_err(to_anyhow)?,
+    )))
+}
+
+pub async fn get_raw_postgres_connection(
+    database: &Postgres,
+    logical_mode: bool,
+) -> Result<Client> {
+    let ssl_mode = match database.sslmode.as_ref() {
+            "disable" => SslMode::Disable,
+            "" | "prefer" | "allow" => SslMode::Prefer,
+            "require" => SslMode::Require,
+            "verify-ca" => SslMode::VerifyCa,
+            "verify-full" => SslMode::VerifyFull,
+            ssl_mode => {
+                return Err(Error::BadRequest(
+                    format!("Invalid ssl mode for postgres: {}, please put a valid ssl_mode among the following available ssl mode: ['disable', 'allow', 'prefer', 'verify-ca', 'verify-full']", ssl_mode),
+                ))
+            }
+        };
+
+    let mut config = Config::new();
+    config
+        .dbname(&database.dbname)
+        .host(&database.host)
+        .user(&database.user)
+        .ssl_mode(ssl_mode);
+
+    if logical_mode {
+        config.replication_mode(rust_postgres::config::ReplicationMode::Logical);
+    }
+
+    if let Some(port) = database.port {
+        config.port(port);
+    };
+
+    if !database.password.is_empty() {
+        config.password(&database.password);
+    }
+
+    let connector = build_tls_connector(ssl_mode, database.root_certificate_pem.as_ref())?;
+
+    let client = if let Some(connector) = connector {
+        let (client, connection) = config.connect(connector).await.map_err(to_anyhow)?;
+        tokio::spawn(async move {
+            if let Err(e) = connection.await {
+                tracing::debug!("{:#?}", e);
+            };
+            tracing::info!("Successfully Connected into database");
+        });
+        client
+    } else {
+        let (client, connection) = config.connect(NoTls).await.map_err(to_anyhow)?;
+        tokio::spawn(async move {
+            if let Err(e) = connection.await {
+                tracing::debug!("{:#?}", e);
+            };
+            tracing::info!("Successfully Connected into database");
+        });
+        client
+    };
+
+    Ok(client)
+}
+
+pub async fn get_pg_connection(
     authed: ApiAuthed,
     user_db: Option<UserDB>,
     db: &DB,
     postgres_resource_path: &str,
     w_id: &str,
-) -> std::result::Result<PgConnection, windmill_common::error::Error> {
+    logical_mode: bool,
+) -> Result<Client> {
     let database =
         try_get_resource_from_db_as::<Postgres>(authed, user_db, db, postgres_resource_path, w_id)
             .await?;
 
-    Ok(get_raw_postgres_connection(&database).await?)
+    Ok(get_raw_postgres_connection(&database, logical_mode).await?)
 }
 
-pub async fn get_raw_postgres_connection(
-    db: &Postgres,
-) -> std::result::Result<PgConnection, Error> {
-    let options = {
-        let sslmode = if !db.sslmode.is_empty() {
-            PgSslMode::from_str(&db.sslmode)?
-        } else {
-            PgSslMode::Prefer
-        };
-        let options = {
-            let inner_options = PgConnectOptions::new()
-                .host(&db.host)
-                .database(&db.dbname)
-                .ssl_mode(sslmode)
-                .username(&db.user);
+pub async fn get_default_pg_connection(
+    authed: ApiAuthed,
+    user_db: Option<UserDB>,
+    db: &DB,
+    postgres_resource_path: &str,
+    w_id: &str,
+) -> Result<Client> {
+    get_pg_connection(authed, user_db, db, postgres_resource_path, w_id, false).await
+}
 
-            if let Some(port) = db.port {
-                inner_options.port(port)
-            } else {
-                inner_options
-            }
-        };
+pub async fn create_logical_replication_slot(tx: &Client, slot_name: &str) -> Result<()> {
+    tx.execute(
+        &format!("SELECT * FROM pg_create_logical_replication_slot($1, 'pgoutput')"),
+        &[&slot_name],
+    )
+    .await
+    .map_err(to_anyhow)?;
+    Ok(())
+}
 
-        let options = if let Some(root_certificate_pem) = &db.root_certificate_pem {
-            options.ssl_root_cert_from_pem(root_certificate_pem.as_bytes().to_vec())
-        } else {
-            options
-        };
+async fn check_if_valid_publication_for_postgres_version(
+    pg_connection: &Client,
+    table_to_track: Option<&[Relations]>,
+) -> Result<bool> {
+    let postgres_version = get_postgres_version_internal(pg_connection).await?;
 
-        if !db.password.is_empty() {
-            options.password(&db.password)
-        } else {
-            options
+    let pg_14 = postgres_version.starts_with("14");
+    if pg_14 {
+        let unsupported_publication = table_to_track
+            .and_then(|relations| {
+                relations.iter().find(|relation| {
+                    let invalid_relation = relation.table_to_track.iter().find(|table_to_track| {
+                        table_to_track.where_clause.is_some()
+                            || table_to_track.columns_name.is_some()
+                    });
+
+                    relation.table_to_track.is_empty() || invalid_relation.is_some()
+                })
+            })
+            .is_some();
+
+        if unsupported_publication {
+            return Err(Error::BadRequest(
+                    "Your PostgreSQL database is running version 14, which does not support the following publication features: \
+                    - WHERE clause filtering, \
+                    - selective column tracking, and \
+                    - tracking all tables within a schema.\n\
+                    These features are only available in PostgreSQL 15 and above.".to_string(),
+                ));
         }
-    };
-    Ok(PgConnection::connect_with(&options).await?)
+    }
+    Ok(pg_14)
 }
 
-pub fn create_logical_replication_slot_query(name: &str) -> String {
-    let query = format!(
-        r#"
-        SELECT 
-                *
-        FROM
-            pg_create_logical_replication_slot({}, 'pgoutput');"#,
-        quote_literal(&name)
-    );
-
-    query
-}
-
-pub fn create_publication_query(
+pub async fn create_pg_publication(
+    pg_connection: &Client,
     publication_name: &str,
     table_to_track: Option<&[Relations]>,
-    transaction_to_track: &[&str],
-) -> String {
+    transaction_to_track: &[String],
+) -> Result<()> {
+    let pg_14 =
+        check_if_valid_publication_for_postgres_version(pg_connection, table_to_track).await?;
     let mut query = String::from("CREATE PUBLICATION ");
 
     query.push_str(&quote_identifier(publication_name));
@@ -124,21 +235,26 @@ pub fn create_publication_query(
     match table_to_track {
         Some(database_component) if !database_component.is_empty() => {
             query.push_str(" FOR");
+            let mut first = true;
             for (i, schema) in database_component.iter().enumerate() {
                 if schema.table_to_track.is_empty() {
                     query.push_str(" TABLES IN SCHEMA ");
                     query.push_str(&quote_identifier(&schema.schema_name));
                 } else {
-                    query.push_str(" TABLE ONLY ");
+                    if pg_14 && first {
+                        query.push_str(" TABLE ONLY ");
+                        first = false
+                    } else if !pg_14 {
+                        query.push_str(" TABLE ONLY ");
+                    }
                     for (j, table) in schema.table_to_track.iter().enumerate() {
                         let table_name = quote_identifier(&table.table_name);
                         let schema_name = quote_identifier(&schema.schema_name);
                         let full_name = format!("{}.{}", &schema_name, &table_name);
                         query.push_str(&full_name);
-                        if !table.columns_name.is_empty() {
+                        if let Some(columns) = table.columns_name.as_ref() {
                             query.push_str(" (");
-                            let columns = table
-                                .columns_name
+                            let columns = columns
                                 .iter()
                                 .map(|column| quote_identifier(column))
                                 .join(", ");
@@ -174,22 +290,24 @@ pub fn create_publication_query(
         query.push_str("');");
     }
 
-    query
+    pg_connection
+        .execute(&query, &[])
+        .await
+        .map_err(to_anyhow)?;
+    Ok(())
 }
 
-pub fn drop_publication_query(publication_name: &str) -> String {
+pub async fn drop_publication(pg_connection: &Client, publication_name: &str) -> Result<()> {
     let mut query = String::from("DROP PUBLICATION IF EXISTS ");
     let quoted_publication_name = quote_identifier(publication_name);
     query.push_str(&quoted_publication_name);
-    query.push_str(";");
-    query
-}
 
-pub fn drop_logical_replication_slot_query(replication_slot_name: &str) -> String {
-    format!(
-        "SELECT pg_drop_replication_slot({});",
-        quote_literal(&replication_slot_name)
-    )
+    pg_connection
+        .execute(&query, &[])
+        .await
+        .map_err(to_anyhow)?;
+
+    Ok(())
 }
 
 pub fn generate_random_string() -> String {
@@ -228,6 +346,10 @@ fn slot_service() -> Router {
         .route("/delete/*path", delete(drop_slot_name))
 }
 
+fn postgres_service() -> Router {
+    Router::new().route("/version/*path", get(get_postgres_version))
+}
+
 pub fn workspaced_service() -> Router {
     Router::new()
         .route("/test", post(test_postgres_connection))
@@ -246,6 +368,7 @@ pub fn workspaced_service() -> Router {
         )
         .nest("/publication", publication_service())
         .nest("/slot", slot_service())
+        .nest("/postgres", postgres_service())
 }
 
 async fn run_job(

backend/windmill-api/src/postgres_triggers/trigger.rs

@@ -19,25 +19,27 @@ use crate::{
 use bytes::{BufMut, Bytes, BytesMut};
 use chrono::TimeZone;
 use futures::{pin_mut, SinkExt, StreamExt};
-use native_tls::{Certificate, TlsConnector};
 use pg_escape::{quote_identifier, quote_literal};
 use rand::seq::SliceRandom;
-use rust_postgres::{config::SslMode, Client, Config, CopyBothDuplex, NoTls, SimpleQueryMessage};
-use rust_postgres_native_tls::MakeTlsConnector;
+use rust_postgres::{Client, CopyBothDuplex, SimpleQueryMessage};
 use serde::Deserialize;
 use serde_json::value::RawValue;
 use sqlx::types::Json as SqlxJson;
 
 use windmill_common::{
-    db::UserDB, error, triggers::TriggerKind, utils::report_critical_error, worker::to_raw_value,
+    db::UserDB,
+    error::{self, to_anyhow},
+    triggers::TriggerKind,
+    utils::report_critical_error,
+    worker::to_raw_value,
     INSTANCE_NAME,
 };
 
 use super::{
-    drop_logical_replication_slot_query, drop_publication_query, get_database_connection,
-    handler::{Postgres, PostgresTrigger},
+    drop_publication, get_default_pg_connection, get_raw_postgres_connection,
+    handler::{drop_logical_replication_slot, Postgres, PostgresTrigger},
     replication_message::PrimaryKeepAliveBody,
-    ERROR_PUBLICATION_NAME_NOT_EXISTS, ERROR_REPLICATION_SLOT_NOT_EXISTS,
+    Error, ERROR_PUBLICATION_NAME_NOT_EXISTS, ERROR_REPLICATION_SLOT_NOT_EXISTS,
 };
 
 pub struct LogicalReplicationSettings {
@@ -69,109 +71,11 @@ impl RowExist for Vec<SimpleQueryMessage> {
     }
 }
 
-#[derive(thiserror::Error, Debug)]
-enum Error {
-    #[error("Error from database: {0}")]
-    Postgres(#[from] rust_postgres::Error),
-    #[error("Error : {0}")]
-    Common(#[from] windmill_common::error::Error),
-    #[error("Tls Error: {0}")]
-    Tls(#[from] native_tls::Error),
-}
-
-fn build_tls_connector(
-    ssl_mode: SslMode,
-    root_certificate_pem: Option<&String>,
-) -> Result<Option<MakeTlsConnector>, Error> {
-    let get_tls_builder_for_verify = |root_certificate: Option<&String>| {
-        let mut builder = TlsConnector::builder();
-        if let Some(root_certificate) = root_certificate {
-            let root_certificate_pem = Certificate::from_pem(root_certificate.as_bytes()).map_err(|e| {
-                Error::Common(error::Error::BadConfig(format!("Invalid Certs: {e:#}")))
-            })?;
-            builder.add_root_certificate(root_certificate_pem);
-        }
-        Ok::<_, Error>(builder)
-    };
-    let connector = match ssl_mode {
-        SslMode::Disable => return Ok(None),
-        SslMode::Require | SslMode::Prefer => {
-            let mut builder = TlsConnector::builder();
-            builder.danger_accept_invalid_certs(true);
-            builder.danger_accept_invalid_hostnames(true);
-            builder
-        }
-
-        SslMode::VerifyCa => {
-            let mut builder = get_tls_builder_for_verify(root_certificate_pem)?;
-            builder.danger_accept_invalid_hostnames(true);
-            builder
-        }
-
-        SslMode::VerifyFull => {
-            let builder = get_tls_builder_for_verify(root_certificate_pem)?;
-            builder
-        }
-        _ => unreachable!(),
-    };
-
-    Ok(Some(MakeTlsConnector::new(connector.build()?)))
-}
-
 pub struct PostgresSimpleClient(Client);
 
 impl PostgresSimpleClient {
     async fn new(database: &Postgres) -> Result<Self, Error> {
-        let ssl_mode = match database.sslmode.as_ref() {
-            "disable" => SslMode::Disable,
-            "" | "prefer" | "allow" => SslMode::Prefer,
-            "require" => SslMode::Require,
-            "verify-ca" => SslMode::VerifyCa,
-            "verify-full" => SslMode::VerifyFull,
-            ssl_mode => {
-                return Err(Error::Common(windmill_common::error::Error::BadRequest(
-                    format!("Invalid ssl mode for postgres: {}, please put a valid ssl_mode among the following avalible ssl mode: ['disable', 'allow', 'prefer', 'verify-ca', 'verify-full']", ssl_mode),
-                )))
-            }
-        };
-
-        let mut config = Config::new();
-        config
-            .dbname(&database.dbname)
-            .host(&database.host)
-            .user(&database.user)
-            .ssl_mode(ssl_mode)
-            .replication_mode(rust_postgres::config::ReplicationMode::Logical);
-
-        if let Some(port) = database.port {
-            config.port(port);
-        };
-
-        if !database.password.is_empty() {
-            config.password(&database.password);
-        }
-
-        let connector = build_tls_connector(ssl_mode, database.root_certificate_pem.as_ref())?;
-
-        let client = if let Some(connector) = connector {
-            let (client, connection) = config.connect(connector).await?;
-            tokio::spawn(async move {
-                if let Err(e) = connection.await {
-                    tracing::debug!("{:#?}", e);
-                };
-                tracing::info!("Successfully Connected into database");
-            });
-            client
-        } else {
-            let (client, connection) = config.connect(NoTls).await?;
-            tokio::spawn(async move {
-                if let Err(e) = connection.await {
-                    tracing::debug!("{:#?}", e);
-                };
-                tracing::info!("Successfully Connected into database");
-            });
-            client
-        };
+        let client = get_raw_postgres_connection(database, true).await?;
 
         Ok(PostgresSimpleClient(client))
     }
@@ -202,7 +106,8 @@ impl PostgresSimpleClient {
         Ok((
             self.0
                 .copy_both_simple::<bytes::Bytes>(query.as_str())
-                .await?,
+                .await
+                .map_err(to_anyhow)?,
             LogicalReplicationSettings::new(false),
         ))
     }
@@ -527,12 +432,13 @@ impl PostgresConfig {
                 "SELECT pubname FROM pg_publication WHERE pubname = {}",
                 quote_literal(&publication_name)
             ))
-            .await?;
+            .await
+            .map_err(to_anyhow)?;
 
         if !publication.row_exist() {
-            return Err(Error::Common(error::Error::BadConfig(
+            return Err(Error::BadConfig(
                 ERROR_PUBLICATION_NAME_NOT_EXISTS.to_string(),
-            )));
+            ));
         }
 
         let replication_slot = client
@@ -540,17 +446,19 @@ impl PostgresConfig {
                 "SELECT slot_name FROM pg_replication_slots WHERE slot_name = {}",
                 quote_literal(&replication_slot_name)
             ))
-            .await?;
+            .await
+            .map_err(to_anyhow)?;
 
         if !replication_slot.row_exist() {
-            return Err(Error::Common(error::Error::BadConfig(
+            return Err(Error::BadConfig(
                 ERROR_REPLICATION_SLOT_NOT_EXISTS.to_string(),
-            )));
+            ));
         }
 
         let (logical_replication_stream, logical_replication_settings) = client
             .get_logical_replication_stream(&publication_name, &replication_slot_name)
-            .await?;
+            .await
+            .map_err(to_anyhow)?;
 
         Ok((logical_replication_stream, logical_replication_settings))
     }
@@ -585,7 +493,7 @@ impl PostgresConfig {
 
                 let user_db = UserDB::new(db.clone());
 
-                let mut connection = get_database_connection(
+                let mut pg_connection = get_default_pg_connection(
                     authed.clone(),
                     Some(user_db.clone()),
                     &db,
@@ -594,13 +502,12 @@ impl PostgresConfig {
                 )
                 .await?;
 
-                let query = drop_logical_replication_slot_query(replication_slot_name);
+                if capture.trigger_config.basic_mode.unwrap_or(false) {
+                    drop_logical_replication_slot(&mut pg_connection, replication_slot_name)
+                        .await?;
 
-                let _ = sqlx::query(&query).execute(&mut connection).await;
-
-                let query = drop_publication_query(publication_name);
-
-                let _ = sqlx::query(&query).execute(&mut connection).await;
+                    drop_publication(&mut pg_connection, publication_name).await?;
+                }
 
                 Ok(())
             }

backend/windmill-api/src/raw_apps.rs

@@ -22,7 +22,7 @@ use serde::{Deserialize, Serialize};
 use sql_builder::{bind::Bind, SqlBuilder};
 use sqlx::FromRow;
 use std::str;
-use windmill_audit::audit_ee::audit_log;
+use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::{
     apps::ListAppQuery,

backend/windmill-api/src/resources.rs

@@ -26,7 +26,7 @@ use serde_json::{value::RawValue, Value};
 use sql_builder::{bind::Bind, quote, SqlBuilder};
 use sqlx::{FromRow, Postgres, Transaction};
 use uuid::Uuid;
-use windmill_audit::audit_ee::{audit_log, AuditAuthor};
+use windmill_audit::audit_oss::{audit_log, AuditAuthor};
 use windmill_audit::ActionKind;
 use windmill_common::{
     db::UserDB,