windmill icon indicating copy to clipboard operation
windmill copied to clipboard

feature: Provide a method to accept user-input for scripts and flows that can be masked in the job run history

Open jstaffin-presidio opened this issue 1 year ago • 1 comments

We would like a way to mask script or flow input in some way in the UI.

Example use-case: user runs a script that includes an input arg for a sensitive value such as a password or SNMP community string. when viewing the job run sensitive, the input arg is masked from view.

A suggested way to handle this could be for the UI to create a linked secret variable, scoped to the user or schedule running the script or flow, that could accept the input and automatically store it in the secret variable, then provide the reference to the variable when queueing the job

jstaffin-presidio avatar Feb 02 '24 18:02 jstaffin-presidio

@fatonramadani this can be complementary to the new password field option.

When the schema form is used in the context of the new run page and a field is secret, when you press run, the password would be assigned to the secret u/<user>/run_secret_<script_path>_<timestamp> and in the variable/secret page, we would have a dedicated tab for those (if any) and have a button to clear them all.

rubenfiszel avatar Feb 12 '24 10:02 rubenfiszel

Done, every string input marked as a password input now behaves as explained above: image meaning only the caller can see it

rubenfiszel avatar Apr 24 '24 21:04 rubenfiszel

Would this be a good way to handle PII (in the GDPR sense) data? This would be data that I may want to see during the run, but not log it.

gabriel-r avatar Apr 30 '24 11:04 gabriel-r