activejob-temporal 0.1.0 → 0.3.0

data/lib/activejob/temporal/cancel.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "temporalio/error"
+require_relative "job_id_validation"
 require_relative "visibility_query"
 require_relative "workflow_id_builder"
 
@@ -27,6 +29,48 @@ module ActiveJob
     # @see https://docs.temporal.io/activities#heartbeat Temporal Activity Heartbeating
     # @see https://docs.temporal.io/workflows#cancellation Temporal Cancellation Guide
     module Cancel
+      class CancellationRequest
+        def initialize(client:, job_id:, workflow_id:, run_id: nil)
+          @client = client
+          @job_id = job_id
+          @workflow_id = workflow_id
+          @run_id = run_id
+        end
+
+        def call
+          cancellation_handle.cancel
+        rescue StandardError => e
+          raise workflow_not_found_error, cause: e if rpc_not_found?(e)
+
+          raise ActiveJob::Temporal::TemporalConnectionError.new(
+            "Failed to cancel Temporal workflow for job_id #{@job_id}: #{e.message}"
+          ), cause: e
+        end
+
+        private
+
+        attr_reader :client, :workflow_id, :run_id
+
+        def cancellation_handle
+          return client.workflow_handle(workflow_id) unless run_id
+
+          client.workflow_handle(workflow_id, run_id: run_id)
+        end
+
+        def workflow_not_found_error
+          ActiveJob::Temporal::WorkflowNotFoundError.new(
+            "No workflow found for job_id #{@job_id}. The job may have completed or never existed."
+          )
+        end
+
+        def rpc_not_found?(error)
+          defined?(Temporalio::Error::RPCError) &&
+            error.is_a?(Temporalio::Error::RPCError) &&
+            error.code == Temporalio::Error::RPCError::Code::NOT_FOUND
+        end
+      end
+      private_constant :CancellationRequest
+
       class << self
         # Cancels a running Temporal workflow by sending a cancellation request.
         #
@@ -38,7 +82,7 @@ module ActiveJob
         # @return [Boolean, nil] Returns false if workflow already completed, nil if cancellation requested
         #
         # @raise [WorkflowNotFoundError] if no workflow exists for the given job_id
-        # @raise [TemporalConnectionError] if the Temporal cluster cannot be reached
+        # @raise [TemporalConnectionError] if Temporal lookup or cancellation RPCs fail
         #
         # @note Asynchronous Cancellation
         #   Cancellation requests are asynchronous. The method returns immediately after
@@ -67,6 +111,8 @@ module ActiveJob
         def cancel(job_class, job_id)
           validate_job_id!(job_id)
           client = ActiveJob::Temporal.client
+          return nil if cancel_schedule_execution(client, job_class, job_id)
+
           workflow_state = find_workflow(client, job_class, job_id)
           workflow_id = workflow_state[:workflow_id]
 
@@ -78,7 +124,7 @@ module ActiveJob
             raise ActiveJob::Temporal::WorkflowNotFoundError,
                   "No workflow found for job_id #{job_id}. The job may have never existed."
           when :running
-            client.workflow_handle(workflow_id).cancel
+            request_cancellation(client, job_id, workflow_id)
             log_cancellation_requested(job_class, job_id, workflow_id)
             log_audit_cancellation_requested(job_class, job_id, workflow_id)
             nil
@@ -95,11 +141,6 @@ module ActiveJob
           BatchCanceller.new(ActiveJob::Temporal.client).cancel_where(filters)
         end
 
-        # UUID format regex (compliant with RFC 4122).
-        # Matches standard UUID format: 8-4-4-4-12 hexadecimal characters.
-        # @api private
-        UUID_REGEX = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/i
-
         private
 
         def validate_job_class!(job_class)
@@ -108,22 +149,28 @@ module ActiveJob
           raise ArgumentError, "job_class must be a named class"
         end
 
-        # Validates that job_id is a valid UUID format.
-        #
-        # ActiveJob generates job IDs using SecureRandom.uuid, which produces RFC 4122
-        # compliant UUIDs. This validation prevents search query injection attacks by
-        # ensuring job_id contains only hexadecimal characters and hyphens, making it
-        # safe for direct use in Temporal queries.
-        #
         # @param job_id [String] The job identifier to validate
-        # @raise [ArgumentError] if job_id is not a valid UUID format
+        # @raise [ArgumentError] if job_id is not a safe string identifier
         # @api private
         def validate_job_id!(job_id)
-          return if job_id.is_a?(String) && job_id.match?(UUID_REGEX)
+          JobIdValidation.validate!(job_id)
+        end
 
-          raise ArgumentError,
-                "Invalid job_id format: expected UUID (e.g., '550e8400-e29b-41d4-a716-446655440000'), " \
-                "got: #{job_id.inspect}"
+        def cancel_schedule_execution(client, job_class, job_id)
+          schedule_reference = JobIdValidation.schedule_execution_reference(job_id)
+          return false unless schedule_reference
+
+          workflow_id = schedule_reference.fetch(:workflow_id)
+          request_cancellation(client, job_id, workflow_id, run_id: schedule_reference.fetch(:run_id))
+          log_cancellation_requested(job_class, job_id, workflow_id)
+          log_audit_cancellation_requested(job_class, job_id, workflow_id)
+          true
+        rescue ActiveJob::Temporal::WorkflowNotFoundError
+          false
+        end
+
+        def request_cancellation(client, job_id, workflow_id, run_id: nil)
+          CancellationRequest.new(client: client, job_id: job_id, workflow_id: workflow_id, run_id: run_id).call
         end
 
         # Builds deterministic workflow ID from job class and job ID.
@@ -167,21 +214,11 @@ module ActiveJob
           { status: status, workflow_id: workflow_id }
         end
 
-        # Builds Temporal query for running workflows by job class and job_id.
-        #
-        # Note: job_id is validated as a UUID before reaching this method, ensuring it
-        # contains only safe characters ([0-9a-fA-F-]) for direct query interpolation.
-        #
         # @api private
         def running_workflows_query(job_class, job_id)
           workflow_search_query(job_class, job_id, "ExecutionStatus='Running'")
         end
 
-        # Builds Temporal query for closed workflows by job class and job_id.
-        #
-        # Note: job_id is validated as a UUID before reaching this method, ensuring it
-        # contains only safe characters ([0-9a-fA-F-]) for direct query interpolation.
-        #
         # @api private
         def closed_workflows_query(job_class, job_id)
           workflow_search_query(

data/lib/activejob/temporal/certificate_watcher.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "listen"
-
 module ActiveJob
   module Temporal
     # Watches TLS certificate files and runs a reload callback when they change.
@@ -16,7 +14,7 @@ module ActiveJob
         ].compact.reject { |path| path.to_s.strip.empty? }
       end
 
-      def initialize(paths:, reload_callback:, listener_factory: Listen, debounce_seconds: DEFAULT_DEBOUNCE_SECONDS)
+      def initialize(paths:, reload_callback:, listener_factory: nil, debounce_seconds: DEFAULT_DEBOUNCE_SECONDS)
         @paths = paths.map { |path| File.expand_path(path) }.uniq
         @reload_callback = reload_callback
         @listener_factory = listener_factory
@@ -24,12 +22,13 @@ module ActiveJob
         @mutex = Mutex.new
         @last_reload_at = nil
         @listener = nil
+        @trailing_reload = nil
       end
 
       def start
         return self if @paths.empty? || @listener
 
-        @listener = @listener_factory.to(*directories) do |modified, added, removed|
+        @listener = listener_factory.to(*directories) do |modified, added, removed|
           handle_changes(modified + added + removed)
         end
         @listener.start
@@ -39,21 +38,57 @@ module ActiveJob
       def stop
         @listener&.stop
         @listener = nil
+        @mutex.synchronize { @trailing_reload }&.kill
       end
 
       def handle_changes(changed_paths)
         return unless relevant_change?(changed_paths)
-        return if debounced?
 
-        @reload_callback.call
+        if debounced?
+          schedule_trailing_reload
+        else
+          reload(retry_on_failure: true)
+        end
       end
 
       private
 
+      # A failed reload clears the debounce stamp so the next change reloads
+      # immediately, and gets one retry in case no further change arrives.
+      def reload(retry_on_failure:)
+        @reload_callback.call
+      rescue StandardError
+        @mutex.synchronize { @last_reload_at = nil }
+        schedule_trailing_reload if retry_on_failure
+      end
+
+      # Cert and key rotate as separate writes, so the second one lands inside
+      # the debounce window. Flush it once the window closes instead of dropping it.
+      def schedule_trailing_reload
+        @mutex.synchronize do
+          return if @trailing_reload&.alive?
+
+          @trailing_reload = Thread.new do
+            sleep(@debounce_seconds)
+            @mutex.synchronize { @last_reload_at = Process.clock_gettime(Process::CLOCK_MONOTONIC) }
+            reload(retry_on_failure: false)
+          end
+        end
+      end
+
       def directories
         @directories ||= @paths.map { |path| File.dirname(path) }.uniq
       end
 
+      def listener_factory
+        @listener_factory ||= begin
+          require "listen"
+          Listen
+        rescue LoadError => e
+          raise LoadError, "listen gem is required when tls_cert_watch is enabled: #{e.message}"
+        end
+      end
+
       def relevant_change?(changed_paths)
         changed_paths.any? do |path|
           @paths.include?(File.expand_path(path))

data/lib/activejob/temporal/client.rb

@@ -71,7 +71,8 @@ module ActiveJob
       #
       # @return [Temporalio::Client] Connected Temporal client
       #
-      # @raise [ActiveJob::Temporal::Error] if connection fails (includes target, namespace, and error message)
+      # @raise [ActiveJob::Temporal::TemporalConnectionError] if connection fails
+      #   (includes target, namespace, and error message)
       # @raise [OpenSSL::SSL::SSLError] if TLS certificate validation fails
       # @raise [OpenSSL::PKey::RSAError] if TLS private key is invalid
       # @raise [OpenSSL::X509::CertificateError] if TLS certificate is malformed
@@ -95,7 +96,7 @@ module ActiveJob
       # @example Handling connection failures
       #   begin
       #     client = Client.build(config)
-      #   rescue ActiveJob::Temporal::Error => e
+      #   rescue ActiveJob::Temporal::TemporalConnectionError => e
       #     Rails.logger.fatal("Cannot connect to Temporal: #{e.message}")
       #     # Fall back to different adapter or alert operations team
       #   end
@@ -106,7 +107,7 @@ module ActiveJob
           **connection_kwargs(configuration)
         )
       rescue StandardError => e
-        raise ActiveJob::Temporal::Error,
+        raise ActiveJob::Temporal::TemporalConnectionError,
               format(
                 "Unable to connect to Temporal at %<target>s (namespace: %<namespace>s): %<error>s",
                 target: configuration.target,
@@ -115,16 +116,33 @@ module ActiveJob
               )
       end
 
-      # Builds connection keyword arguments (including TLS options).
+      # Builds connection keyword arguments (TLS options and API key).
       # @api private
       def connection_kwargs(configuration)
+        kwargs = {}
+
         tls = tls_options(configuration)
-        return {} if tls.nil?
+        kwargs[:tls] = tls unless tls.nil?
+
+        api_key = resolve_api_key(configuration)
+        kwargs[:api_key] = api_key if api_key
 
-        { tls: tls }
+        kwargs
       end
       private_class_method :connection_kwargs
 
+      # Resolves the API key: an explicit api_key wins, otherwise api_key_file is read - at
+      # connection build time, and again by {ActiveJob::Temporal.refresh_api_key!} when the
+      # token file rotates.
+      # @api private
+      def resolve_api_key(configuration)
+        inline = configuration.api_key if configuration.respond_to?(:api_key)
+        return inline unless inline.nil? || inline.to_s.strip.empty?
+
+        path = configuration.api_key_file if configuration.respond_to?(:api_key_file)
+        read_tls_file(path)&.strip.presence
+      end
+
       # Extracts TLS options from config or environment variables.
       # @api private
       def tls_options(configuration)

data/lib/activejob/temporal/conditional_enqueue.rb

@@ -2,6 +2,7 @@
 
 require "active_job"
 require "active_support/concern"
+require_relative "configured_job_compatibility"
 
 module ActiveJob
   module Temporal
@@ -39,7 +40,7 @@ module ActiveJob
     # Adds conditional enqueue helpers to ActiveJob configured jobs.
     module ConfiguredConditionalEnqueue
       def perform_later_if(condition, *arguments, **keyword_arguments, &)
-        job_class = instance_variable_get(:@job_class)
+        job_class = ConfiguredJobCompatibility.job_class(self, feature: "conditional_enqueue")
         condition_arguments = ConditionalEnqueue.job_arguments(arguments, keyword_arguments)
         return nil unless ConditionalEnqueue.condition_allows_enqueue?(job_class, condition, condition_arguments)
 

data/lib/activejob/temporal/configurable.rb

@@ -19,28 +19,23 @@ module ActiveJob
       end
       alias configuration config
 
-      # Configures the gem with a block and validates after mutation.
+      # Configures the gem with a block and validates before publishing changes.
       #
       # @yield [config] Gives the configuration object to the block
       # @yieldparam config [Configuration] the configuration to modify
       # @return [Configuration] the configuration object
       # @raise [ConfigurationError] if validation fails after configuration
-      def configure
-        return config unless block_given?
+      def configure(&block)
+        return config unless block
 
         @config_mvar ||= Concurrent::MVar.new(Configuration.new)
-        @config_mvar.borrow do |configuration|
-          configuration.in_configure_block = true
+        applied_configuration = nil
 
-          begin
-            yield(configuration)
-          ensure
-            configuration.in_configure_block = false
-          end
-
-          configuration.validate!
-          configuration
+        @config_mvar.modify do |current_configuration|
+          applied_configuration = build_configuration_candidate(current_configuration, &block)
         end
+
+        applied_configuration
       end
 
       # Validates the current configuration.
@@ -50,6 +45,54 @@ module ActiveJob
       def validate!
         config.validate!
       end
+
+      private
+
+      def build_configuration_candidate(current_configuration)
+        candidate_configuration = current_configuration.dup
+        begin
+          candidate_configuration.in_configure_block = true
+          yield(candidate_configuration)
+        ensure
+          candidate_configuration.in_configure_block = false
+        end
+
+        candidate_configuration.validate!
+        deactivate_replaced_observability_adapters(current_configuration, candidate_configuration)
+        publish_configuration_candidate(current_configuration, candidate_configuration)
+      rescue StandardError
+        discard_configuration_candidate(current_configuration, candidate_configuration)
+        raise
+      end
+
+      def publish_configuration_candidate(current_configuration, candidate_configuration)
+        current_configuration.instance_variable_set(
+          :@attributes,
+          candidate_configuration.instance_variable_get(:@attributes)
+        )
+        current_configuration.in_configure_block = false
+        current_configuration.finalize_configuration_copy!
+      end
+
+      def deactivate_replaced_observability_adapters(previous_configuration, current_configuration)
+        previous_adapters = previous_configuration.observability.adapters
+        current_adapters = current_configuration.observability.adapters
+
+        previous_adapters.each do |adapter|
+          adapter.stop! unless current_adapters.include?(adapter)
+        end
+      end
+
+      def discard_configuration_candidate(previous_configuration, candidate_configuration)
+        previous_adapters = previous_configuration.observability.adapters
+        candidate_adapters = candidate_configuration.observability.adapters
+
+        candidate_adapters.each do |adapter|
+          adapter.stop! unless previous_adapters.include?(adapter)
+        end
+      rescue StandardError
+        nil
+      end
     end
   end
 end