@dudousxd/nestjs-durable-core 0.82.0 → 0.84.0

package/dist/index.cjs

@@ -72,6 +72,7 @@ __export(index_exports, {
   ScheduleAlreadyExistsError: () => ScheduleAlreadyExistsError,
   ScheduleClient: () => ScheduleClient,
   ScheduleNotFoundError: () => ScheduleNotFoundError,
+  SchemaValidationError: () => SchemaValidationError,
   SignalTimeoutError: () => SignalTimeoutError,
   SingletonQueueFullError: () => SingletonQueueFullError,
   TERMINAL_RUN_STATUSES: () => TERMINAL_RUN_STATUSES,
@@ -134,6 +135,7 @@ __export(index_exports, {
   handoffName: () => handoffName,
   hasDurableExecutionWrappers: () => hasDurableExecutionWrappers,
   heartbeatStatus: () => heartbeatStatus,
+  hmacTenantVerifier: () => hmacTenantVerifier,
   indexWaitersByRun: () => indexWaitersByRun,
   info: () => info,
   isEngineMintedTag: () => isEngineMintedTag,
@@ -171,6 +173,8 @@ __export(index_exports, {
   resolveConcurrency: () => resolveConcurrency,
   resolveRouting: () => resolveRouting,
   resolveRunWaiting: () => resolveRunWaiting,
+  resolveTenantToken: () => resolveTenantToken,
+  resolveWireTenant: () => resolveWireTenant,
   retiredHandoffName: () => retiredHandoffName,
   routeFor: () => routeFor,
   runDetailEtag: () => runDetailEtag,
@@ -183,7 +187,9 @@ __export(index_exports, {
   runStepHandler: () => runStepHandler,
   runValueFacetsFromRuns: () => runValueFacetsFromRuns,
   sanitizeQueueToken: () => sanitizeQueueToken,
+  scheduleRunIdAt: () => scheduleRunIdAt,
   scheduledRunId: () => scheduledRunId,
+  signTenantToken: () => signTenantToken,
   singletonAdmissionDenialPatch: () => singletonAdmissionDenialPatch,
   singletonAdmissionTags: () => singletonAdmissionTags,
   sqlComparator: () => sqlComparator,
@@ -481,6 +487,31 @@ var FatalError = class extends Error {
     this.details = details;
   }
 };
+var SchemaValidationError = class extends FatalError {
+  static {
+    __name(this, "SchemaValidationError");
+  }
+  static code = "schema_validation";
+  issues;
+  /**
+  * @param label What was validated, e.g. `workflow "checkout" input`; the message is
+  *   `invalid <label>: <path>: <message>; …`.
+  * @param summary Overrides the `<path>: <message>; …` part, for issues whose messages already
+  *   name their field (class-validator's `orderId must be a string`).
+  */
+  constructor(label, issues, code = "schema_validation", summary) {
+    const normalized = issues.map((issue) => ({
+      message: issue.message,
+      path: (issue.path ?? []).map((segment) => String(typeof segment === "object" && segment !== null ? segment.key : segment))
+    }));
+    const text = summary ?? normalized.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+    super(`invalid ${label}: ${text}`, code, {
+      issues: normalized
+    });
+    this.name = "SchemaValidationError";
+    this.issues = normalized;
+  }
+};
 var ConcurrencyLimitError = class extends Error {
   static {
     __name(this, "ConcurrencyLimitError");
@@ -2212,9 +2243,14 @@ function liveHandoff(runId, checkpoints) {
   return live;
 }
 __name(liveHandoff, "liveHandoff");
+var SCHEMA_VALIDATION_CODES = /* @__PURE__ */ new Set([
+  "invalid_input",
+  "invalid_output"
+]);
 function routeFor(routes, error2) {
   if (!routes?.length || error2.code && UNROUTABLE_CODES.has(error2.code)) return void 0;
-  return (error2.code ? routes.find((r) => r.code === error2.code) : void 0) ?? routes.find((r) => r.code === void 0);
+  const { code } = error2;
+  return (code ? routes.find((r) => r.code === code) : void 0) ?? (code && SCHEMA_VALIDATION_CODES.has(code) ? routes.find((r) => r.code === "schema_validation") : void 0) ?? routes.find((r) => r.code === void 0);
 }
 __name(routeFor, "routeFor");
 function assertRoutes(workflow, routes) {
@@ -2486,9 +2522,13 @@ __name(scheduleRunIdsAt, "scheduleRunIdsAt");
 async function runSchedules(engine, schedules, nowMs, opts) {
   const random = opts?.random ?? Math.random;
   const sleep = opts?.sleep ?? defaultSleep;
+  const settled = settledIdsFor(engine);
   const ids = [];
   for (const s of schedules) {
+    if (engine.isDraining?.()) break;
     if (s.paused) continue;
+    const candidates = scheduleRunIdsAt(s, nowMs).filter((id) => !settled.get(s.key)?.has(id));
+    if (candidates.length === 0) continue;
     if (s.overlap === "skip" && s.everyMs) {
       const prevBucket = Math.floor(nowMs / s.everyMs) - 1;
       if (prevBucket >= 0) {
@@ -2497,14 +2537,44 @@ async function runSchedules(engine, schedules, nowMs, opts) {
       }
     }
     if (s.jitter && s.jitter > 0) await sleep(Math.floor(random() * s.jitter));
-    for (const runId of scheduleRunIdsAt(s, nowMs)) {
-      await engine.start(s.workflow, s.input, runId);
+    for (const runId of candidates) {
+      if (engine.isDraining?.()) break;
+      const existing = await engine.getRun(runId);
+      remember(settled, s.key, runId);
+      if (existing) continue;
+      await engine.start(workflowName(s.workflow), s.input, runId, {
+        namespace: s.namespace
+      });
       ids.push(runId);
     }
   }
   return ids;
 }
 __name(runSchedules, "runSchedules");
+var settledRunIds = /* @__PURE__ */ new WeakMap();
+function settledIdsFor(engine) {
+  let memo = settledRunIds.get(engine);
+  if (memo === void 0) {
+    memo = /* @__PURE__ */ new Map();
+    settledRunIds.set(engine, memo);
+  }
+  return memo;
+}
+__name(settledIdsFor, "settledIdsFor");
+function remember(memo, key, runId) {
+  const seen = memo.get(key);
+  if (seen === void 0) {
+    memo.set(key, /* @__PURE__ */ new Set([
+      runId
+    ]));
+    return;
+  }
+  seen.add(runId);
+  if (seen.size > 64) memo.set(key, /* @__PURE__ */ new Set([
+    runId
+  ]));
+}
+__name(remember, "remember");
 
 // src/schedules.ts
 var ScheduleAlreadyExistsError = class extends Error {
@@ -3080,6 +3150,73 @@ async function stalledInfo(store, run, now, thresholdMs, ageMs) {
 }
 __name(stalledInfo, "stalledInfo");
 
+// src/tenant-auth.ts
+var import_node_crypto = require("crypto");
+var TOKEN_SEP = ".";
+var EXP_SUFFIX = /\.exp(\d+)$/;
+function sign(claim, secret) {
+  return (0, import_node_crypto.createHmac)("sha256", secret).update(claim).digest("base64url");
+}
+__name(sign, "sign");
+function signTenantToken(tenant, secret, opts) {
+  const claim = opts?.ttlMs !== void 0 ? `${tenant}${TOKEN_SEP}exp${(opts.now ?? Date.now()) + opts.ttlMs}` : tenant;
+  return `${claim}${TOKEN_SEP}${sign(claim, secret)}`;
+}
+__name(signTenantToken, "signTenantToken");
+function hmacTenantVerifier(secret, capabilities) {
+  const secrets = Array.isArray(secret) ? secret : [
+    secret
+  ];
+  return ({ token }) => {
+    if (typeof token !== "string" || token.length === 0) return null;
+    const sep = token.lastIndexOf(TOKEN_SEP);
+    if (sep <= 0 || sep === token.length - 1) return null;
+    const claim = token.slice(0, sep);
+    const presented = token.slice(sep + 1);
+    if (!secrets.some((s) => constantTimeEquals(presented, sign(claim, s)))) return null;
+    const exp = EXP_SUFFIX.exec(claim);
+    if (exp) {
+      const expiresAt = Number(exp[1]);
+      if (!Number.isFinite(expiresAt) || Date.now() > expiresAt) return null;
+      const tenant = claim.slice(0, claim.length - (exp[0]?.length ?? 0));
+      if (tenant.length === 0) return null;
+      return capabilities !== void 0 ? {
+        tenant,
+        capabilities
+      } : {
+        tenant
+      };
+    }
+    return capabilities !== void 0 ? {
+      tenant: claim,
+      capabilities
+    } : {
+      tenant: claim
+    };
+  };
+}
+__name(hmacTenantVerifier, "hmacTenantVerifier");
+async function resolveWireTenant(wireTenant, verifyTenant) {
+  if (!verifyTenant) return wireTenant;
+  const verified = await verifyTenant({
+    token: wireTenant,
+    tenant: wireTenant
+  });
+  return verified ? verified.tenant : null;
+}
+__name(resolveWireTenant, "resolveWireTenant");
+async function resolveTenantToken(source) {
+  return typeof source === "function" ? source() : source;
+}
+__name(resolveTenantToken, "resolveTenantToken");
+function constantTimeEquals(a, b) {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  if (ab.length !== bb.length) return false;
+  return (0, import_node_crypto.timingSafeEqual)(ab, bb);
+}
+__name(constantTimeEquals, "constantTimeEquals");
+
 // src/transport-pool.ts
 var TransportPool = class {
   static {
@@ -3303,11 +3440,6 @@ function normalizeChildOptions(options) {
   } : options ?? {};
 }
 __name(normalizeChildOptions, "normalizeChildOptions");
-function formatIssuePath(path) {
-  if (!path || path.length === 0) return "(root)";
-  return path.map((segment) => String(typeof segment === "object" ? segment.key : segment)).join(".");
-}
-__name(formatIssuePath, "formatIssuePath");
 function resolveStepPolicy(config, opts) {
   const policy = {};
   const retries = opts?.retries ?? config?.retries;
@@ -4139,11 +4271,7 @@ function createWorkflowCtx(host, runId, compensations, workflow = "", searchAttr
         throw new Error(`workflow "${workflow}": ctx.upsertSearchAttributes schema validation must be synchronous (the searchAttributes schema's \`~standard.validate\` returned a Promise) \u2014 replay-determinism requires a sync validator; drop any async refinement from the schema passed to @Workflow({ searchAttributes }).`);
       }
       if (result.issues) {
-        const offendingKeys = [
-          ...new Set(result.issues.map((issue) => formatIssuePath(issue.path)))
-        ];
-        const details = result.issues.map((issue) => `${formatIssuePath(issue.path)}: ${issue.message}`).join("; ");
-        throw new Error(`workflow "${workflow}": ctx.upsertSearchAttributes rejected by its searchAttributes schema \u2014 offending key(s) ${offendingKeys.join(", ")} \u2014 ${details}`);
+        throw new SchemaValidationError(`workflow "${workflow}" ctx.upsertSearchAttributes`, result.issues);
       }
     }
     await host.upsertSearchAttributes(runId, attrs);
@@ -4565,9 +4693,20 @@ var WorkflowEngine = class {
         await this.completeRemoteDecision(decision);
       }
     );
+    const verifyTenant = deps.verifyTenant;
     this.pool.onStartRun(async (message) => {
+      let tenant;
+      try {
+        tenant = await resolveWireTenant(message.tenant, verifyTenant);
+      } catch {
+        tenant = null;
+      }
+      if (tenant === null) {
+        console.warn(`[nestjs-durable] dropped a start-run for "${message.workflow}": invalid or unauthorized tenant token`);
+        return;
+      }
       await this.start(message.workflow, message.input, message.runId ?? globalThis.crypto.randomUUID(), {
-        namespace: message.tenant,
+        namespace: tenant,
         tags: message.tags,
         searchAttributes: message.searchAttributes
       });
@@ -5349,6 +5488,10 @@ var WorkflowEngine = class {
       for (const rearm of this.drainRearms) rearm();
     }
   }
+  /** True once {@link beginDrain} (or {@link drain}) has been called. */
+  isDraining() {
+    return this.draining;
+  }
   /**
   * Graceful shutdown: stop picking up new runs (recovery/timer become no-ops) and wait for
   * in-flight executions to settle, up to `timeoutMs`. Call from your app's shutdown hook so a
@@ -10940,6 +11083,7 @@ var InMemoryTransport = class {
   ScheduleAlreadyExistsError,
   ScheduleClient,
   ScheduleNotFoundError,
+  SchemaValidationError,
   SignalTimeoutError,
   SingletonQueueFullError,
   TERMINAL_RUN_STATUSES,
@@ -11002,6 +11146,7 @@ var InMemoryTransport = class {
   handoffName,
   hasDurableExecutionWrappers,
   heartbeatStatus,
+  hmacTenantVerifier,
   indexWaitersByRun,
   info,
   isEngineMintedTag,
@@ -11039,6 +11184,8 @@ var InMemoryTransport = class {
   resolveConcurrency,
   resolveRouting,
   resolveRunWaiting,
+  resolveTenantToken,
+  resolveWireTenant,
   retiredHandoffName,
   routeFor,
   runDetailEtag,
@@ -11051,7 +11198,9 @@ var InMemoryTransport = class {
   runStepHandler,
   runValueFacetsFromRuns,
   sanitizeQueueToken,
+  scheduleRunIdAt,
   scheduledRunId,
+  signTenantToken,
   singletonAdmissionDenialPatch,
   singletonAdmissionTags,
   sqlComparator,