@dudousxd/nestjs-durable-core 0.83.0 → 0.84.1

package/dist/index.cjs

@@ -135,6 +135,7 @@ __export(index_exports, {
   handoffName: () => handoffName,
   hasDurableExecutionWrappers: () => hasDurableExecutionWrappers,
   heartbeatStatus: () => heartbeatStatus,
+  hmacTenantVerifier: () => hmacTenantVerifier,
   indexWaitersByRun: () => indexWaitersByRun,
   info: () => info,
   isEngineMintedTag: () => isEngineMintedTag,
@@ -172,6 +173,8 @@ __export(index_exports, {
   resolveConcurrency: () => resolveConcurrency,
   resolveRouting: () => resolveRouting,
   resolveRunWaiting: () => resolveRunWaiting,
+  resolveTenantToken: () => resolveTenantToken,
+  resolveWireTenant: () => resolveWireTenant,
   retiredHandoffName: () => retiredHandoffName,
   routeFor: () => routeFor,
   runDetailEtag: () => runDetailEtag,
@@ -186,6 +189,7 @@ __export(index_exports, {
   sanitizeQueueToken: () => sanitizeQueueToken,
   scheduleRunIdAt: () => scheduleRunIdAt,
   scheduledRunId: () => scheduledRunId,
+  signTenantToken: () => signTenantToken,
   singletonAdmissionDenialPatch: () => singletonAdmissionDenialPatch,
   singletonAdmissionTags: () => singletonAdmissionTags,
   sqlComparator: () => sqlComparator,
@@ -3146,6 +3150,73 @@ async function stalledInfo(store, run, now, thresholdMs, ageMs) {
 }
 __name(stalledInfo, "stalledInfo");
 
+// src/tenant-auth.ts
+var import_node_crypto = require("crypto");
+var TOKEN_SEP = ".";
+var EXP_SUFFIX = /\.exp(\d+)$/;
+function sign(claim, secret) {
+  return (0, import_node_crypto.createHmac)("sha256", secret).update(claim).digest("base64url");
+}
+__name(sign, "sign");
+function signTenantToken(tenant, secret, opts) {
+  const claim = opts?.ttlMs !== void 0 ? `${tenant}${TOKEN_SEP}exp${(opts.now ?? Date.now()) + opts.ttlMs}` : tenant;
+  return `${claim}${TOKEN_SEP}${sign(claim, secret)}`;
+}
+__name(signTenantToken, "signTenantToken");
+function hmacTenantVerifier(secret, capabilities) {
+  const secrets = Array.isArray(secret) ? secret : [
+    secret
+  ];
+  return ({ token }) => {
+    if (typeof token !== "string" || token.length === 0) return null;
+    const sep = token.lastIndexOf(TOKEN_SEP);
+    if (sep <= 0 || sep === token.length - 1) return null;
+    const claim = token.slice(0, sep);
+    const presented = token.slice(sep + 1);
+    if (!secrets.some((s) => constantTimeEquals(presented, sign(claim, s)))) return null;
+    const exp = EXP_SUFFIX.exec(claim);
+    if (exp) {
+      const expiresAt = Number(exp[1]);
+      if (!Number.isFinite(expiresAt) || Date.now() > expiresAt) return null;
+      const tenant = claim.slice(0, claim.length - (exp[0]?.length ?? 0));
+      if (tenant.length === 0) return null;
+      return capabilities !== void 0 ? {
+        tenant,
+        capabilities
+      } : {
+        tenant
+      };
+    }
+    return capabilities !== void 0 ? {
+      tenant: claim,
+      capabilities
+    } : {
+      tenant: claim
+    };
+  };
+}
+__name(hmacTenantVerifier, "hmacTenantVerifier");
+async function resolveWireTenant(wireTenant, verifyTenant) {
+  if (!verifyTenant) return wireTenant;
+  const verified = await verifyTenant({
+    token: wireTenant,
+    tenant: wireTenant
+  });
+  return verified ? verified.tenant : null;
+}
+__name(resolveWireTenant, "resolveWireTenant");
+async function resolveTenantToken(source) {
+  return typeof source === "function" ? source() : source;
+}
+__name(resolveTenantToken, "resolveTenantToken");
+function constantTimeEquals(a, b) {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  if (ab.length !== bb.length) return false;
+  return (0, import_node_crypto.timingSafeEqual)(ab, bb);
+}
+__name(constantTimeEquals, "constantTimeEquals");
+
 // src/transport-pool.ts
 var TransportPool = class {
   static {
@@ -4622,9 +4693,20 @@ var WorkflowEngine = class {
         await this.completeRemoteDecision(decision);
       }
     );
+    const verifyTenant = deps.verifyTenant;
     this.pool.onStartRun(async (message) => {
+      let tenant;
+      try {
+        tenant = await resolveWireTenant(message.tenant, verifyTenant);
+      } catch {
+        tenant = null;
+      }
+      if (tenant === null) {
+        console.warn(`[nestjs-durable] dropped a start-run for "${message.workflow}": invalid or unauthorized tenant token`);
+        return;
+      }
       await this.start(message.workflow, message.input, message.runId ?? globalThis.crypto.randomUUID(), {
-        namespace: message.tenant,
+        namespace: tenant,
         tags: message.tags,
         searchAttributes: message.searchAttributes
       });
@@ -11064,6 +11146,7 @@ var InMemoryTransport = class {
   handoffName,
   hasDurableExecutionWrappers,
   heartbeatStatus,
+  hmacTenantVerifier,
   indexWaitersByRun,
   info,
   isEngineMintedTag,
@@ -11101,6 +11184,8 @@ var InMemoryTransport = class {
   resolveConcurrency,
   resolveRouting,
   resolveRunWaiting,
+  resolveTenantToken,
+  resolveWireTenant,
   retiredHandoffName,
   routeFor,
   runDetailEtag,
@@ -11115,6 +11200,7 @@ var InMemoryTransport = class {
   sanitizeQueueToken,
   scheduleRunIdAt,
   scheduledRunId,
+  signTenantToken,
   singletonAdmissionDenialPatch,
   singletonAdmissionTags,
   sqlComparator,