@mondaydotcomorg/atp-server 0.17.14

package/src/execution-state/index.ts

@@ -0,0 +1,204 @@
+import { log } from '@mondaydotcomorg/atp-runtime';
+import type { ExecutionConfig, CallbackType, CacheProvider } from '@mondaydotcomorg/atp-protocol';
+import type { ProvenanceState, ProvenanceSnapshot } from '@mondaydotcomorg/atp-provenance';
+
+/**
+ * Callback request sent to client when execution is paused
+ */
+export interface CallbackRequest {
+	type: CallbackType;
+	operation: string;
+	payload: Record<string, unknown>;
+}
+
+/**
+ * Callback execution record for replay
+ */
+export interface CallbackRecord {
+	type: CallbackType;
+	operation: string;
+	payload: Record<string, unknown>;
+	result?: unknown;
+	timestamp: number;
+	sequenceNumber: number;
+}
+
+/**
+ * Paused execution state
+ */
+export interface PausedExecution {
+	executionId: string;
+	code: string;
+	config: ExecutionConfig;
+	clientId: string;
+	callbackRequest: CallbackRequest;
+	pausedAt: number;
+
+	callbackHistory: CallbackRecord[];
+	currentCallbackIndex: number;
+
+	context: {
+		variables?: Record<string, unknown>;
+		codeTransformed?: boolean;
+	};
+
+	provenanceState?: ProvenanceState | ProvenanceSnapshot;
+}
+
+/**
+ * Execution state manager using CacheProvider
+ * Works with any CacheProvider (MemoryCache, RedisCache, etc.)
+ */
+export class ExecutionStateManager {
+	private cache: CacheProvider;
+	private keyPrefix: string;
+	private ttl: number;
+	private maxPauseDuration: number;
+	private metrics: {
+		totalPauses: number;
+		totalResumes: number;
+		totalExpired: number;
+		totalFailed: number;
+	};
+
+	constructor(
+		cache: CacheProvider,
+		options?: {
+			keyPrefix?: string;
+			ttl?: number;
+			maxPauseDuration?: number;
+		}
+	) {
+		this.cache = cache;
+		this.keyPrefix = options?.keyPrefix || 'atp:execution:';
+		this.ttl = options?.ttl || 3600;
+		this.maxPauseDuration = (options?.maxPauseDuration ?? 3600) * 1000;
+		this.metrics = {
+			totalPauses: 0,
+			totalResumes: 0,
+			totalExpired: 0,
+			totalFailed: 0,
+		};
+
+		log.info('ExecutionStateManager initialized', {
+			cacheProvider: cache.name,
+			ttl: this.ttl,
+			maxPauseDuration: this.maxPauseDuration / 1000,
+		});
+	}
+
+	/**
+	 * Saves paused execution state
+	 */
+	async pause(state: PausedExecution): Promise<void> {
+		this.metrics.totalPauses++;
+
+		const key = this.getKey(state.executionId);
+		const serialized = JSON.stringify(state);
+		await this.cache.set(key, serialized, this.ttl);
+
+		log.info('Execution paused', {
+			executionId: state.executionId,
+			clientId: state.clientId,
+			callbackType: state.callbackRequest.type,
+			cacheProvider: this.cache.name,
+			ttl: this.ttl,
+			maxPauseDuration: this.maxPauseDuration / 1000,
+		});
+	}
+
+	/**
+	 * Retrieves paused execution state
+	 */
+	async get(executionId: string): Promise<PausedExecution | null> {
+		const key = this.getKey(executionId);
+		const serialized = await this.cache.get(key);
+
+		if (!serialized) {
+			log.warn('Execution not found or expired', { executionId });
+			this.metrics.totalExpired++;
+			return null;
+		}
+
+		const state = JSON.parse(serialized as string) as PausedExecution;
+
+		const pauseDuration = Date.now() - state.pausedAt;
+		if (pauseDuration > this.maxPauseDuration) {
+			log.warn('Execution pause duration exceeded maximum', {
+				executionId,
+				pauseDuration: pauseDuration / 1000,
+				maxDuration: this.maxPauseDuration / 1000,
+			});
+			await this.delete(executionId);
+			this.metrics.totalExpired++;
+			return null;
+		}
+
+		await this.cache.set(key, serialized, this.ttl);
+
+		this.metrics.totalResumes++;
+		return state;
+	}
+
+	/**
+	 * Deletes execution state
+	 */
+	async delete(executionId: string): Promise<void> {
+		const key = this.getKey(executionId);
+		await this.cache.delete(key);
+		log.debug('Execution state deleted', { executionId });
+	}
+
+	/**
+	 * Gets the full cache key for an execution ID
+	 */
+	private getKey(executionId: string): string {
+		return `${this.keyPrefix}${executionId}`;
+	}
+
+	/**
+	 * Closes connections and cleanup
+	 */
+	async close(): Promise<void> {
+		if (this.cache.disconnect) {
+			await this.cache.disconnect();
+		}
+		log.debug('ExecutionStateManager closed');
+	}
+
+	/**
+	 * Gets storage type from cache provider
+	 */
+	getStorageType(): string {
+		return this.cache.name;
+	}
+
+	/**
+	 * Gets pause/resume metrics
+	 */
+	getMetrics() {
+		return {
+			...this.metrics,
+			successRate:
+				this.metrics.totalResumes > 0
+					? ((this.metrics.totalResumes / (this.metrics.totalPauses || 1)) * 100).toFixed(2) + '%'
+					: '0%',
+			expiredRate:
+				this.metrics.totalExpired > 0
+					? ((this.metrics.totalExpired / (this.metrics.totalPauses || 1)) * 100).toFixed(2) + '%'
+					: '0%',
+		};
+	}
+
+	/**
+	 * Resets metrics (useful for testing)
+	 */
+	resetMetrics(): void {
+		this.metrics = {
+			totalPauses: 0,
+			totalResumes: 0,
+			totalExpired: 0,
+			totalFailed: 0,
+		};
+	}
+}

package/src/executor/ast-provenance-bridge.ts

@@ -0,0 +1,80 @@
+/**
+ * Bridge between AST tracker in isolated-vm and host policy engine
+ */
+import * as ivm from 'isolated-vm';
+import { getProvenance, getProvenanceForPrimitive } from '@mondaydotcomorg/atp-provenance';
+
+// Store active isolate contexts for AST mode provenance checking
+const activeIsolates = new Map<string, ivm.Context>();
+
+// Cache the getProvenance function to avoid repeated requires
+let cachedGetProvenance: ((value: unknown) => any) | null = null;
+
+export function registerIsolateContext(executionId: string, context: ivm.Context): void {
+	activeIsolates.set(executionId, context);
+}
+
+export function unregisterIsolateContext(executionId: string): void {
+	activeIsolates.delete(executionId);
+}
+
+/**
+ * Create a getProvenance function that can check AST tracker inside the isolate
+ * Falls back to host-side getProvenance for hint-based tracking
+ */
+export function createASTProvenanceChecker(executionId: string): (value: unknown) => any {
+	return (value: unknown) => {
+		const context = activeIsolates.get(executionId);
+
+		// First, try checking in the isolate's AST tracker
+		if (context) {
+			try {
+				// Serialize the value to pass into isolate for checking
+				const valueStr =
+					typeof value === 'string' || typeof value === 'number'
+						? JSON.stringify(String(value))
+						: JSON.stringify(value);
+
+				// Call __check_provenance inside the isolate
+				const checkCode = `
+					(function() {
+						try {
+							if (typeof globalThis.__check_provenance !== 'function') {
+								return null;
+							}
+							const value = ${valueStr};
+							const result = globalThis.__check_provenance(value);
+							return result;
+						} catch (e) {
+							return null;
+						}
+					})()
+				`;
+
+				const result = context.evalSync(checkCode, { timeout: 100, copy: true });
+				if (result) {
+					return result;
+				}
+			} catch (error) {
+				// Fall through to host check
+			}
+		}
+
+		// Fall back to host-side provenance check (for hints and registered metadata)
+		// This is critical for checking primitives that were registered via hints
+		if (!cachedGetProvenance) {
+			cachedGetProvenance = getProvenance;
+		}
+		const hostResult = cachedGetProvenance?.(value);
+
+		// Also check getProvenanceForPrimitive for tainted primitives
+		if (!hostResult && (typeof value === 'string' || typeof value === 'number')) {
+			const primitiveResult = getProvenanceForPrimitive?.(value);
+			if (primitiveResult) {
+				return primitiveResult;
+			}
+		}
+
+		return hostResult;
+	};
+}