@oxy.so/core 1.6.0 → 1.6.1

package/dist/cjs/server/traffic.js

@@ -5,6 +5,12 @@ const trafficNodeHttp_1 = require("./trafficNodeHttp");
 const socket_1 = require("@oxy.so/telemetry/socket");
 const node_crypto_1 = require("node:crypto");
 const OxyServices_1 = require("../OxyServices");
+// Static, unlike the lazy import in `mixins/OxyServices.auth.ts`: that module is
+// reachable from the root barrel, which ships to React Native, so pulling
+// `node:crypto` in eagerly there would cost every mobile bundle. This file is
+// server-only and the server barrel already exports `./workloadIdentity`, so
+// there is nothing here for a phone to load.
+const workloadIdentity_1 = require("./workloadIdentity");
 const collector_1 = require("@oxy.so/telemetry/collector");
 /** Install once per service process, before registering HTTP routes. */
 function createEcosystemTraffic(options) {
@@ -17,9 +23,30 @@ function createEcosystemTraffic(options) {
     }
     const apiKey = activityKey || process.env.OXY_SERVICE_API_KEY;
     const apiSecret = activitySecret || process.env.OXY_SERVICE_API_SECRET;
-    if (!options.credential && (!apiKey || !apiSecret))
-        throw new Error('Ecosystem activity requires OXY_SERVICE_API_KEY and OXY_SERVICE_API_SECRET');
+    /**
+     * Having no key pair is a legitimate configuration now — but only where this
+     * process can prove what it IS (ADR 0026).
+     *
+     * This used to throw on a missing pair, full stop. Every service in the fleet
+     * boots with `OXY_ECOSYSTEM_ACTIVITY_ENABLED=true`, so deleting
+     * `OXY_SERVICE_API_KEY` and `OXY_SERVICE_API_SECRET` from a task definition —
+     * which is the entire migration ADR 0026 asks for — killed the process at
+     * boot. The ECS circuit breaker then rolled the deploy back and reported the
+     * service stable, so the operator saw a rollback with nothing naming its
+     * cause. That is what one line cost, multiplied by fourteen services holding
+     * a secret they no longer need.
+     *
+     * What is still refused: nothing to authenticate with AND nothing to attest.
+     * That is a laptop or a CI box, where the container credentials endpoint is
+     * not going to turn up later, and the honest answer is to say so at boot
+     * rather than to fail on the first heartbeat.
+     */
+    if (!options.credential && (!apiKey || !apiSecret) && !(0, workloadIdentity_1.canAttestWorkloadIdentity)()) {
+        throw new Error('Ecosystem activity needs one of: an OXY_ACTIVITY_API_KEY and OXY_ACTIVITY_API_SECRET pair, an OXY_SERVICE_API_KEY and OXY_SERVICE_API_SECRET pair, or a workload identity this process can attest (ADR 0026).');
+    }
     const oxy = new OxyServices_1.OxyServices({ baseURL });
+    // Left unconfigured when there is no pair on purpose: `getServiceToken()`
+    // attests instead of being handed half a credential to fail on.
     if (apiKey && apiSecret)
         oxy.configureServiceAuth(apiKey, apiSecret);
     const credential = options.credential ?? (() => oxy.getServiceToken());