@shipfox/api-workflows 2.0.0

package/src/presentation/routes/get-step-secrets.test.ts

@@ -0,0 +1,260 @@
+import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
+import {setSecrets} from '@shipfox/api-secrets';
+import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
+import {createCapturingLogger} from '@shipfox/node-log/test';
+import {eq} from 'drizzle-orm';
+import type {StepStatus} from '#core/entities/step.js';
+import {db} from '#db/db.js';
+import {jobs} from '#db/schema/jobs.js';
+import {steps as stepsTable} from '#db/schema/steps.js';
+import {
+  createWorkflowRun,
+  getJobScope,
+  getJobsByWorkflowRunId,
+  getStepsByJobId,
+} from '#db/workflow-runs.js';
+import {workflowModel} from '#test/factories/workflow-model.js';
+import {mintActiveLeaseToken} from '#test/fixtures/active-lease-token.js';
+import {leaseTokenRouteGroup} from './index.js';
+
+const URL_PREFIX = '/runs/jobs/current/steps';
+
+describe('GET /runs/jobs/current/steps/:stepId/secrets', () => {
+  let app: FastifyInstance;
+  const {logger, lines: logLines, clear: clearLogLines} = createCapturingLogger();
+
+  beforeAll(async () => {
+    app = await createApp({
+      auth: [createLeaseTokenAuthMethod()],
+      routes: [leaseTokenRouteGroup],
+      swagger: false,
+      fastifyOptions: {loggerInstance: logger},
+    });
+    await app.ready();
+  });
+
+  beforeEach(() => {
+    clearLogLines();
+  });
+
+  afterAll(async () => {
+    await closeApp();
+  });
+
+  test('returns only referenced secrets for the leased run step and does not cache or log plaintext', async () => {
+    const {run, job, step} = await createRunningRunStep();
+    await setRunSecretBindings(step.id, [
+      {
+        target: 'TOKEN',
+        segments: [
+          {kind: 'literal', value: 'prefix-'},
+          {kind: 'secret', store: 'local', key: 'API_TOKEN'},
+        ],
+      },
+      {
+        target: 'REUSED',
+        segments: [{kind: 'secret', store: 'local', key: 'API_TOKEN'}],
+      },
+    ]);
+    await setSecrets({
+      workspaceId: run.workspaceId,
+      projectId: run.projectId,
+      values: {API_TOKEN: 'runtime-secret', UNUSED_TOKEN: 'unused-secret'},
+    });
+    const token = await mintActiveLeaseToken({jobId: job.id});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: stepSecretsUrl(step.id, step.currentAttempt),
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.headers['cache-control']).toBe('no-store');
+    expect(res.json()).toEqual({
+      secrets: [{store: 'local', key: 'API_TOKEN', value: 'runtime-secret'}],
+    });
+    expect(res.body).not.toContain('unused-secret');
+    expect(logLines.join('\n')).not.toContain('runtime-secret');
+  });
+
+  test('derives scope from the job row and prefers project secrets over workspace secrets', async () => {
+    const {run, job, step} = await createRunningRunStep();
+    const hostileWorkspaceId = crypto.randomUUID();
+    await setRunSecretBindings(step.id, [
+      {
+        target: 'TOKEN',
+        segments: [{kind: 'secret', store: 'local', key: 'API_TOKEN'}],
+      },
+    ]);
+    await setSecrets({workspaceId: run.workspaceId, values: {API_TOKEN: 'workspace-secret'}});
+    await setSecrets({
+      workspaceId: run.workspaceId,
+      projectId: run.projectId,
+      values: {API_TOKEN: 'project-secret'},
+    });
+    await setSecrets({workspaceId: hostileWorkspaceId, values: {API_TOKEN: 'hostile-secret'}});
+    const token = await mintActiveLeaseToken({
+      jobId: job.id,
+      token: {workspaceId: hostileWorkspaceId, projectId: crypto.randomUUID()},
+    });
+
+    const res = await app.inject({
+      method: 'GET',
+      url: stepSecretsUrl(step.id, step.currentAttempt),
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json().secrets).toEqual([
+      {store: 'local', key: 'API_TOKEN', value: 'project-secret'},
+    ]);
+    expect(res.body).not.toContain('hostile-secret');
+  });
+
+  test('returns an empty response without resolving secrets when bindings are absent', async () => {
+    const {job, step} = await createRunningRunStep();
+    const token = await mintActiveLeaseToken({jobId: job.id});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: stepSecretsUrl(step.id, step.currentAttempt),
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({secrets: []});
+  });
+
+  test('returns 409 when the leased step is not a run step', async () => {
+    const {job, step} = await createRunningAgentStep();
+    const token = await mintActiveLeaseToken({jobId: job.id});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: stepSecretsUrl(step.id, step.currentAttempt),
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('step-not-run');
+  });
+
+  test('returns 422 when a referenced secret does not exist', async () => {
+    const {job, step} = await createRunningRunStep();
+    await setRunSecretBindings(step.id, [
+      {
+        target: 'TOKEN',
+        segments: [{kind: 'secret', store: 'local', key: 'MISSING_TOKEN'}],
+      },
+    ]);
+    const token = await mintActiveLeaseToken({jobId: job.id});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: stepSecretsUrl(step.id, step.currentAttempt),
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(422);
+    expect(res.json().code).toBe('secret-not-found');
+  });
+
+  test('returns 409 instead of 500 when stored secret bindings are corrupt', async () => {
+    const {job, step} = await createRunningRunStep();
+    await db()
+      .update(stepsTable)
+      .set({config: {run: 'echo "$TOKEN"', secret_bindings: [{target: 'TOKEN'}]}})
+      .where(eq(stepsTable.id, step.id));
+    const token = await mintActiveLeaseToken({jobId: job.id});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: stepSecretsUrl(step.id, step.currentAttempt),
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('secret-bindings-invalid');
+  });
+
+  test('getJobScope returns the workspace and project that own a job', async () => {
+    const {run, job} = await createRunningRunStep();
+
+    const scope = await getJobScope(job.id);
+
+    expect(scope).toEqual({workspaceId: run.workspaceId, projectId: run.projectId});
+  });
+});
+
+function stepSecretsUrl(stepId: string, attempt: number): string {
+  const search = new URLSearchParams({attempt: String(attempt)});
+  return `${URL_PREFIX}/${stepId}/secrets?${search.toString()}`;
+}
+
+async function setRunSecretBindings(
+  stepId: string,
+  bindings: NonNullable<Record<string, unknown>['secret_bindings']>,
+): Promise<void> {
+  await db()
+    .update(stepsTable)
+    .set({config: {run: 'echo "$TOKEN"', secret_bindings: bindings}})
+    .where(eq(stepsTable.id, stepId));
+}
+
+type TestStepInput = {prompt: string} | {run: string};
+
+async function createRunningRunStep(options: {status?: StepStatus} = {}) {
+  return await createStep({
+    steps: [{run: 'echo hello'}],
+    targetType: 'run',
+    status: options.status ?? 'running',
+  });
+}
+
+async function createRunningAgentStep() {
+  return await createStep({
+    steps: [{prompt: 'Fix the failing tests.'}],
+    targetType: 'agent',
+    status: 'running',
+  });
+}
+
+async function createStep(params: {
+  steps: readonly TestStepInput[];
+  targetType: 'agent' | 'run';
+  status: StepStatus;
+}) {
+  const run = await createWorkflowRun({
+    workspaceId: crypto.randomUUID(),
+    projectId: crypto.randomUUID(),
+    definitionId: crypto.randomUUID(),
+    model: workflowModel({jobs: {build: {steps: params.steps}}}),
+    resolveAgentDefaults: (defaults) => ({
+      harness: defaults.harness ?? 'pi',
+      provider: defaults.provider ?? 'anthropic',
+      model: defaults.model ?? 'claude-opus-4-8',
+      thinking: defaults.thinking ?? 'high',
+    }),
+    triggerPayload: {
+      source: 'manual',
+      event: 'fire',
+      subscriptionId: crypto.randomUUID(),
+      userId: crypto.randomUUID(),
+    },
+  });
+  const [job] = await getJobsByWorkflowRunId(run.id);
+  if (!job) throw new Error('createStep: run created no job');
+  await db().update(jobs).set({status: 'running'}).where(eq(jobs.id, job.id));
+
+  const stepRows = await getStepsByJobId(job.id);
+  const step = stepRows.find((candidate) => candidate.type === params.targetType);
+  if (!step) throw new Error(`createStep: ${params.targetType} step not found`);
+  await db().update(stepsTable).set({status: params.status}).where(eq(stepsTable.id, step.id));
+
+  return {
+    run,
+    job: {...job, status: 'running' as const},
+    step: {...step, status: params.status},
+  };
+}

package/src/presentation/routes/get-step-secrets.ts

@@ -0,0 +1,117 @@
+import {getSecret, SecretDecryptionError} from '@shipfox/api-secrets';
+import {
+  materializedSecretBindingSchema,
+  type StepSecretDto,
+  stepSecretsParamsSchema,
+  stepSecretsQuerySchema,
+  stepSecretsResponseSchema,
+} from '@shipfox/api-secrets-dto';
+import {captureException} from '@shipfox/node-error-monitoring';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {logger} from '@shipfox/node-opentelemetry';
+import {ZodError, z} from 'zod';
+import {loadRunningLeasedStep} from './leased-step.js';
+
+const secretBindingsSchema = z.array(materializedSecretBindingSchema);
+
+export const getStepSecretsRoute = defineRoute({
+  method: 'GET',
+  path: '/steps/:stepId/secrets',
+  description:
+    "Returns decrypted secret values referenced by the runner's currently leased running run step. The job scope and secret bindings are re-derived from server state; the runner supplies only the step id and current attempt.",
+  schema: {
+    params: stepSecretsParamsSchema,
+    querystring: stepSecretsQuerySchema,
+    response: {
+      200: stepSecretsResponseSchema,
+    },
+  },
+  errorHandler: (error) => {
+    if (error instanceof SecretDecryptionError) {
+      captureException(error);
+      throw new ClientError('Step secret could not be decrypted', 'secret-value-invalid', {
+        status: 409,
+        cause: error,
+      });
+    }
+    throw error;
+  },
+  handler: async (request, reply) => {
+    const {stepId} = request.params;
+    const {attempt} = request.query;
+    const {leasedJob, step, workspaceId, projectId} = await loadRunningLeasedStep({
+      request,
+      stepId,
+      attempt,
+    });
+
+    if (step.type !== 'run') {
+      throw new ClientError('Step is not a run step', 'step-not-run', {status: 409});
+    }
+
+    const secretBindings = parseSecretBindings(step.config.secret_bindings);
+    const references = distinctSecretReferences(secretBindings);
+    const secrets = await Promise.all(
+      references.map(async (reference): Promise<StepSecretDto> => {
+        const value = await getSecret({
+          workspaceId,
+          projectId,
+          namespace: '',
+          key: reference.key,
+          store: reference.store,
+        });
+        if (value === null) {
+          throw new ClientError('Secret not found', 'secret-not-found', {status: 422});
+        }
+        return {...reference, value};
+      }),
+    );
+
+    logger().info(
+      {jobId: leasedJob.jobId, workspaceId, stepId, keyCount: references.length},
+      'Resolved step secrets',
+    );
+    logger().debug(
+      {jobId: leasedJob.jobId, workspaceId, stepId, keys: references.map((ref) => ref.key)},
+      'Resolved step secret keys',
+    );
+
+    reply.header('cache-control', 'no-store');
+    return {secrets};
+  },
+});
+
+function parseSecretBindings(value: unknown): z.infer<typeof secretBindingsSchema> {
+  try {
+    return secretBindingsSchema.parse(value ?? []);
+  } catch (error) {
+    if (error instanceof ZodError) {
+      throw new ClientError('Step secret bindings are invalid', 'secret-bindings-invalid', {
+        status: 409,
+        cause: error,
+      });
+    }
+    throw error;
+  }
+}
+
+function distinctSecretReferences(
+  bindings: ReadonlyArray<z.infer<typeof materializedSecretBindingSchema>>,
+): Array<Pick<StepSecretDto, 'store' | 'key'>> {
+  const seen = new Set<string>();
+  const references: Array<Pick<StepSecretDto, 'store' | 'key'>> = [];
+  for (const binding of bindings) {
+    for (const segment of binding.segments) {
+      if (segment.kind !== 'secret') continue;
+      const id = secretReferenceId(segment);
+      if (seen.has(id)) continue;
+      seen.add(id);
+      references.push({store: segment.store, key: segment.key});
+    }
+  }
+  return references;
+}
+
+function secretReferenceId(reference: Pick<StepSecretDto, 'store' | 'key'>): string {
+  return `${reference.store}\0${reference.key}`;
+}

package/src/presentation/routes/index.test.ts

@@ -0,0 +1,71 @@
+import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
+import {
+  AUTH_LEASED_JOB,
+  AUTH_USER,
+  buildUserContext,
+  setUserContext,
+} from '@shipfox/api-auth-context';
+import {type AuthMethod, ClientError, closeApp, createApp} from '@shipfox/node-fastify';
+import type {FastifyRequest} from 'fastify';
+import {workflowRoutes} from './index.js';
+
+const fakeUserAuth: AuthMethod = {
+  name: AUTH_USER,
+  authenticate: (request: FastifyRequest) => {
+    if (request.headers.authorization !== 'Bearer user') {
+      throw new ClientError('Invalid user token', 'unauthorized', {status: 401});
+    }
+
+    setUserContext(
+      request,
+      buildUserContext({userId: 'user-1', email: 'user@example.com', memberships: []}),
+    );
+    return Promise.resolve();
+  },
+};
+
+afterEach(async () => {
+  await closeApp();
+});
+
+describe('workflow route auth', () => {
+  test('uses user auth', () => {
+    expect(workflowRoutes[0]?.auth).toBe(AUTH_USER);
+  });
+
+  test('rejects API-key-only requests', async () => {
+    const app = await createApp({
+      auth: [fakeUserAuth, createLeaseTokenAuthMethod()],
+      routes: workflowRoutes,
+      swagger: false,
+    });
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workflows/runs?project_id=${crypto.randomUUID()}`,
+      headers: {authorization: 'Bearer api-key'},
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json().code).toBe('unauthorized');
+  });
+
+  test('step routes use lease-token auth', () => {
+    expect(workflowRoutes[1]?.prefix).toBe('/runs/jobs/current');
+    expect(workflowRoutes[1]?.auth).toBe(AUTH_LEASED_JOB);
+  });
+
+  test('step routes reject requests without a lease token', async () => {
+    const app = await createApp({
+      auth: [fakeUserAuth, createLeaseTokenAuthMethod()],
+      routes: workflowRoutes,
+      swagger: false,
+    });
+    const res = await app.inject({
+      method: 'POST',
+      url: '/runs/jobs/current/steps/next',
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json().code).toBe('unauthorized');
+  });
+});

package/src/presentation/routes/index.ts

@@ -0,0 +1,42 @@
+import {AUTH_LEASED_JOB, AUTH_USER} from '@shipfox/api-auth-context';
+import type {RouteGroup} from '@shipfox/node-fastify';
+import {agentRuntimeConfigRoute} from './agent-runtime-config.js';
+import {cancelRunRoute} from './cancel-run.js';
+import {checkoutTokenRoute} from './checkout-token.js';
+import {getRunRoute} from './get-run.js';
+import {getRunAggregatesRoute} from './get-run-aggregates.js';
+import {getStepSecretsRoute} from './get-step-secrets.js';
+import {listRunAttemptsRoute} from './list-run-attempts.js';
+import {listRunsRoute} from './list-runs.js';
+import {nextStepRoute} from './next-step.js';
+import {reportStepRoute} from './report-step.js';
+import {rerunRunRoute} from './rerun-run.js';
+
+export const leaseTokenRouteGroup: RouteGroup = {
+  // The lease token names the job, so the path carries no job id ("current").
+  prefix: '/runs/jobs/current',
+  auth: AUTH_LEASED_JOB,
+  routes: [
+    nextStepRoute,
+    reportStepRoute,
+    checkoutTokenRoute,
+    agentRuntimeConfigRoute,
+    getStepSecretsRoute,
+  ],
+};
+
+export const workflowRoutes: RouteGroup[] = [
+  {
+    prefix: '/workflows/runs',
+    auth: AUTH_USER,
+    routes: [
+      listRunsRoute,
+      getRunAggregatesRoute,
+      listRunAttemptsRoute,
+      getRunRoute,
+      cancelRunRoute,
+      rerunRunRoute,
+    ],
+  },
+  leaseTokenRouteGroup,
+];

package/src/presentation/routes/leased-step.ts

@@ -0,0 +1,54 @@
+import {type LeasedJobContext, requireLeasedJobContext} from '@shipfox/api-auth-context';
+import {isJobLeaseActive} from '@shipfox/api-runners';
+import {ClientError} from '@shipfox/node-fastify';
+import type {Step} from '#core/entities/step.js';
+import {getJobScope, getStepByIdForJobExecution} from '#db/index.js';
+
+export interface LoadedRunningLeasedStep {
+  leasedJob: LeasedJobContext;
+  step: Step;
+  workspaceId: string;
+  projectId: string;
+}
+
+export async function loadRunningLeasedStep(params: {
+  request: object;
+  stepId: string;
+  attempt: number;
+}): Promise<LoadedRunningLeasedStep> {
+  const leasedJob = requireLeasedJobContext(params.request);
+
+  const leaseIsActive = await isJobLeaseActive({
+    jobId: leasedJob.jobId,
+    jobExecutionId: leasedJob.jobExecutionId,
+    runnerSessionId: leasedJob.runnerSessionId,
+  });
+  if (!leaseIsActive) {
+    throw new ClientError('Job lease is no longer active', 'lease-not-active', {status: 404});
+  }
+
+  const step = await getStepByIdForJobExecution({
+    stepId: params.stepId,
+    jobExecutionId: leasedJob.jobExecutionId,
+  });
+  if (!step) {
+    throw new ClientError('Step not found for leased job', 'step-not-found', {status: 404});
+  }
+
+  const scope = await getJobScope(leasedJob.jobId);
+  if (!scope) {
+    throw new ClientError('Leased job not found', 'job-not-found', {status: 404});
+  }
+
+  if (step.currentAttempt !== params.attempt) {
+    throw new ClientError('Step attempt does not match current attempt', 'step-attempt-mismatch', {
+      status: 409,
+    });
+  }
+
+  if (step.status !== 'running') {
+    throw new ClientError('Step is not running', 'step-not-running', {status: 409});
+  }
+
+  return {leasedJob, step, workspaceId: scope.workspaceId, projectId: scope.projectId};
+}