@trigger.dev/core 4.5.4 → 4.5.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commonjs/v3/apiClient/core.d.ts +7 -0
- package/dist/commonjs/v3/apiClient/core.js +1 -0
- package/dist/commonjs/v3/apiClient/core.js.map +1 -1
- package/dist/commonjs/v3/build/resolvedConfig.d.ts +6 -5
- package/dist/commonjs/v3/build/runtime.d.ts +3 -0
- package/dist/commonjs/v3/build/runtime.js +28 -1
- package/dist/commonjs/v3/build/runtime.js.map +1 -1
- package/dist/commonjs/v3/build/runtime.test.d.ts +1 -0
- package/dist/commonjs/v3/build/runtime.test.js +34 -0
- package/dist/commonjs/v3/build/runtime.test.js.map +1 -0
- package/dist/commonjs/v3/config.d.ts +2 -2
- package/dist/commonjs/v3/index.d.ts +1 -0
- package/dist/commonjs/v3/index.js +1 -0
- package/dist/commonjs/v3/index.js.map +1 -1
- package/dist/commonjs/v3/jwt.d.ts +1 -0
- package/dist/commonjs/v3/jwt.js +6 -4
- package/dist/commonjs/v3/jwt.js.map +1 -1
- package/dist/commonjs/v3/runEngineWorker/consts.d.ts +1 -0
- package/dist/commonjs/v3/runEngineWorker/consts.js +3 -0
- package/dist/commonjs/v3/runEngineWorker/consts.js.map +1 -1
- package/dist/commonjs/v3/runEngineWorker/supervisor/http.d.ts +8 -5
- package/dist/commonjs/v3/runEngineWorker/supervisor/http.js +15 -5
- package/dist/commonjs/v3/runEngineWorker/supervisor/http.js.map +1 -1
- package/dist/commonjs/v3/runEngineWorker/supervisor/schemas.d.ts +40 -30
- package/dist/commonjs/v3/runEngineWorker/types.d.ts +1 -0
- package/dist/commonjs/v3/runEngineWorker/workload/http.d.ts +1 -0
- package/dist/commonjs/v3/runEngineWorker/workload/schemas.d.ts +35 -30
- package/dist/commonjs/v3/runMetadata/operations.d.ts +1 -1
- package/dist/commonjs/v3/runMetadata/operations.js +7 -0
- package/dist/commonjs/v3/runMetadata/operations.js.map +1 -1
- package/dist/commonjs/v3/schemas/api.d.ts +64 -17
- package/dist/commonjs/v3/schemas/api.js +21 -4
- package/dist/commonjs/v3/schemas/api.js.map +1 -1
- package/dist/commonjs/v3/schemas/build.d.ts +23 -21
- package/dist/commonjs/v3/schemas/build.js +9 -2
- package/dist/commonjs/v3/schemas/build.js.map +1 -1
- package/dist/commonjs/v3/schemas/checkpoints.d.ts +5 -0
- package/dist/commonjs/v3/schemas/common.d.ts +121 -115
- package/dist/commonjs/v3/schemas/common.js +21 -5
- package/dist/commonjs/v3/schemas/common.js.map +1 -1
- package/dist/commonjs/v3/schemas/messages.d.ts +35 -35
- package/dist/commonjs/v3/schemas/runEngine.d.ts +5 -0
- package/dist/commonjs/v3/schemas/runEngine.js +2 -0
- package/dist/commonjs/v3/schemas/runEngine.js.map +1 -1
- package/dist/commonjs/v3/utils/flattenAttributes.js +11 -2
- package/dist/commonjs/v3/utils/flattenAttributes.js.map +1 -1
- package/dist/commonjs/v3/workloadDeploymentToken.d.ts +68 -0
- package/dist/commonjs/v3/workloadDeploymentToken.js +73 -0
- package/dist/commonjs/v3/workloadDeploymentToken.js.map +1 -0
- package/dist/commonjs/v3/workloadDeploymentToken.test.d.ts +1 -0
- package/dist/commonjs/v3/workloadDeploymentToken.test.js +110 -0
- package/dist/commonjs/v3/workloadDeploymentToken.test.js.map +1 -0
- package/dist/commonjs/version.js +1 -1
- package/dist/esm/v3/apiClient/core.d.ts +7 -0
- package/dist/esm/v3/apiClient/core.js +1 -0
- package/dist/esm/v3/apiClient/core.js.map +1 -1
- package/dist/esm/v3/build/resolvedConfig.d.ts +6 -5
- package/dist/esm/v3/build/runtime.d.ts +3 -0
- package/dist/esm/v3/build/runtime.js +26 -1
- package/dist/esm/v3/build/runtime.js.map +1 -1
- package/dist/esm/v3/build/runtime.test.d.ts +1 -0
- package/dist/esm/v3/build/runtime.test.js +32 -0
- package/dist/esm/v3/build/runtime.test.js.map +1 -0
- package/dist/esm/v3/config.d.ts +2 -2
- package/dist/esm/v3/index.d.ts +1 -0
- package/dist/esm/v3/index.js +1 -0
- package/dist/esm/v3/index.js.map +1 -1
- package/dist/esm/v3/jwt.d.ts +1 -0
- package/dist/esm/v3/jwt.js +6 -4
- package/dist/esm/v3/jwt.js.map +1 -1
- package/dist/esm/v3/runEngineWorker/consts.d.ts +1 -0
- package/dist/esm/v3/runEngineWorker/consts.js +3 -0
- package/dist/esm/v3/runEngineWorker/consts.js.map +1 -1
- package/dist/esm/v3/runEngineWorker/supervisor/http.d.ts +8 -5
- package/dist/esm/v3/runEngineWorker/supervisor/http.js +15 -5
- package/dist/esm/v3/runEngineWorker/supervisor/http.js.map +1 -1
- package/dist/esm/v3/runEngineWorker/supervisor/schemas.d.ts +40 -30
- package/dist/esm/v3/runEngineWorker/types.d.ts +1 -0
- package/dist/esm/v3/runEngineWorker/workload/http.d.ts +1 -0
- package/dist/esm/v3/runEngineWorker/workload/schemas.d.ts +35 -30
- package/dist/esm/v3/runMetadata/operations.d.ts +1 -1
- package/dist/esm/v3/runMetadata/operations.js +7 -0
- package/dist/esm/v3/runMetadata/operations.js.map +1 -1
- package/dist/esm/v3/schemas/api.d.ts +64 -17
- package/dist/esm/v3/schemas/api.js +17 -0
- package/dist/esm/v3/schemas/api.js.map +1 -1
- package/dist/esm/v3/schemas/build.d.ts +23 -21
- package/dist/esm/v3/schemas/build.js +8 -1
- package/dist/esm/v3/schemas/build.js.map +1 -1
- package/dist/esm/v3/schemas/checkpoints.d.ts +5 -0
- package/dist/esm/v3/schemas/common.d.ts +121 -115
- package/dist/esm/v3/schemas/common.js +20 -5
- package/dist/esm/v3/schemas/common.js.map +1 -1
- package/dist/esm/v3/schemas/messages.d.ts +35 -35
- package/dist/esm/v3/schemas/runEngine.d.ts +5 -0
- package/dist/esm/v3/schemas/runEngine.js +2 -0
- package/dist/esm/v3/schemas/runEngine.js.map +1 -1
- package/dist/esm/v3/utils/flattenAttributes.js +11 -2
- package/dist/esm/v3/utils/flattenAttributes.js.map +1 -1
- package/dist/esm/v3/workloadDeploymentToken.d.ts +68 -0
- package/dist/esm/v3/workloadDeploymentToken.js +66 -0
- package/dist/esm/v3/workloadDeploymentToken.js.map +1 -0
- package/dist/esm/v3/workloadDeploymentToken.test.d.ts +1 -0
- package/dist/esm/v3/workloadDeploymentToken.test.js +108 -0
- package/dist/esm/v3/workloadDeploymentToken.test.js.map +1 -0
- package/dist/esm/version.js +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,68 @@
|
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
/**
|
|
3
|
+
* Signed, deployment-scoped token carried in the TRIGGER_DEPLOYMENT_ID env var to identify a run
|
|
4
|
+
* controller. Long-lived identity token, not a rotating credential; the `ver` claim allows a future
|
|
5
|
+
* format revision.
|
|
6
|
+
*/
|
|
7
|
+
export declare const WORKLOAD_DEPLOYMENT_TOKEN_VERSION: 1;
|
|
8
|
+
export declare const WorkloadDeploymentTokenClaims: z.ZodObject<{
|
|
9
|
+
ver: z.ZodLiteral<1>;
|
|
10
|
+
/** Deployment friendlyId (deployment_xxxx). */
|
|
11
|
+
deployment: z.ZodString;
|
|
12
|
+
deployment_version: z.ZodString;
|
|
13
|
+
environment_id: z.ZodString;
|
|
14
|
+
environment_type: z.ZodString;
|
|
15
|
+
org_id: z.ZodString;
|
|
16
|
+
project_id: z.ZodString;
|
|
17
|
+
exp: z.ZodNumber;
|
|
18
|
+
}, "strip", z.ZodTypeAny, {
|
|
19
|
+
deployment: string;
|
|
20
|
+
ver: 1;
|
|
21
|
+
deployment_version: string;
|
|
22
|
+
environment_id: string;
|
|
23
|
+
environment_type: string;
|
|
24
|
+
org_id: string;
|
|
25
|
+
project_id: string;
|
|
26
|
+
exp: number;
|
|
27
|
+
}, {
|
|
28
|
+
deployment: string;
|
|
29
|
+
ver: 1;
|
|
30
|
+
deployment_version: string;
|
|
31
|
+
environment_id: string;
|
|
32
|
+
environment_type: string;
|
|
33
|
+
org_id: string;
|
|
34
|
+
project_id: string;
|
|
35
|
+
exp: number;
|
|
36
|
+
}>;
|
|
37
|
+
export type WorkloadDeploymentTokenClaims = z.infer<typeof WorkloadDeploymentTokenClaims>;
|
|
38
|
+
/** Claims the caller supplies; `ver` and `exp` are set by the minter. */
|
|
39
|
+
export type WorkloadDeploymentTokenInput = Omit<WorkloadDeploymentTokenClaims, "ver" | "exp">;
|
|
40
|
+
/**
|
|
41
|
+
* `expiresAtSeconds` is an absolute epoch (caller-supplied — the supervisor drives it). Combined with
|
|
42
|
+
* the omitted `iat`, the token is byte-deterministic per deployment: identical claims mint identical
|
|
43
|
+
* bytes, so the OTel `worker.id` the runner derives from it stays one value per deployment.
|
|
44
|
+
*/
|
|
45
|
+
export declare function mintWorkloadDeploymentToken(claims: WorkloadDeploymentTokenInput, secret: string, expiresAtSeconds: number): Promise<string>;
|
|
46
|
+
export type WorkloadDeploymentTokenVerification = {
|
|
47
|
+
ok: true;
|
|
48
|
+
claims: WorkloadDeploymentTokenClaims;
|
|
49
|
+
} | {
|
|
50
|
+
ok: false;
|
|
51
|
+
reason: "invalid_signature" | "malformed_claims";
|
|
52
|
+
error: string;
|
|
53
|
+
};
|
|
54
|
+
export declare function verifyWorkloadDeploymentToken(token: string, secret: string): Promise<WorkloadDeploymentTokenVerification>;
|
|
55
|
+
/**
|
|
56
|
+
* A legacy TRIGGER_DEPLOYMENT_ID is a bare friendlyId (deployment_xxxx); a minted token is a JWT of
|
|
57
|
+
* three non-empty base64url segments. Used by the dry-run to tell a pre-upgrade runner from a token.
|
|
58
|
+
*/
|
|
59
|
+
export declare function looksLikeWorkloadDeploymentToken(value: string): boolean;
|
|
60
|
+
export type DeploymentIdHeaderOutcome = "jwt_valid" | "jwt_invalid" | "legacy_bare";
|
|
61
|
+
/**
|
|
62
|
+
* Classify the value carried in the deployment-id header for the rollout metric, verifying the
|
|
63
|
+
* signature when it is JWT-shaped. Returns the claims on a valid token so callers avoid a second verify.
|
|
64
|
+
*/
|
|
65
|
+
export declare function classifyDeploymentIdHeader(value: string, secret: string): Promise<{
|
|
66
|
+
outcome: DeploymentIdHeaderOutcome;
|
|
67
|
+
claims?: WorkloadDeploymentTokenClaims;
|
|
68
|
+
}>;
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
import { generateJWT, validateJWT } from "./jwt.js";
|
|
3
|
+
/**
|
|
4
|
+
* Signed, deployment-scoped token carried in the TRIGGER_DEPLOYMENT_ID env var to identify a run
|
|
5
|
+
* controller. Long-lived identity token, not a rotating credential; the `ver` claim allows a future
|
|
6
|
+
* format revision.
|
|
7
|
+
*/
|
|
8
|
+
export const WORKLOAD_DEPLOYMENT_TOKEN_VERSION = 1;
|
|
9
|
+
export const WorkloadDeploymentTokenClaims = z.object({
|
|
10
|
+
ver: z.literal(WORKLOAD_DEPLOYMENT_TOKEN_VERSION),
|
|
11
|
+
/** Deployment friendlyId (deployment_xxxx). */
|
|
12
|
+
deployment: z.string(),
|
|
13
|
+
deployment_version: z.string(),
|
|
14
|
+
environment_id: z.string(),
|
|
15
|
+
environment_type: z.string(),
|
|
16
|
+
org_id: z.string(),
|
|
17
|
+
project_id: z.string(),
|
|
18
|
+
exp: z.number(),
|
|
19
|
+
});
|
|
20
|
+
/**
|
|
21
|
+
* `expiresAtSeconds` is an absolute epoch (caller-supplied — the supervisor drives it). Combined with
|
|
22
|
+
* the omitted `iat`, the token is byte-deterministic per deployment: identical claims mint identical
|
|
23
|
+
* bytes, so the OTel `worker.id` the runner derives from it stays one value per deployment.
|
|
24
|
+
*/
|
|
25
|
+
export async function mintWorkloadDeploymentToken(claims, secret, expiresAtSeconds) {
|
|
26
|
+
return generateJWT({
|
|
27
|
+
secretKey: secret,
|
|
28
|
+
payload: { ver: WORKLOAD_DEPLOYMENT_TOKEN_VERSION, ...claims },
|
|
29
|
+
expirationTime: expiresAtSeconds,
|
|
30
|
+
omitIssuedAt: true,
|
|
31
|
+
});
|
|
32
|
+
}
|
|
33
|
+
export async function verifyWorkloadDeploymentToken(token, secret) {
|
|
34
|
+
const result = await validateJWT(token, secret);
|
|
35
|
+
if (!result.ok) {
|
|
36
|
+
return { ok: false, reason: "invalid_signature", error: result.error };
|
|
37
|
+
}
|
|
38
|
+
const parsed = WorkloadDeploymentTokenClaims.safeParse(result.payload);
|
|
39
|
+
if (!parsed.success) {
|
|
40
|
+
return { ok: false, reason: "malformed_claims", error: parsed.error.message };
|
|
41
|
+
}
|
|
42
|
+
return { ok: true, claims: parsed.data };
|
|
43
|
+
}
|
|
44
|
+
/**
|
|
45
|
+
* A legacy TRIGGER_DEPLOYMENT_ID is a bare friendlyId (deployment_xxxx); a minted token is a JWT of
|
|
46
|
+
* three non-empty base64url segments. Used by the dry-run to tell a pre-upgrade runner from a token.
|
|
47
|
+
*/
|
|
48
|
+
export function looksLikeWorkloadDeploymentToken(value) {
|
|
49
|
+
const parts = value.split(".");
|
|
50
|
+
return parts.length === 3 && parts.every((part) => part.length > 0);
|
|
51
|
+
}
|
|
52
|
+
/**
|
|
53
|
+
* Classify the value carried in the deployment-id header for the rollout metric, verifying the
|
|
54
|
+
* signature when it is JWT-shaped. Returns the claims on a valid token so callers avoid a second verify.
|
|
55
|
+
*/
|
|
56
|
+
export async function classifyDeploymentIdHeader(value, secret) {
|
|
57
|
+
if (!looksLikeWorkloadDeploymentToken(value)) {
|
|
58
|
+
return { outcome: "legacy_bare" };
|
|
59
|
+
}
|
|
60
|
+
const result = await verifyWorkloadDeploymentToken(value, secret);
|
|
61
|
+
if (result.ok) {
|
|
62
|
+
return { outcome: "jwt_valid", claims: result.claims };
|
|
63
|
+
}
|
|
64
|
+
return { outcome: "jwt_invalid" };
|
|
65
|
+
}
|
|
66
|
+
//# sourceMappingURL=workloadDeploymentToken.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"workloadDeploymentToken.js","sourceRoot":"","sources":["../../../src/v3/workloadDeploymentToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAU,CAAC;AAE5D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;IACjD,+CAA+C;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC;AAOH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAoC,EACpC,MAAc,EACd,gBAAwB;IAExB,OAAO,WAAW,CAAC;QACjB,SAAS,EAAE,MAAM;QACjB,OAAO,EAAE,EAAE,GAAG,EAAE,iCAAiC,EAAE,GAAG,MAAM,EAAE;QAC9D,cAAc,EAAE,gBAAgB;QAChC,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;AACL,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAa,EACb,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEhD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAChF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAAa;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAID;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAa,EACb,MAAc;IAEd,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAElE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export {};
|
|
@@ -0,0 +1,108 @@
|
|
|
1
|
+
import { describe, expect, it } from "vitest";
|
|
2
|
+
import { generateJWT } from "./jwt.js";
|
|
3
|
+
import { classifyDeploymentIdHeader, looksLikeWorkloadDeploymentToken, mintWorkloadDeploymentToken, verifyWorkloadDeploymentToken, WORKLOAD_DEPLOYMENT_TOKEN_VERSION, } from "./workloadDeploymentToken.js";
|
|
4
|
+
const SECRET = "test-workload-token-secret";
|
|
5
|
+
const EXP = Math.floor(Date.UTC(2032, 0, 1) / 1000);
|
|
6
|
+
const claims = {
|
|
7
|
+
deployment: "deployment_abc123",
|
|
8
|
+
deployment_version: "20260709.1",
|
|
9
|
+
environment_id: "env_1",
|
|
10
|
+
environment_type: "PRODUCTION",
|
|
11
|
+
org_id: "org_1",
|
|
12
|
+
project_id: "proj_1",
|
|
13
|
+
};
|
|
14
|
+
describe("workloadDeploymentToken", () => {
|
|
15
|
+
it("mints a token that verifies and round-trips every claim", async () => {
|
|
16
|
+
const token = await mintWorkloadDeploymentToken(claims, SECRET, EXP);
|
|
17
|
+
const result = await verifyWorkloadDeploymentToken(token, SECRET);
|
|
18
|
+
expect(result.ok).toBe(true);
|
|
19
|
+
if (!result.ok)
|
|
20
|
+
return;
|
|
21
|
+
expect(result.claims.ver).toBe(WORKLOAD_DEPLOYMENT_TOKEN_VERSION);
|
|
22
|
+
expect(result.claims.deployment).toBe(claims.deployment);
|
|
23
|
+
expect(result.claims.deployment_version).toBe(claims.deployment_version);
|
|
24
|
+
expect(result.claims.environment_id).toBe(claims.environment_id);
|
|
25
|
+
expect(result.claims.environment_type).toBe(claims.environment_type);
|
|
26
|
+
expect(result.claims.org_id).toBe(claims.org_id);
|
|
27
|
+
expect(result.claims.project_id).toBe(claims.project_id);
|
|
28
|
+
});
|
|
29
|
+
it("sets the caller-supplied absolute exp", async () => {
|
|
30
|
+
const token = await mintWorkloadDeploymentToken(claims, SECRET, EXP);
|
|
31
|
+
const result = await verifyWorkloadDeploymentToken(token, SECRET);
|
|
32
|
+
expect(result.ok).toBe(true);
|
|
33
|
+
if (!result.ok)
|
|
34
|
+
return;
|
|
35
|
+
expect(result.claims.exp).toBe(EXP);
|
|
36
|
+
});
|
|
37
|
+
it("mints byte-identical tokens for identical claims (deterministic, no iat)", async () => {
|
|
38
|
+
const a = await mintWorkloadDeploymentToken(claims, SECRET, EXP);
|
|
39
|
+
const b = await mintWorkloadDeploymentToken(claims, SECRET, EXP);
|
|
40
|
+
expect(a).toBe(b);
|
|
41
|
+
const result = await verifyWorkloadDeploymentToken(a, SECRET);
|
|
42
|
+
expect(result.ok).toBe(true);
|
|
43
|
+
if (!result.ok)
|
|
44
|
+
return;
|
|
45
|
+
expect(result.claims.iat).toBeUndefined();
|
|
46
|
+
});
|
|
47
|
+
it("rejects a token signed with a different secret", async () => {
|
|
48
|
+
const token = await mintWorkloadDeploymentToken(claims, SECRET, EXP);
|
|
49
|
+
const result = await verifyWorkloadDeploymentToken(token, "wrong-secret");
|
|
50
|
+
expect(result.ok).toBe(false);
|
|
51
|
+
if (result.ok)
|
|
52
|
+
return;
|
|
53
|
+
expect(result.reason).toBe("invalid_signature");
|
|
54
|
+
});
|
|
55
|
+
it("rejects a tampered token", async () => {
|
|
56
|
+
const token = await mintWorkloadDeploymentToken(claims, SECRET, EXP);
|
|
57
|
+
const [header, payload, signature] = token.split(".");
|
|
58
|
+
const tampered = `${header}.${payload}x.${signature}`;
|
|
59
|
+
const result = await verifyWorkloadDeploymentToken(tampered, SECRET);
|
|
60
|
+
expect(result.ok).toBe(false);
|
|
61
|
+
});
|
|
62
|
+
it("rejects a valid JWT that is missing required claims", async () => {
|
|
63
|
+
// Signed with the right secret, but not a workload deployment token.
|
|
64
|
+
const token = await generateJWT({
|
|
65
|
+
secretKey: SECRET,
|
|
66
|
+
payload: { foo: "bar" },
|
|
67
|
+
expirationTime: "1825d",
|
|
68
|
+
});
|
|
69
|
+
const result = await verifyWorkloadDeploymentToken(token, SECRET);
|
|
70
|
+
expect(result.ok).toBe(false);
|
|
71
|
+
if (result.ok)
|
|
72
|
+
return;
|
|
73
|
+
expect(result.reason).toBe("malformed_claims");
|
|
74
|
+
});
|
|
75
|
+
describe("looksLikeWorkloadDeploymentToken", () => {
|
|
76
|
+
it("is true for a minted token", async () => {
|
|
77
|
+
const token = await mintWorkloadDeploymentToken(claims, SECRET, EXP);
|
|
78
|
+
expect(looksLikeWorkloadDeploymentToken(token)).toBe(true);
|
|
79
|
+
});
|
|
80
|
+
it("is false for a legacy bare friendlyId", () => {
|
|
81
|
+
expect(looksLikeWorkloadDeploymentToken("deployment_abc123")).toBe(false);
|
|
82
|
+
});
|
|
83
|
+
it("is false for empty and malformed values", () => {
|
|
84
|
+
expect(looksLikeWorkloadDeploymentToken("")).toBe(false);
|
|
85
|
+
expect(looksLikeWorkloadDeploymentToken("a.b")).toBe(false);
|
|
86
|
+
expect(looksLikeWorkloadDeploymentToken("a..c")).toBe(false);
|
|
87
|
+
});
|
|
88
|
+
});
|
|
89
|
+
describe("classifyDeploymentIdHeader", () => {
|
|
90
|
+
it("classifies a minted token as jwt_valid and returns claims", async () => {
|
|
91
|
+
const token = await mintWorkloadDeploymentToken(claims, SECRET, EXP);
|
|
92
|
+
const result = await classifyDeploymentIdHeader(token, SECRET);
|
|
93
|
+
expect(result.outcome).toBe("jwt_valid");
|
|
94
|
+
expect(result.claims?.deployment).toBe(claims.deployment);
|
|
95
|
+
});
|
|
96
|
+
it("classifies a JWT with a bad signature as jwt_invalid", async () => {
|
|
97
|
+
const token = await mintWorkloadDeploymentToken(claims, SECRET, EXP);
|
|
98
|
+
const result = await classifyDeploymentIdHeader(token, "wrong-secret");
|
|
99
|
+
expect(result.outcome).toBe("jwt_invalid");
|
|
100
|
+
expect(result.claims).toBeUndefined();
|
|
101
|
+
});
|
|
102
|
+
it("classifies a bare friendlyId as legacy_bare", async () => {
|
|
103
|
+
const result = await classifyDeploymentIdHeader("deployment_abc123", SECRET);
|
|
104
|
+
expect(result.outcome).toBe("legacy_bare");
|
|
105
|
+
});
|
|
106
|
+
});
|
|
107
|
+
});
|
|
108
|
+
//# sourceMappingURL=workloadDeploymentToken.test.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"workloadDeploymentToken.test.js","sourceRoot":"","sources":["../../../src/v3/workloadDeploymentToken.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,GAElC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,GAAG,4BAA4B,CAAC;AAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAEpD,MAAM,MAAM,GAAiC;IAC3C,UAAU,EAAE,mBAAmB;IAC/B,kBAAkB,EAAE,YAAY;IAChC,cAAc,EAAE,OAAO;IACvB,gBAAgB,EAAE,YAAY;IAC9B,MAAM,EAAE,OAAO;IACf,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QAEvB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QAEvB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,CAAC,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAElB,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,CAAE,MAAM,CAAC,MAAkC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO;QACtB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC;YAC9B,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;YACvB,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO;QACtB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACrE,MAAM,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,gCAAgC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5D,MAAM,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YACvE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YAC7E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
package/dist/esm/version.js
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
export const VERSION = "4.5.
|
|
1
|
+
export const VERSION = "4.5.6";
|
|
2
2
|
//# sourceMappingURL=version.js.map
|