@vertesia/workflow 1.4.0 → 1.5.0-dev.20260713.151751Z

package/src/activities/notifyWebhook.ts

@@ -1,4 +1,4 @@
-import { log } from '@temporalio/activity';
+import { ApplicationFailure, log } from '@temporalio/activity';
 import { VertesiaClient } from '@vertesia/client';
 import {
     ApiVersions,
@@ -9,6 +9,7 @@ import {
 } from '@vertesia/common';
 import { setupActivity } from '../dsl/setup/ActivityContext.js';
 import { WorkflowParamNotFoundError } from '../errors.js';
+import { safeFetch, URLValidationError } from '../security/ssrf.js';
 import { getVertesiaClientOptions } from '../utils/client.js';
 
 export interface NotifyWebhookParams {
@@ -18,9 +19,11 @@ export interface NotifyWebhookParams {
     workflow_run_id: string; //The ID of the specific workflow run sending the notification
     event_name: string; //The event that triggered the notification (e.g. "completed", "failed", etc.)
     detail?: Record<string, unknown>; // additional data about the event if any. It will be send to the webhook when using POST
+    body?: string; // raw request body. When set, it bypasses workflow notification payload formatting.
     //target_url: string; //URL to send the notification to
     method: 'GET' | 'POST'; //HTTP method to use
     headers?: Record<string, string>; // additional headers to send
+    timeout_ms?: number;
 }
 
 export interface WebhookNotificationPayload {
@@ -41,10 +44,28 @@ export interface NotifyWebhookResult {
     url: string;
 }
 
+function validationStatusCode(error: unknown): number | undefined {
+    if (typeof error !== 'object' || error === null) {
+        return undefined;
+    }
+    const record = error as { statusCode?: unknown; status?: unknown; code?: unknown };
+    const status = record.statusCode ?? record.status ?? record.code;
+    return typeof status === 'number' ? status : undefined;
+}
+
+function isNonRetryableUrlValidationError(error: unknown): boolean {
+    const status = validationStatusCode(error);
+    if (status !== undefined) {
+        return status >= 400 && status < 500;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return /blocked|not allowed|forbidden|invalid url|internal hosts|private network|metadata/i.test(message);
+}
+
 export async function notifyWebhook(
     payload: DSLActivityExecutionPayload<NotifyWebhookParams>,
 ): Promise<NotifyWebhookResult> {
-    const { params } = await setupActivity<NotifyWebhookParams>(payload);
+    const { params, client } = await setupActivity<NotifyWebhookParams>(payload);
     const { webhook, method, headers: defaultHeaders } = params;
     // resolve the url and the api version of the webhook
     let target_url: string, version: number | undefined;
@@ -57,25 +78,73 @@ export async function notifyWebhook(
 
     if (!target_url) throw new WorkflowParamNotFoundError('target_url');
 
+    try {
+        await client.apps.validateUrl(target_url);
+    } catch (err: unknown) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (!isNonRetryableUrlValidationError(err)) {
+            log.warn('URL validation preflight failed; retrying webhook notification', {
+                url: target_url,
+                workflow_id: params.workflow_id,
+                workflow_run_id: params.workflow_run_id,
+                error: message,
+            });
+            throw err;
+        }
+        log.warn('URL validation blocked webhook endpoint', {
+            url: target_url,
+            workflow_id: params.workflow_id,
+            workflow_run_id: params.workflow_run_id,
+            error: message,
+        });
+        throw ApplicationFailure.create({
+            message: `Webhook endpoint blocked: ${message}`,
+            nonRetryable: true,
+        });
+    }
+
     const hasBody = method === 'POST'; //body is sent only for POST, always includes workflow info
 
     const headers = {
         ...defaultHeaders,
     };
-    if (hasBody) {
+    if (hasBody && !hasHeader(headers, 'content-type')) {
         headers['Content-Type'] = 'application/json';
     }
-    const body = hasBody ? await createRequestBody(payload, params, version) : undefined;
+    const body = params.body ?? (hasBody ? await createRequestBody(payload, params, version) : undefined);
 
     log.info(`Notifying webhook at ${target_url}`);
-    const res = await fetch(target_url, {
-        method,
-        body,
-        headers,
-    }).catch((err) => {
-        log.error(`An error occurred while notifying webhook at ${target_url}`, { err });
-        throw err;
-    });
+    const timeoutMs = typeof params.timeout_ms === 'number' && params.timeout_ms > 0 ? params.timeout_ms : undefined;
+    const controller = timeoutMs ? new AbortController() : undefined;
+    const timeout = timeoutMs ? setTimeout(() => controller?.abort(), timeoutMs) : undefined;
+    let res: Response;
+    try {
+        res = await safeFetch(target_url, {
+            method,
+            body,
+            headers,
+            ...(controller ? { signal: controller.signal } : {}),
+        }).catch((err: unknown) => {
+            if (err instanceof URLValidationError) {
+                log.warn('Redirect blocked on webhook endpoint', {
+                    url: target_url,
+                    workflow_id: params.workflow_id,
+                    workflow_run_id: params.workflow_run_id,
+                    error: err.message,
+                });
+                throw ApplicationFailure.create({
+                    message: `Webhook endpoint blocked: ${err.message}`,
+                    nonRetryable: true,
+                });
+            }
+            log.error(`An error occurred while notifying webhook at ${target_url}`, { err });
+            throw err;
+        });
+    } finally {
+        if (timeout) {
+            clearTimeout(timeout);
+        }
+    }
 
     if (!res.ok) {
         log.warn(`Webhook endpoint ${target_url} returned an error - ${res.status} ${res.statusText}`, {
@@ -100,6 +169,11 @@ export async function notifyWebhook(
     return { status: res.status, message: res.statusText, url: res.url };
 }
 
+function hasHeader(headers: Record<string, string>, name: string): boolean {
+    const lowerName = name.toLowerCase();
+    return Object.keys(headers).some((header) => header.toLowerCase() === lowerName);
+}
+
 // --------------------------------------
 // Data provider for webhooks
 // this allows to customize the payload sent to the webhook depending on the

package/src/bulk-import.ts

@@ -93,6 +93,7 @@ export interface BulkImportParams {
     partitionSize?: number;
     dryRun?: boolean;
     updateByContentSource?: boolean;
+    /** @deprecated Events are now always emitted. This suppresses the Temporal-backed delivery targets (workflow, agent, and process) — webhook deliveries still fire. */
     skipWorkflows?: boolean;
     /**
      * Processing priority for the document-processing workflows triggered by created objects.

package/src/conversion/TextractProcessor.ts

@@ -136,7 +136,7 @@ export class TextractProcessor {
                                 for (const cellRel of cell.Relationships) {
                                     if (
                                         cellRel.Type === 'CHILD' &&
-                                        // biome-ignore lint/style/noNonNullAssertion: intentional non-null assertion; TS can't prove narrowing here
+                                        // biome-ignore lint/style/noNonNullAssertion: a Textract word block always has an Id; the SDK type marks Block.Id optional and Array.includes requires a string
                                         cellRel.Ids?.includes(wordBlock.Id!)
                                     ) {
                                         return true;
@@ -256,14 +256,14 @@ export class TextractProcessor {
             FeatureTypes: ['TABLES'],
         });
         const response = await this.textractClient.send(command);
-        // biome-ignore lint/style/noNonNullAssertion: intentional non-null assertion; TS can't prove narrowing here
+        // biome-ignore lint/style/noNonNullAssertion: a successful StartDocumentAnalysis response always includes JobId; the SDK type marks it optional
         return response.JobId!;
     }
 
     async checkJobStatus(jobId: string): Promise<string> {
         const command = new GetDocumentAnalysisCommand({ JobId: jobId });
         const response = await this.textractClient.send(command);
-        // biome-ignore lint/style/noNonNullAssertion: intentional non-null assertion; TS can't prove narrowing here
+        // biome-ignore lint/style/noNonNullAssertion: a GetDocumentAnalysis response always includes JobStatus; the SDK type marks it optional
         return response.JobStatus!;
     }
 
@@ -342,7 +342,7 @@ export class TextractProcessor {
         // Create blocks map
         const blocksMap: BlocksMap = {};
         for (const block of allBlocks) {
-            // biome-ignore lint/style/noNonNullAssertion: intentional non-null assertion; TS can't prove narrowing here
+            // biome-ignore lint/style/noNonNullAssertion: every Textract block carries an Id used as the map key; the SDK type marks Block.Id optional
             blocksMap[block.Id!] = block;
         }
 

package/src/conversion/image.test.ts

@@ -116,4 +116,28 @@ describe('ImageMagick image resizing', () => {
         // Check that interlace is disabled (should be 'none' or empty string)
         expect(['none', '']).to.include(interlaceMode);
     });
+
+    test('should apply EXIF orientation before resizing and stripping metadata', async () => {
+        const max_hw = 100;
+        const format = 'jpeg';
+        const inputImagePath = path.join(__dirname, '../../fixtures', 'synthetic-exif-righttop.jpg');
+
+        // Generated from synthetic pixels with only EXIF Orientation=6 added.
+        const { stdout: sourceStdout } = await execAsync(`identify -format "%w %h %[orientation]" "${inputImagePath}"`);
+        const [sourceWidth, sourceHeight, sourceOrientation] = sourceStdout.trim().split(' ');
+        expect(parseInt(sourceWidth, 10)).to.equal(120);
+        expect(parseInt(sourceHeight, 10)).to.equal(180);
+        expect(sourceOrientation).to.equal('RightTop');
+
+        const resizedImagePath = await imageResizer(inputImagePath, max_hw, format);
+
+        expect(fs.existsSync(resizedImagePath)).toBe(true);
+
+        const { stdout } = await execAsync(`identify -format "%w %h %[orientation]" "${resizedImagePath}"`);
+        const [width, height, orientation] = stdout.trim().split(' ');
+
+        expect(parseInt(width, 10)).to.equal(100);
+        expect(parseInt(height, 10)).to.equal(67);
+        expect(['Undefined', 'TopLeft']).to.include(orientation);
+    });
 });

package/src/conversion/image.ts

@@ -84,6 +84,9 @@ export async function imageResizer(
         // Add input after JPEG shrink-on-load optimization so ImageMagick can apply it while decoding.
         args.push(inputPath);
 
+        // Apply EXIF orientation to pixels before stripping metadata or resizing.
+        args.push('-auto-orient');
+
         // Remove metadata
         args.push('-strip');
 

package/src/dsl/setup/fetch/DataProvider.ts

@@ -38,9 +38,9 @@ export abstract class DataProvider {
     ) {}
     async fetch(payload: FindPayload) {
         let results = await this.doFetch(payload);
-        if (payload.select && !this.isProjectionSupported) {
-            // biome-ignore lint/style/noNonNullAssertion: intentional non-null assertion; TS can't prove narrowing here
-            results = results.map((result: Record<string, unknown>) => applyProjection(result, payload.select!));
+        const select = payload.select;
+        if (select && !this.isProjectionSupported) {
+            results = results.map((result: Record<string, unknown>) => applyProjection(result, select));
         }
         return results;
     }

package/src/index.ts

@@ -10,6 +10,7 @@ export * from './activities/advanced/createDocumentTypeFromInteractionRun.js';
 export * from './activities/advanced/createOrUpdateDocumentFromInteractionRun.js';
 export * from './activities/advanced/updateDocumentFromInteractionRun.js';
 export * from './activities/chunkDocument.js';
+export * from './activities/detectDocumentLanguage.js';
 export * from './activities/executeInteraction.js';
 export * from './activities/extractDocumentText.js';
 export * from './activities/generateDocumentProperties.js';

package/src/system/notifyWebhookWorkflow.ts

@@ -16,9 +16,17 @@ const { notifyWebhook } = dslProxyActivities<typeof activities>('notifyWebhookWo
 });
 
 export interface NotifyWebhookWorfklowParams {
-    workflow_type: string;
-    endpoints: (string | WebHookSpec)[];
-    data: Record<string, unknown>;
+    workflow_type?: string;
+    endpoints?: (string | WebHookSpec)[];
+    data?: Record<string, unknown>;
+    requests?: NotifyWebhookRequest[];
+}
+
+export interface NotifyWebhookRequest {
+    url: string;
+    body: string;
+    headers?: Record<string, string>;
+    timeout_ms?: number;
 }
 
 export async function notifyWebhookWorkflow(
@@ -32,6 +40,7 @@ export async function notifyWebhookWorkflow(
         webhook_data?: Record<string, unknown>;
     };
     const endpoints = legacyVars.endpoints ?? legacyVars.webhooks ?? [];
+    const requests = legacyVars.requests ?? [];
     const data = legacyVars.data ?? legacyVars.webhook_data ?? undefined;
     const workflow_type = vars.workflow_type ?? info.workflowType;
     const eventName = payload.event;
@@ -39,11 +48,29 @@ export async function notifyWebhookWorkflow(
     const workflowId = info.parent?.workflowId || info.workflowId;
     const workflowRunId = info.parent?.runId || info.runId;
 
-    if (!endpoints.length) {
+    if (!endpoints.length && !requests.length) {
         log.info(`No webhooks to notify`);
         return { notifications: [], message: 'No webhooks to notify' };
     }
 
+    for (const request of requests) {
+        const n = notifyWebhook(payload, {
+            webhook: request.url,
+            method: 'POST',
+            workflow_type,
+            workflow_id: workflowId,
+            workflow_run_id: workflowRunId,
+            event_name: eventName,
+            body: request.body,
+            headers: request.headers,
+            timeout_ms: request.timeout_ms,
+        }).then((res) => {
+            log.info(`Webhook notified at ${request.url} with response code: ${res.status}`, { res });
+            return res;
+        });
+        notifications.push(n);
+    }
+
     for (const ep of endpoints) {
         const n = notifyWebhook(payload, {
             webhook: ep,