@xemahq/temporal-runtime 0.9.0 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +28 -16
- package/dist/bin/controller-token-publisher.js +2 -2
- package/dist/bin/controller-token-publisher.js.map +1 -1
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -2
- package/dist/index.js.map +1 -1
- package/dist/lib/access-token.d.ts +1 -1
- package/dist/lib/access-token.d.ts.map +1 -1
- package/dist/lib/access-token.js +5 -7
- package/dist/lib/access-token.js.map +1 -1
- package/dist/lib/bounded-retry.d.ts +5 -0
- package/dist/lib/bounded-retry.d.ts.map +1 -1
- package/dist/lib/bounded-retry.js +10 -1
- package/dist/lib/bounded-retry.js.map +1 -1
- package/dist/lib/connection.d.ts +6 -10
- package/dist/lib/connection.d.ts.map +1 -1
- package/dist/lib/connection.js +23 -21
- package/dist/lib/connection.js.map +1 -1
- package/dist/lib/controller-token-publisher.d.ts +3 -2
- package/dist/lib/controller-token-publisher.d.ts.map +1 -1
- package/dist/lib/controller-token-publisher.js +5 -5
- package/dist/lib/controller-token-publisher.js.map +1 -1
- package/dist/lib/nexus-constants.d.ts +1 -0
- package/dist/lib/nexus-constants.d.ts.map +1 -1
- package/dist/lib/nexus-constants.js +2 -1
- package/dist/lib/nexus-constants.js.map +1 -1
- package/dist/lib/nexus-handler.d.ts +9 -1
- package/dist/lib/nexus-handler.d.ts.map +1 -1
- package/dist/lib/nexus-handler.js +22 -13
- package/dist/lib/nexus-handler.js.map +1 -1
- package/dist/lib/proactive-token-refresher.d.ts.map +1 -1
- package/dist/lib/proactive-token-refresher.js +5 -0
- package/dist/lib/proactive-token-refresher.js.map +1 -1
- package/dist/lib/workflow-credential-token-source.d.ts +24 -0
- package/dist/lib/workflow-credential-token-source.d.ts.map +1 -0
- package/dist/lib/workflow-credential-token-source.js +74 -0
- package/dist/lib/workflow-credential-token-source.js.map +1 -0
- package/package.json +4 -4
- package/dist/lib/client-credentials-token-source.d.ts +0 -23
- package/dist/lib/client-credentials-token-source.d.ts.map +0 -1
- package/dist/lib/client-credentials-token-source.js +0 -108
- package/dist/lib/client-credentials-token-source.js.map +0 -1
package/README.md
CHANGED
|
@@ -197,9 +197,11 @@ erasure does not finish before its deadline, the call throws.
|
|
|
197
197
|
### Connecting
|
|
198
198
|
|
|
199
199
|
Every worker and client connects to the frontend over TLS, verified against the
|
|
200
|
-
server CA, with a JWT bearer from
|
|
201
|
-
unauthenticated mode. The bearer
|
|
202
|
-
|
|
200
|
+
server CA, with a JWT bearer from identity-api's workflow authority. There is
|
|
201
|
+
no plaintext or unauthenticated mode. The bearer is minted from the pod's
|
|
202
|
+
projected ServiceAccount token (`POST /internal/workflow-credential`) and is
|
|
203
|
+
replaced before it expires. The pod names nothing but that attestation: the
|
|
204
|
+
authority derives the namespace and the audience.
|
|
203
205
|
|
|
204
206
|
```ts
|
|
205
207
|
import {
|
|
@@ -215,28 +217,38 @@ const client = await connectTemporalClient(options);
|
|
|
215
217
|
```
|
|
216
218
|
|
|
217
219
|
`temporalConnectionOptionsFromEnv` takes an injected reader and reads
|
|
218
|
-
`TEMPORAL_ADDRESS`, `TEMPORAL_TLS_CA_PATH`, `
|
|
219
|
-
`
|
|
220
|
-
|
|
221
|
-
`TEMPORAL_TLS_SERVER_NAME` and the
|
|
222
|
-
`TEMPORAL_TLS_CLIENT_KEY_PATH` pair, which are
|
|
220
|
+
`TEMPORAL_ADDRESS`, `TEMPORAL_TLS_CA_PATH`, `TEMPORAL_AUTH_IDENTITY_API_URL` and
|
|
221
|
+
`TEMPORAL_AUTH_ATTESTATION_FILE` (all required). The attestation file is the
|
|
222
|
+
projected ServiceAccount token, whose audience must equal the attester audience
|
|
223
|
+
identity-api declares. It also reads `TEMPORAL_TLS_SERVER_NAME` and the
|
|
224
|
+
`TEMPORAL_TLS_CLIENT_CERT_PATH` / `TEMPORAL_TLS_CLIENT_KEY_PATH` pair, which are
|
|
225
|
+
optional.
|
|
223
226
|
|
|
224
|
-
|
|
227
|
+
If identity-api refuses the attestation, the process fails closed: the connect
|
|
228
|
+
rejects (or, on a refresh, the process crashes) with a `TemporalCredentialRefusedError`
|
|
229
|
+
that carries identity-api's typed refusal code. A refusal is never retried and
|
|
230
|
+
there is no fallback credential.
|
|
231
|
+
|
|
232
|
+
### Keeping the workflow credential current
|
|
225
233
|
|
|
226
234
|
`ProactiveTokenRefresher` is the one refresh mechanism. The connections use it,
|
|
227
|
-
and so can any other holder of
|
|
235
|
+
and so can any other holder of the same credential:
|
|
228
236
|
|
|
229
237
|
```ts
|
|
230
238
|
const tokens = await ProactiveTokenRefresher.start({
|
|
231
|
-
source:
|
|
232
|
-
description: 'controller
|
|
239
|
+
source: createWorkflowCredentialTokenSource(temporalWorkflowCredentialFromEnv(env)),
|
|
240
|
+
description: 'controller token',
|
|
233
241
|
});
|
|
234
242
|
await tokens.subscribe((token) => writeSecret(token.value));
|
|
235
243
|
```
|
|
236
244
|
|
|
237
|
-
It refreshes at 75% of the
|
|
238
|
-
current
|
|
239
|
-
|
|
245
|
+
It refreshes at 75% of the credential's lifetime and retries with backoff while
|
|
246
|
+
the current one is still valid. If it expires with no replacement, it crashes
|
|
247
|
+
the process (or calls the `onFatal` you pass instead).
|
|
248
|
+
|
|
249
|
+
The Worker Controller token publisher (`xema-temporal-controller-token-publisher`)
|
|
250
|
+
writes the worker's own credential into the controller Secret: one credential
|
|
251
|
+
per ServiceAccount, no separate controller identity.
|
|
240
252
|
|
|
241
253
|
### Tests
|
|
242
254
|
|
|
@@ -249,7 +261,7 @@ runs the connection suite against it.
|
|
|
249
261
|
- `@nestjs/common` ^11
|
|
250
262
|
- `reflect-metadata` ^0.2
|
|
251
263
|
- `@xemahq/contracts` >=0.55.0
|
|
252
|
-
- `@xemahq/identity-client` >=0.
|
|
264
|
+
- `@xemahq/identity-client` >=0.18.0
|
|
253
265
|
|
|
254
266
|
## License
|
|
255
267
|
|
|
@@ -10,9 +10,9 @@ const logger = {
|
|
|
10
10
|
error: (message) => console.error(message),
|
|
11
11
|
};
|
|
12
12
|
async function main() {
|
|
13
|
-
const options = await (0, controller_token_publisher_1.controllerTokenPublisherOptionsFromEnv)((name) => process.env[name]);
|
|
13
|
+
const options = await (0, controller_token_publisher_1.controllerTokenPublisherOptionsFromEnv)((name) => process.env[name], { logger });
|
|
14
14
|
await (0, controller_token_publisher_1.startControllerTokenPublisher)(options, { logger });
|
|
15
|
-
logger.log(`Worker Controller token publisher: ${options.
|
|
15
|
+
logger.log(`Worker Controller token publisher: ${options.description} → ${options.target.namespace}/${options.target.secretName}#${options.target.secretKey}`);
|
|
16
16
|
}
|
|
17
17
|
void main();
|
|
18
18
|
//# sourceMappingURL=controller-token-publisher.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/bin/controller-token-publisher.ts"],"names":[],"mappings":";;;AAUA,kFAG2C;AAE3C,MAAM,MAAM,GAAG;IACb,GAAG,EAAE,CAAC,OAAe,EAAE,EAAE;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;IAChD,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;CACnD,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,MAAM,IAAA,mEAAsC,EAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/bin/controller-token-publisher.ts"],"names":[],"mappings":";;;AAUA,kFAG2C;AAE3C,MAAM,MAAM,GAAG;IACb,GAAG,EAAE,CAAC,OAAe,EAAE,EAAE;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;IAChD,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;CACnD,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,MAAM,IAAA,mEAAsC,EAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACtG,MAAM,IAAA,0DAA6B,EAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,sCAAsC,OAAO,CAAC,WAAW,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;AACjK,CAAC;AAKD,KAAK,IAAI,EAAE,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -2,7 +2,7 @@ export * from './lib/connection';
|
|
|
2
2
|
export * from './lib/controller-token-publisher';
|
|
3
3
|
export * from './lib/access-token';
|
|
4
4
|
export * from './lib/bounded-retry';
|
|
5
|
-
export * from './lib/
|
|
5
|
+
export * from './lib/workflow-credential-token-source';
|
|
6
6
|
export * from './lib/proactive-token-refresher';
|
|
7
7
|
export * from './lib/namespace';
|
|
8
8
|
export * from './lib/base-temporal-client.service';
|
|
@@ -15,7 +15,7 @@ export * from './lib/biome-worker';
|
|
|
15
15
|
export * from './lib/fairness';
|
|
16
16
|
export * from './lib/nexus-contract';
|
|
17
17
|
export * from './lib/nexus-handler';
|
|
18
|
-
export { NEXUS_CALLER_NOT_BOUND, NEXUS_ENDPOINTS_NOT_DEFINED, NEXUS_OPERATION_TIMED_OUT, NEXUS_ORG_MISSING, NEXUS_SERVICE_NOT_BOUND, nexusServiceKey, } from './lib/nexus-constants';
|
|
18
|
+
export { NEXUS_CALLER_NOT_BOUND, NEXUS_CALLER_UNVERIFIABLE, NEXUS_ENDPOINTS_NOT_DEFINED, NEXUS_OPERATION_TIMED_OUT, NEXUS_ORG_MISSING, NEXUS_SERVICE_NOT_BOUND, nexusServiceKey, } from './lib/nexus-constants';
|
|
19
19
|
export * from './lib/standalone-activity';
|
|
20
20
|
export * from './lib/auth-kind';
|
|
21
21
|
export * from './lib/service-http-client';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA8CA,cAAc,kBAAkB,CAAC;AACjC,cAAc,kCAAkC,CAAC;AACjD,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA8CA,cAAc,kBAAkB,CAAC;AACjC,cAAc,kCAAkC,CAAC;AACjD,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,iBAAiB,CAAC;AAChC,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -14,12 +14,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
|
14
14
|
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
15
|
};
|
|
16
16
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
-
exports.nexusServiceKey = exports.NEXUS_SERVICE_NOT_BOUND = exports.NEXUS_ORG_MISSING = exports.NEXUS_OPERATION_TIMED_OUT = exports.NEXUS_ENDPOINTS_NOT_DEFINED = exports.NEXUS_CALLER_NOT_BOUND = void 0;
|
|
17
|
+
exports.nexusServiceKey = exports.NEXUS_SERVICE_NOT_BOUND = exports.NEXUS_ORG_MISSING = exports.NEXUS_OPERATION_TIMED_OUT = exports.NEXUS_ENDPOINTS_NOT_DEFINED = exports.NEXUS_CALLER_UNVERIFIABLE = exports.NEXUS_CALLER_NOT_BOUND = void 0;
|
|
18
18
|
__exportStar(require("./lib/connection"), exports);
|
|
19
19
|
__exportStar(require("./lib/controller-token-publisher"), exports);
|
|
20
20
|
__exportStar(require("./lib/access-token"), exports);
|
|
21
21
|
__exportStar(require("./lib/bounded-retry"), exports);
|
|
22
|
-
__exportStar(require("./lib/
|
|
22
|
+
__exportStar(require("./lib/workflow-credential-token-source"), exports);
|
|
23
23
|
__exportStar(require("./lib/proactive-token-refresher"), exports);
|
|
24
24
|
__exportStar(require("./lib/namespace"), exports);
|
|
25
25
|
__exportStar(require("./lib/base-temporal-client.service"), exports);
|
|
@@ -34,6 +34,7 @@ __exportStar(require("./lib/nexus-contract"), exports);
|
|
|
34
34
|
__exportStar(require("./lib/nexus-handler"), exports);
|
|
35
35
|
var nexus_constants_1 = require("./lib/nexus-constants");
|
|
36
36
|
Object.defineProperty(exports, "NEXUS_CALLER_NOT_BOUND", { enumerable: true, get: function () { return nexus_constants_1.NEXUS_CALLER_NOT_BOUND; } });
|
|
37
|
+
Object.defineProperty(exports, "NEXUS_CALLER_UNVERIFIABLE", { enumerable: true, get: function () { return nexus_constants_1.NEXUS_CALLER_UNVERIFIABLE; } });
|
|
37
38
|
Object.defineProperty(exports, "NEXUS_ENDPOINTS_NOT_DEFINED", { enumerable: true, get: function () { return nexus_constants_1.NEXUS_ENDPOINTS_NOT_DEFINED; } });
|
|
38
39
|
Object.defineProperty(exports, "NEXUS_OPERATION_TIMED_OUT", { enumerable: true, get: function () { return nexus_constants_1.NEXUS_OPERATION_TIMED_OUT; } });
|
|
39
40
|
Object.defineProperty(exports, "NEXUS_ORG_MISSING", { enumerable: true, get: function () { return nexus_constants_1.NEXUS_ORG_MISSING; } });
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA8CA,mDAAiC;AACjC,mEAAiD;AACjD,qDAAmC;AACnC,sDAAoC;AACpC,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA8CA,mDAAiC;AACjC,mEAAiD;AACjD,qDAAmC;AACnC,sDAAoC;AACpC,yEAAuD;AACvD,kEAAgD;AAChD,kDAAgC;AAChC,qEAAmD;AACnD,8DAA4C;AAC5C,iEAA+C;AAC/C,+CAA6B;AAC7B,wDAAsC;AACtC,kEAAgD;AAChD,qDAAmC;AACnC,iDAA+B;AAC/B,uDAAqC;AACrC,sDAAoC;AACpC,yDAQ+B;AAP7B,yHAAA,sBAAsB,OAAA;AACtB,4HAAA,yBAAyB,OAAA;AACzB,8HAAA,2BAA2B,OAAA;AAC3B,4HAAA,yBAAyB,OAAA;AACzB,oHAAA,iBAAiB,OAAA;AACjB,0HAAA,uBAAuB,OAAA;AACvB,kHAAA,eAAe,OAAA;AAEjB,4DAA0C;AAC1C,kDAAgC;AAChC,4DAA0C;AAC1C,iDAA+B;AAC/B,0DAAwC;AACxC,oDAAkC;AAClC,qDAAmC"}
|
|
@@ -4,7 +4,7 @@ export interface AccessToken {
|
|
|
4
4
|
}
|
|
5
5
|
export type AccessTokenSource = () => Promise<AccessToken>;
|
|
6
6
|
export interface AccessTokenClaims {
|
|
7
|
-
readonly
|
|
7
|
+
readonly iat: number | undefined;
|
|
8
8
|
readonly exp: number | undefined;
|
|
9
9
|
}
|
|
10
10
|
export declare function decodeAccessTokenClaims(token: string): AccessTokenClaims;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../src/lib/access-token.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAQD,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAG3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,
|
|
1
|
+
{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../src/lib/access-token.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAQD,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAG3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAOD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAsBxE"}
|
package/dist/lib/access-token.js
CHANGED
|
@@ -18,13 +18,11 @@ function decodeAccessTokenClaims(token) {
|
|
|
18
18
|
throw new Error('Temporal access token payload is not a JSON object.');
|
|
19
19
|
}
|
|
20
20
|
const record = payload;
|
|
21
|
-
const
|
|
22
|
-
const aud = typeof rawAud === 'string'
|
|
23
|
-
? [rawAud]
|
|
24
|
-
: Array.isArray(rawAud)
|
|
25
|
-
? rawAud.filter((entry) => typeof entry === 'string')
|
|
26
|
-
: [];
|
|
21
|
+
const rawIat = record['iat'];
|
|
27
22
|
const rawExp = record['exp'];
|
|
28
|
-
return {
|
|
23
|
+
return {
|
|
24
|
+
iat: typeof rawIat === 'number' ? rawIat : undefined,
|
|
25
|
+
exp: typeof rawExp === 'number' ? rawExp : undefined,
|
|
26
|
+
};
|
|
29
27
|
}
|
|
30
28
|
//# sourceMappingURL=access-token.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../src/lib/access-token.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../src/lib/access-token.ts"],"names":[],"mappings":";;AA+BA,0DAsBC;AAtBD,SAAgB,uBAAuB,CAAC,KAAa;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4DAA4D,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO;QACL,GAAG,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACpD,GAAG,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KACrD,CAAC;AACJ,CAAC"}
|
|
@@ -12,6 +12,11 @@ export interface RetryClock {
|
|
|
12
12
|
export declare const SYSTEM_CLOCK: RetryClock;
|
|
13
13
|
export declare function backoffDelayMs(policy: BoundedRetryPolicy, failedAttempt: number): number;
|
|
14
14
|
export declare function sleep(clock: RetryClock, ms: number): Promise<void>;
|
|
15
|
+
export declare class PermanentFailureError extends Error {
|
|
16
|
+
constructor(message: string, options?: {
|
|
17
|
+
cause?: unknown;
|
|
18
|
+
});
|
|
19
|
+
}
|
|
15
20
|
export declare class BoundedRetryExhaustedError extends Error {
|
|
16
21
|
readonly operation: string;
|
|
17
22
|
readonly attempts: number;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bounded-retry.d.ts","sourceRoot":"","sources":["../../src/lib/bounded-retry.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAGD,eAAO,MAAM,4BAA4B,EAAE,kBAI1C,CAAC;AAGF,MAAM,WAAW,UAAU;IACzB,GAAG,IAAI,MAAM,CAAC;IACd,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;CACrC;AAED,eAAO,MAAM,YAAY,EAAE,UAU1B,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlE;AAGD,qBAAa,0BAA2B,SAAQ,KAAK;IAEjD,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBADhB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EACzB,KAAK,EAAE,OAAO;CAUjB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAOzE;AAOD,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,UAAU,EACjB,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,GAC/E,OAAO,CAAC,CAAC,CAAC,
|
|
1
|
+
{"version":3,"file":"bounded-retry.d.ts","sourceRoot":"","sources":["../../src/lib/bounded-retry.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAGD,eAAO,MAAM,4BAA4B,EAAE,kBAI1C,CAAC;AAGF,MAAM,WAAW,UAAU;IACzB,GAAG,IAAI,MAAM,CAAC;IACd,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;CACrC;AAED,eAAO,MAAM,YAAY,EAAE,UAU1B,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlE;AAOD,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAGD,qBAAa,0BAA2B,SAAQ,KAAK;IAEjD,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBADhB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EACzB,KAAK,EAAE,OAAO;CAUjB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAOzE;AAOD,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,UAAU,EACjB,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,GAC/E,OAAO,CAAC,CAAC,CAAC,CAgBZ"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.BoundedRetryExhaustedError = exports.SYSTEM_CLOCK = exports.DEFAULT_BOUNDED_RETRY_POLICY = void 0;
|
|
3
|
+
exports.BoundedRetryExhaustedError = exports.PermanentFailureError = exports.SYSTEM_CLOCK = exports.DEFAULT_BOUNDED_RETRY_POLICY = void 0;
|
|
4
4
|
exports.backoffDelayMs = backoffDelayMs;
|
|
5
5
|
exports.sleep = sleep;
|
|
6
6
|
exports.assertBoundedRetryPolicy = assertBoundedRetryPolicy;
|
|
@@ -27,6 +27,13 @@ function sleep(clock, ms) {
|
|
|
27
27
|
clock.setTimeout(resolve, ms);
|
|
28
28
|
});
|
|
29
29
|
}
|
|
30
|
+
class PermanentFailureError extends Error {
|
|
31
|
+
constructor(message, options) {
|
|
32
|
+
super(message, options);
|
|
33
|
+
this.name = 'PermanentFailureError';
|
|
34
|
+
}
|
|
35
|
+
}
|
|
36
|
+
exports.PermanentFailureError = PermanentFailureError;
|
|
30
37
|
class BoundedRetryExhaustedError extends Error {
|
|
31
38
|
operation;
|
|
32
39
|
attempts;
|
|
@@ -54,6 +61,8 @@ async function withBoundedRetry(operationName, operation, policy, clock, onAttem
|
|
|
54
61
|
return await operation();
|
|
55
62
|
}
|
|
56
63
|
catch (error) {
|
|
64
|
+
if (error instanceof PermanentFailureError)
|
|
65
|
+
throw error;
|
|
57
66
|
lastError = error;
|
|
58
67
|
if (attempt === policy.attempts)
|
|
59
68
|
break;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bounded-retry.js","sourceRoot":"","sources":["../../src/lib/bounded-retry.ts"],"names":[],"mappings":";;;AAyCA,wCAEC;AAED,sBAIC;
|
|
1
|
+
{"version":3,"file":"bounded-retry.js","sourceRoot":"","sources":["../../src/lib/bounded-retry.ts"],"names":[],"mappings":";;;AAyCA,wCAEC;AAED,sBAIC;AA+BD,4DAOC;AAOD,4CAsBC;AApGY,QAAA,4BAA4B,GAAuB;IAC9D,QAAQ,EAAE,CAAC;IACX,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,MAAM;CACnB,CAAC;AASW,QAAA,YAAY,GAAe;IACtC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAGxC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAuC,CAAC;CAChF,CAAC;AAEF,SAAgB,cAAc,CAAC,MAA0B,EAAE,aAAqB;IAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAgB,KAAK,CAAC,KAAiB,EAAE,EAAU;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AALD,sDAKC;AAGD,MAAa,0BAA2B,SAAQ,KAAK;IAExC;IACA;IAFX,YACW,SAAiB,EACjB,QAAgB,EACzB,KAAc;QAEd,KAAK,CACH,GAAG,SAAS,iBAAiB,QAAQ,gBACnC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,EAAE,KAAK,EAAE,CACV,CAAC;QATO,cAAS,GAAT,SAAS,CAAQ;QACjB,aAAQ,GAAR,QAAQ,CAAQ;QASzB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAdD,gEAcC;AAED,SAAgB,wBAAwB,CAAC,MAA0B;IACjE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAOM,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,SAA2B,EAC3B,MAA0B,EAC1B,KAAiB,EACjB,eAAgF;IAEhF,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB;gBAAE,MAAM,KAAK,CAAC;YACxD,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,OAAO,KAAK,MAAM,CAAC,QAAQ;gBAAE,MAAM;YACvC,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9C,eAAe,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,0BAA0B,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAClF,CAAC"}
|
package/dist/lib/connection.d.ts
CHANGED
|
@@ -1,14 +1,13 @@
|
|
|
1
1
|
import { Connection } from '@temporalio/client';
|
|
2
2
|
import { NativeConnection } from '@temporalio/worker';
|
|
3
|
-
import type { AccessTokenSource } from './access-token';
|
|
4
3
|
import { type BoundedRetryPolicy, type RetryClock } from './bounded-retry';
|
|
5
|
-
import { type ClientCredentialsDeps, type ClientCredentialsOptions } from './client-credentials-token-source';
|
|
6
4
|
import type { TemporalEnvReader } from './namespace';
|
|
7
5
|
import { ProactiveTokenRefresher, type TokenRefresherLogger } from './proactive-token-refresher';
|
|
6
|
+
import { type WorkflowCredentialDeps, type WorkflowCredentialOptions } from './workflow-credential-token-source';
|
|
8
7
|
export interface TemporalConnectionOptions {
|
|
9
8
|
readonly address: string;
|
|
10
9
|
readonly tls: TemporalTlsOptions;
|
|
11
|
-
readonly credentials:
|
|
10
|
+
readonly credentials: WorkflowCredentialOptions;
|
|
12
11
|
readonly connectRetry?: BoundedRetryPolicy;
|
|
13
12
|
}
|
|
14
13
|
export interface TemporalTlsOptions {
|
|
@@ -17,12 +16,11 @@ export interface TemporalTlsOptions {
|
|
|
17
16
|
readonly clientCertPath?: string;
|
|
18
17
|
readonly clientKeyPath?: string;
|
|
19
18
|
}
|
|
20
|
-
export interface TemporalConnectionDeps extends
|
|
19
|
+
export interface TemporalConnectionDeps extends WorkflowCredentialDeps {
|
|
21
20
|
readonly logger?: TokenRefresherLogger;
|
|
22
21
|
readonly clock?: RetryClock;
|
|
23
22
|
readonly onCredentialFailure?: (error: Error) => void;
|
|
24
23
|
readonly readFile?: (path: string) => Promise<Buffer>;
|
|
25
|
-
readonly tokenSource?: AccessTokenSource;
|
|
26
24
|
}
|
|
27
25
|
export interface TemporalWorkerConnection {
|
|
28
26
|
readonly connection: NativeConnection;
|
|
@@ -40,12 +38,10 @@ export declare const TEMPORAL_CONNECTION_ENV: {
|
|
|
40
38
|
readonly tlsServerName: "TEMPORAL_TLS_SERVER_NAME";
|
|
41
39
|
readonly tlsClientCertPath: "TEMPORAL_TLS_CLIENT_CERT_PATH";
|
|
42
40
|
readonly tlsClientKeyPath: "TEMPORAL_TLS_CLIENT_KEY_PATH";
|
|
43
|
-
readonly
|
|
44
|
-
readonly
|
|
45
|
-
readonly clientSecretFile: "TEMPORAL_AUTH_CLIENT_SECRET_FILE";
|
|
46
|
-
readonly audience: "TEMPORAL_AUTH_AUDIENCE";
|
|
41
|
+
readonly identityApiUrl: "TEMPORAL_AUTH_IDENTITY_API_URL";
|
|
42
|
+
readonly attestationFile: "TEMPORAL_AUTH_ATTESTATION_FILE";
|
|
47
43
|
};
|
|
48
|
-
export declare function
|
|
44
|
+
export declare function temporalWorkflowCredentialFromEnv(env: TemporalEnvReader): WorkflowCredentialOptions;
|
|
49
45
|
export declare function temporalConnectionOptionsFromEnv(env: TemporalEnvReader): TemporalConnectionOptions;
|
|
50
46
|
export declare function validateTemporalConnectionOptions(options: TemporalConnectionOptions): void;
|
|
51
47
|
export declare function connectTemporalWorker(options: TemporalConnectionOptions, deps?: TemporalConnectionDeps): Promise<TemporalWorkerConnection>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/lib/connection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,
|
|
1
|
+
{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/lib/connection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,oCAAoC,CAAC;AAsB5C,MAAM,WAAW,yBAAyB;IAExC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAEhD,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAGD,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAE5B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACvD;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IAEzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IAEzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAGD,eAAO,MAAM,uBAAuB;;;;;;;;CAQ1B,CAAC;AAoCX,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,iBAAiB,GAAG,yBAAyB,CAOnG;AASD,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,iBAAiB,GAAG,yBAAyB,CAyBlG;AAGD,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAe1F;AA6DD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,yBAAyB,EAClC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CA8BnC;AAOD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,yBAAyB,EAClC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CAgCnC"}
|
package/dist/lib/connection.js
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.TEMPORAL_CONNECTION_ENV = void 0;
|
|
4
|
-
exports.
|
|
4
|
+
exports.temporalWorkflowCredentialFromEnv = temporalWorkflowCredentialFromEnv;
|
|
5
5
|
exports.temporalConnectionOptionsFromEnv = temporalConnectionOptionsFromEnv;
|
|
6
6
|
exports.validateTemporalConnectionOptions = validateTemporalConnectionOptions;
|
|
7
7
|
exports.connectTemporalWorker = connectTemporalWorker;
|
|
@@ -10,25 +10,29 @@ const promises_1 = require("node:fs/promises");
|
|
|
10
10
|
const client_1 = require("@temporalio/client");
|
|
11
11
|
const worker_1 = require("@temporalio/worker");
|
|
12
12
|
const bounded_retry_1 = require("./bounded-retry");
|
|
13
|
-
const client_credentials_token_source_1 = require("./client-credentials-token-source");
|
|
14
13
|
const proactive_token_refresher_1 = require("./proactive-token-refresher");
|
|
14
|
+
const workflow_credential_token_source_1 = require("./workflow-credential-token-source");
|
|
15
15
|
exports.TEMPORAL_CONNECTION_ENV = {
|
|
16
16
|
address: 'TEMPORAL_ADDRESS',
|
|
17
17
|
tlsCaPath: 'TEMPORAL_TLS_CA_PATH',
|
|
18
18
|
tlsServerName: 'TEMPORAL_TLS_SERVER_NAME',
|
|
19
19
|
tlsClientCertPath: 'TEMPORAL_TLS_CLIENT_CERT_PATH',
|
|
20
20
|
tlsClientKeyPath: 'TEMPORAL_TLS_CLIENT_KEY_PATH',
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
clientSecretFile: 'TEMPORAL_AUTH_CLIENT_SECRET_FILE',
|
|
24
|
-
audience: 'TEMPORAL_AUTH_AUDIENCE',
|
|
21
|
+
identityApiUrl: 'TEMPORAL_AUTH_IDENTITY_API_URL',
|
|
22
|
+
attestationFile: 'TEMPORAL_AUTH_ATTESTATION_FILE',
|
|
25
23
|
};
|
|
26
|
-
const RETIRED_CONNECTION_ENV = [
|
|
24
|
+
const RETIRED_CONNECTION_ENV = [
|
|
25
|
+
'TEMPORAL_TLS_ENABLED',
|
|
26
|
+
'TEMPORAL_AUTH_TOKEN_ENDPOINT',
|
|
27
|
+
'TEMPORAL_AUTH_CLIENT_ID',
|
|
28
|
+
'TEMPORAL_AUTH_CLIENT_SECRET_FILE',
|
|
29
|
+
'TEMPORAL_AUTH_AUDIENCE',
|
|
30
|
+
];
|
|
27
31
|
function required(env, name) {
|
|
28
32
|
const value = env(name)?.trim();
|
|
29
33
|
if (!value) {
|
|
30
34
|
throw new Error(`${name} is required for a Temporal connection: every worker and client ` +
|
|
31
|
-
'connects to the frontend over TLS with
|
|
35
|
+
'connects to the frontend over TLS with a workflow-authority bearer token, and ' +
|
|
32
36
|
'there is no plaintext or unauthenticated mode.');
|
|
33
37
|
}
|
|
34
38
|
return value;
|
|
@@ -37,21 +41,20 @@ function optional(env, name) {
|
|
|
37
41
|
const value = env(name)?.trim();
|
|
38
42
|
return value ? value : undefined;
|
|
39
43
|
}
|
|
40
|
-
function
|
|
44
|
+
function temporalWorkflowCredentialFromEnv(env) {
|
|
41
45
|
const options = {
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
clientSecretFile: required(env, exports.TEMPORAL_CONNECTION_ENV.clientSecretFile),
|
|
45
|
-
audience: required(env, exports.TEMPORAL_CONNECTION_ENV.audience),
|
|
46
|
+
identityApiUrl: required(env, exports.TEMPORAL_CONNECTION_ENV.identityApiUrl),
|
|
47
|
+
attestationFile: required(env, exports.TEMPORAL_CONNECTION_ENV.attestationFile),
|
|
46
48
|
};
|
|
47
|
-
(0,
|
|
49
|
+
(0, workflow_credential_token_source_1.validateWorkflowCredentialOptions)(options);
|
|
48
50
|
return options;
|
|
49
51
|
}
|
|
50
52
|
function temporalConnectionOptionsFromEnv(env) {
|
|
51
53
|
for (const retired of RETIRED_CONNECTION_ENV) {
|
|
52
54
|
if (env(retired) !== undefined) {
|
|
53
|
-
throw new Error(`${retired} is set, but the
|
|
54
|
-
`
|
|
55
|
+
throw new Error(`${retired} is set, but the setting it controlled is removed: TLS and ` +
|
|
56
|
+
`a workflow-authority bearer (${exports.TEMPORAL_CONNECTION_ENV.identityApiUrl}, ` +
|
|
57
|
+
`${exports.TEMPORAL_CONNECTION_ENV.attestationFile}) are unconditional. Remove ${retired} from the deployment.`);
|
|
55
58
|
}
|
|
56
59
|
}
|
|
57
60
|
const clientCertPath = optional(env, exports.TEMPORAL_CONNECTION_ENV.tlsClientCertPath);
|
|
@@ -65,7 +68,7 @@ function temporalConnectionOptionsFromEnv(env) {
|
|
|
65
68
|
...(clientCertPath !== undefined ? { clientCertPath } : {}),
|
|
66
69
|
...(clientKeyPath !== undefined ? { clientKeyPath } : {}),
|
|
67
70
|
},
|
|
68
|
-
credentials:
|
|
71
|
+
credentials: temporalWorkflowCredentialFromEnv(env),
|
|
69
72
|
};
|
|
70
73
|
validateTemporalConnectionOptions(options);
|
|
71
74
|
return options;
|
|
@@ -82,7 +85,7 @@ function validateTemporalConnectionOptions(options) {
|
|
|
82
85
|
if (hasCert !== hasKey) {
|
|
83
86
|
throw new Error('Temporal connection: tls.clientCertPath and tls.clientKeyPath are a pair — set both or neither.');
|
|
84
87
|
}
|
|
85
|
-
(0,
|
|
88
|
+
(0, workflow_credential_token_source_1.validateWorkflowCredentialOptions)(options.credentials);
|
|
86
89
|
}
|
|
87
90
|
async function resolveTls(tls, read) {
|
|
88
91
|
const serverRootCACertificate = await read(tls.serverCaPath);
|
|
@@ -101,10 +104,9 @@ async function resolveTls(tls, read) {
|
|
|
101
104
|
return config;
|
|
102
105
|
}
|
|
103
106
|
async function startTokens(options, deps) {
|
|
104
|
-
const source = deps.tokenSource ?? (0, client_credentials_token_source_1.createClientCredentialsTokenSource)(options.credentials, deps);
|
|
105
107
|
return proactive_token_refresher_1.ProactiveTokenRefresher.start({
|
|
106
|
-
source,
|
|
107
|
-
description: `
|
|
108
|
+
source: (0, workflow_credential_token_source_1.createWorkflowCredentialTokenSource)(options.credentials, deps),
|
|
109
|
+
description: `workflow credential ${options.credentials.attestationFile}`,
|
|
108
110
|
startupRetry: options.connectRetry ?? bounded_retry_1.DEFAULT_BOUNDED_RETRY_POLICY,
|
|
109
111
|
...(deps.logger !== undefined ? { logger: deps.logger } : {}),
|
|
110
112
|
...(deps.clock !== undefined ? { clock: deps.clock } : {}),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/lib/connection.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/lib/connection.ts"],"names":[],"mappings":";;;AAqIA,8EAOC;AASD,4EAyBC;AAGD,8EAeC;AA6DD,sDAiCC;AAOD,sDAmCC;AAxUD,+CAA4C;AAE5C,+CAAgE;AAChE,+CAAsD;AAEtD,mDAMyB;AAEzB,2EAGqC;AACrC,yFAK4C;AAmE/B,QAAA,uBAAuB,GAAG;IACrC,OAAO,EAAE,kBAAkB;IAC3B,SAAS,EAAE,sBAAsB;IACjC,aAAa,EAAE,0BAA0B;IACzC,iBAAiB,EAAE,+BAA+B;IAClD,gBAAgB,EAAE,8BAA8B;IAChD,cAAc,EAAE,gCAAgC;IAChD,eAAe,EAAE,gCAAgC;CACzC,CAAC;AAMX,MAAM,sBAAsB,GAAG;IAC7B,sBAAsB;IACtB,8BAA8B;IAC9B,yBAAyB;IACzB,kCAAkC;IAClC,wBAAwB;CAChB,CAAC;AAEX,SAAS,QAAQ,CAAC,GAAsB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kEAAkE;YACvE,gFAAgF;YAChF,gDAAgD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAsB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAOD,SAAgB,iCAAiC,CAAC,GAAsB;IACtE,MAAM,OAAO,GAA8B;QACzC,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,cAAc,CAAC;QACrE,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,eAAe,CAAC;KACxE,CAAC;IACF,IAAA,oEAAiC,EAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,SAAgB,gCAAgC,CAAC,GAAsB;IACrE,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,6DAA6D;gBACrE,gCAAgC,+BAAuB,CAAC,cAAc,IAAI;gBAC1E,GAAG,+BAAuB,CAAC,eAAe,+BAA+B,OAAO,uBAAuB,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,iBAAiB,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,OAAO,GAA8B;QACzC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,OAAO,CAAC;QACvD,GAAG,EAAE;YACH,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,SAAS,CAAC;YAC9D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D;QACD,WAAW,EAAE,iCAAiC,CAAC,GAAG,CAAC;KACpD,CAAC;IACF,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAgB,iCAAiC,CAAC,OAAkC;IAClF,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC;IACvD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IACD,IAAA,oEAAiC,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAuB,EACvB,IAAuC;IAGvC,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,YAAY,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAc,EAAE,uBAAuB,EAAE,CAAC;IACtD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,kBAAkB,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7E,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,CAAC,cAAc,GAAG;YACtB,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YACnC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;SACnC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAkC,EAClC,IAA4B;IAE5B,OAAO,mDAAuB,CAAC,KAAK,CAAC;QACnC,MAAM,EAAE,IAAA,sEAAmC,EAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;QACtE,WAAW,EAAE,uBAAuB,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE;QACzE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,4CAA4B;QAClE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,OAAkC,EAClC,IAA4B;IAE5B,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,4CAA4B;QAC3D,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,4BAAY;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAA0B;IAC3C,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,OAAO,GAAG,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;AACrC,CAAC;AAOM,KAAK,UAAU,qBAAqB,CACzC,OAAkC,EAClC,OAA+B,EAAE;IAEjC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,UAA4B,CAAC;IACjC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAA,gCAAgB,EACjC,mCAAmC,OAAO,CAAC,OAAO,EAAE,EACpD,GAAG,EAAE,CAAC,yBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,EACzF,KAAK,EACL,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,iCAAiC,OAAO,CAAC,OAAO,aAAa,OAAO,UAAU;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CACzF,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IAGD,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,UAAU;QACV,MAAM;QACN,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAOM,KAAK,UAAU,qBAAqB,CACzC,OAAkC,EAClC,OAA+B,EAAE;IAEjC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,UAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAA,gCAAgB,EACjC,mCAAmC,OAAO,CAAC,OAAO,EAAE,EACpD,GAAG,EAAE,CACH,mBAAU,CAAC,OAAO,CAAC;YACjB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG;YACH,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;SAC7B,CAAC,EACJ,KAAK,EACL,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,iCAAiC,OAAO,CAAC,OAAO,aAAa,OAAO,UAAU;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CACzF,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACL,UAAU;QACV,MAAM;QACN,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}
|
|
@@ -2,6 +2,7 @@ import type { AccessTokenSource } from './access-token';
|
|
|
2
2
|
import type { RetryClock } from './bounded-retry';
|
|
3
3
|
import type { TemporalEnvReader } from './namespace';
|
|
4
4
|
import { ProactiveTokenRefresher, type AccessTokenListener, type TokenRefresherLogger } from './proactive-token-refresher';
|
|
5
|
+
import { type WorkflowCredentialDeps } from './workflow-credential-token-source';
|
|
5
6
|
export declare const CONTROLLER_TOKEN_PUBLISHER_ENV: {
|
|
6
7
|
readonly secretName: "XEMA_TEMPORAL_CONTROLLER_TOKEN_SECRET";
|
|
7
8
|
readonly secretKey: "XEMA_TEMPORAL_CONTROLLER_TOKEN_KEY";
|
|
@@ -36,10 +37,10 @@ export declare class ControllerTokenSinkError extends Error {
|
|
|
36
37
|
export declare function kubernetesSecretTokenSink(target: KubernetesSecretTarget, deps?: KubernetesSecretSinkDeps): AccessTokenListener;
|
|
37
38
|
export interface ControllerTokenPublisherOptions {
|
|
38
39
|
readonly source: AccessTokenSource;
|
|
39
|
-
readonly
|
|
40
|
+
readonly description: string;
|
|
40
41
|
readonly target: KubernetesSecretTarget;
|
|
41
42
|
}
|
|
42
|
-
export declare function controllerTokenPublisherOptionsFromEnv(env: TemporalEnvReader, deps?: {
|
|
43
|
+
export declare function controllerTokenPublisherOptionsFromEnv(env: TemporalEnvReader, deps?: WorkflowCredentialDeps & {
|
|
43
44
|
readonly readFile?: (path: string) => Promise<string>;
|
|
44
45
|
readonly serviceAccountDir?: string;
|
|
45
46
|
}): Promise<ControllerTokenPublisherOptions>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"controller-token-publisher.d.ts","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"controller-token-publisher.d.ts","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,oCAAoC,CAAC;AAwB5C,eAAO,MAAM,8BAA8B;;;;;CAKjC,CAAC;AAGX,eAAO,MAAM,8BAA8B,kDAAkD,CAAC;AAG9F,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;CACvC;AAOD,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAoCD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,IAAI,GAAE,wBAA6B,GAClC,mBAAmB,CAyBrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAEnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AAUD,wBAAsB,sCAAsC,CAC1D,GAAG,EAAE,iBAAiB,EACtB,IAAI,GAAE,sBAAsB,GAAG;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAChC,GACL,OAAO,CAAC,+BAA+B,CAAC,CAwB1C;AASD,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,+BAA+B,EACxC,IAAI,GAAE,wBAAwB,GAAG;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CACxB,GACL,OAAO,CAAC,uBAAuB,CAAC,CAelC"}
|
|
@@ -6,9 +6,9 @@ exports.controllerTokenPublisherOptionsFromEnv = controllerTokenPublisherOptions
|
|
|
6
6
|
exports.startControllerTokenPublisher = startControllerTokenPublisher;
|
|
7
7
|
const promises_1 = require("node:fs/promises");
|
|
8
8
|
const node_https_1 = require("node:https");
|
|
9
|
-
const client_credentials_token_source_1 = require("./client-credentials-token-source");
|
|
10
9
|
const connection_1 = require("./connection");
|
|
11
10
|
const proactive_token_refresher_1 = require("./proactive-token-refresher");
|
|
11
|
+
const workflow_credential_token_source_1 = require("./workflow-credential-token-source");
|
|
12
12
|
exports.CONTROLLER_TOKEN_PUBLISHER_ENV = {
|
|
13
13
|
secretName: 'XEMA_TEMPORAL_CONTROLLER_TOKEN_SECRET',
|
|
14
14
|
secretKey: 'XEMA_TEMPORAL_CONTROLLER_TOKEN_KEY',
|
|
@@ -71,7 +71,7 @@ function kubernetesSecretTokenSink(target, deps = {}) {
|
|
|
71
71
|
};
|
|
72
72
|
}
|
|
73
73
|
async function controllerTokenPublisherOptionsFromEnv(env, deps = {}) {
|
|
74
|
-
const credentials = (0, connection_1.
|
|
74
|
+
const credentials = (0, connection_1.temporalWorkflowCredentialFromEnv)(env);
|
|
75
75
|
const required = (name) => {
|
|
76
76
|
const value = env(name)?.trim();
|
|
77
77
|
if (!value)
|
|
@@ -84,8 +84,8 @@ async function controllerTokenPublisherOptionsFromEnv(env, deps = {}) {
|
|
|
84
84
|
const port = required(exports.CONTROLLER_TOKEN_PUBLISHER_ENV.apiPort);
|
|
85
85
|
const namespace = (await read(`${dir}/namespace`)).trim();
|
|
86
86
|
return {
|
|
87
|
-
source: (0,
|
|
88
|
-
|
|
87
|
+
source: (0, workflow_credential_token_source_1.createWorkflowCredentialTokenSource)(credentials, deps),
|
|
88
|
+
description: credentials.attestationFile,
|
|
89
89
|
target: {
|
|
90
90
|
apiServer: `https://${host.includes(':') ? `[${host}]` : host}:${port}`,
|
|
91
91
|
namespace,
|
|
@@ -99,7 +99,7 @@ async function controllerTokenPublisherOptionsFromEnv(env, deps = {}) {
|
|
|
99
99
|
async function startControllerTokenPublisher(options, deps = {}) {
|
|
100
100
|
const refresher = await proactive_token_refresher_1.ProactiveTokenRefresher.start({
|
|
101
101
|
source: options.source,
|
|
102
|
-
description: `${options.
|
|
102
|
+
description: `${options.description} (Worker Controller credential → ${options.target.namespace}/${options.target.secretName})`,
|
|
103
103
|
...(deps.logger ? { logger: deps.logger } : {}),
|
|
104
104
|
...(deps.onFatal ? { onFatal: deps.onFatal } : {}),
|
|
105
105
|
...(deps.clock ? { clock: deps.clock } : {}),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":";;;AA0HA,8DA4BC;AAiBD,wFA8BC;AASD,sEAsBC;AApOD,+CAA4C;AAC5C,2CAAqD;AAIrD,6CAAiE;AAEjE,2EAIqC;AACrC,yFAG4C;AAwB/B,QAAA,8BAA8B,GAAG;IAC5C,UAAU,EAAE,uCAAuC;IACnD,SAAS,EAAE,oCAAoC;IAC/C,OAAO,EAAE,yBAAyB;IAClC,OAAO,EAAE,yBAAyB;CAC1B,CAAC;AAGE,QAAA,8BAA8B,GAAG,+CAA+C,CAAC;AA6B9F,MAAM,WAAW,GAAG,wCAAwC,CAAC;AAC7D,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAGlC,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED,MAAM,cAAc,GAAuB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CACvE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,GAAG,GAAG,IAAA,oBAAY,EACtB,GAAG,EACH;QACE,MAAM,EAAE,OAAO;QACf,EAAE;QACF,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,8BAA8B;YAC9C,MAAM,EAAE,kBAAkB;YAC1B,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;SAC1C;KACF,EACD,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,oBAAoB,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC,CAAC,CAAC;AASL,SAAgB,yBAAyB,CACvC,MAA8B,EAC9B,OAAiC,EAAE;IAEnC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,wBAAwB,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,wBAAwB,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC5C,MAAM,GAAG,GACP,GAAG,MAAM,CAAC,SAAS,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QAC/E,YAAY,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IACtD,OAAO,KAAK,EAAE,KAAkB,EAAE,EAAE;QAClC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,wBAAwB,CAChC,SAAS,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,aAAa,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7G,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAiBM,KAAK,UAAU,sCAAsC,CAC1D,GAAsB,EACtB,OAGI,EAAE;IAEN,MAAM,WAAW,GAAG,IAAA,8CAAiC,EAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,wBAAwB,CAAC,GAAG,IAAI,wDAAwD,CAAC,CAAC;QAChH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,sCAA8B,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,sCAA8B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,sCAA8B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,IAAA,sEAAmC,EAAC,WAAW,EAAE,IAAI,CAAC;QAC9D,WAAW,EAAE,WAAW,CAAC,eAAe;QACxC,MAAM,EAAE;YACN,SAAS,EAAE,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE;YACvE,SAAS;YACT,UAAU,EAAE,QAAQ,CAAC,sCAA8B,CAAC,UAAU,CAAC;YAC/D,SAAS,EAAE,QAAQ,CAAC,sCAA8B,CAAC,SAAS,CAAC;YAC7D,uBAAuB,EAAE,GAAG,GAAG,QAAQ;YACvC,MAAM,EAAE,GAAG,GAAG,SAAS;SACxB;KACF,CAAC;AACJ,CAAC;AASM,KAAK,UAAU,6BAA6B,CACjD,OAAwC,EACxC,OAII,EAAE;IAEN,MAAM,SAAS,GAAG,MAAM,mDAAuB,CAAC,KAAK,CAAC;QACpD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,oCAAoC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG;QAC/H,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
|
@@ -2,6 +2,7 @@ export declare const NEXUS_ENDPOINTS_DEFINE = "__XEMA_NEXUS_ENDPOINTS__";
|
|
|
2
2
|
export declare const NEXUS_SERVICE_NOT_BOUND = "NEXUS_SERVICE_NOT_BOUND";
|
|
3
3
|
export declare const NEXUS_ENDPOINTS_NOT_DEFINED = "NEXUS_ENDPOINTS_NOT_DEFINED";
|
|
4
4
|
export declare const NEXUS_CALLER_NOT_BOUND = "NEXUS_CALLER_NOT_BOUND";
|
|
5
|
+
export declare const NEXUS_CALLER_UNVERIFIABLE = "NEXUS_CALLER_UNVERIFIABLE";
|
|
5
6
|
export declare const NEXUS_ORG_MISSING = "NEXUS_ORG_MISSING";
|
|
6
7
|
export declare function nexusServiceKey(service: string, version: string): string;
|
|
7
8
|
export declare const NEXUS_OPERATION_TIMED_OUT = "NEXUS_OPERATION_TIMED_OUT";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nexus-constants.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAOjE,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAGjE,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAGzE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"nexus-constants.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAOjE,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAGjE,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAGzE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAO/D,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAGrE,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAGrD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAExE;AAMD,eAAO,MAAM,yBAAyB,8BAA8B,CAAC"}
|
|
@@ -1,11 +1,12 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.NEXUS_OPERATION_TIMED_OUT = exports.NEXUS_ORG_MISSING = exports.NEXUS_CALLER_NOT_BOUND = exports.NEXUS_ENDPOINTS_NOT_DEFINED = exports.NEXUS_SERVICE_NOT_BOUND = exports.NEXUS_ENDPOINTS_DEFINE = void 0;
|
|
3
|
+
exports.NEXUS_OPERATION_TIMED_OUT = exports.NEXUS_ORG_MISSING = exports.NEXUS_CALLER_UNVERIFIABLE = exports.NEXUS_CALLER_NOT_BOUND = exports.NEXUS_ENDPOINTS_NOT_DEFINED = exports.NEXUS_SERVICE_NOT_BOUND = exports.NEXUS_ENDPOINTS_DEFINE = void 0;
|
|
4
4
|
exports.nexusServiceKey = nexusServiceKey;
|
|
5
5
|
exports.NEXUS_ENDPOINTS_DEFINE = '__XEMA_NEXUS_ENDPOINTS__';
|
|
6
6
|
exports.NEXUS_SERVICE_NOT_BOUND = 'NEXUS_SERVICE_NOT_BOUND';
|
|
7
7
|
exports.NEXUS_ENDPOINTS_NOT_DEFINED = 'NEXUS_ENDPOINTS_NOT_DEFINED';
|
|
8
8
|
exports.NEXUS_CALLER_NOT_BOUND = 'NEXUS_CALLER_NOT_BOUND';
|
|
9
|
+
exports.NEXUS_CALLER_UNVERIFIABLE = 'NEXUS_CALLER_UNVERIFIABLE';
|
|
9
10
|
exports.NEXUS_ORG_MISSING = 'NEXUS_ORG_MISSING';
|
|
10
11
|
function nexusServiceKey(service, version) {
|
|
11
12
|
return `${service}@${version}`;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nexus-constants.js","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"nexus-constants.js","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":";;;AAqCA,0CAEC;AA5BY,QAAA,sBAAsB,GAAG,0BAA0B,CAAC;AAOpD,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAGpD,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAG5D,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAOlD,QAAA,yBAAyB,GAAG,2BAA2B,CAAC;AAGxD,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAGrD,SAAgB,eAAe,CAAC,OAAe,EAAE,OAAe;IAC9D,OAAO,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;AACjC,CAAC;AAMY,QAAA,yBAAyB,GAAG,2BAA2B,CAAC"}
|
|
@@ -26,7 +26,15 @@ export interface XemaNexusServiceImplementation {
|
|
|
26
26
|
readonly operations: ReadonlyMap<string, BiomeNexusOperationMode>;
|
|
27
27
|
bind(policy: NexusCallerPolicy): PlatformNexusServiceHandler;
|
|
28
28
|
}
|
|
29
|
-
export
|
|
29
|
+
export type CallerNamespaceRefusal = 'none' | 'ambiguous' | 'malformed';
|
|
30
|
+
export type CallerNamespaceResult = {
|
|
31
|
+
readonly ok: true;
|
|
32
|
+
readonly namespace: string;
|
|
33
|
+
} | {
|
|
34
|
+
readonly ok: false;
|
|
35
|
+
readonly reason: CallerNamespaceRefusal;
|
|
36
|
+
};
|
|
37
|
+
export declare function callerNamespaceOf(links: readonly nexus.Link[]): CallerNamespaceResult;
|
|
30
38
|
export declare function nexusHandlerFor<Ops extends XemaNexusOperationMap>(contract: XemaNexusContract<Ops>, impl: XemaNexusServiceImpl<Ops>): XemaNexusServiceImplementation;
|
|
31
39
|
export type { NexusOperationInputOf, NexusOperationOutputOf };
|
|
32
40
|
//# sourceMappingURL=nexus-handler.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nexus-handler.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"nexus-handler.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":"AA8BA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,oBAAoB,IAAI,yBAAyB,EACvD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,KAAK,MAAM,WAAW,CAAC;AAKnC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAOjF,MAAM,MAAM,4BAA4B,CAAC,CAAC,SAAS,QAAQ,IAAI,IAAI,CACjE,yBAAyB,CAAC,CAAC,CAAC,EAC5B,UAAU,GAAG,kBAAkB,GAAG,uBAAuB,CAC1D,GAAG;IACF,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;CACnD,CAAC;AAGF,MAAM,WAAW,yBAAyB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB;IAE5F,QAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,mBAAmB,CAAC,GAAG,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAEhF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,qBAAqB,CAAC;IAQ5C,aAAa,CAAC,CAAC,SAAS,QAAQ,EAC9B,kBAAkB,EAAE,MAAM,GAAG,CAAC,EAC9B,OAAO,EAAE,4BAA4B,CAAC,CAAC,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACnD;AAED,KAAK,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;AAGjF,MAAM,MAAM,sBAAsB,CAAC,EAAE,IACnC,EAAE,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,uBAAuB,CAAC,KAAK,CAAC,GAC1E,CAAC,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GACrF,EAAE,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,uBAAuB,CAAC,IAAI,CAAC,GAC3E,CAAC,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACrE,KAAK,CAAC;AAEd,MAAM,MAAM,oBAAoB,CAAC,GAAG,SAAS,qBAAqB,IAAI;IACpE,QAAQ,EAAE,CAAC,IAAI,MAAM,GAAG,GAAG,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACnE,CAAC;AAGF,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvD;AAGD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAElE,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,2BAA2B,CAAC;CAC9D;AAaD,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,WAAW,GAAG,WAAW,CAAC;AAExE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAcpE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE,GAAG,qBAAqB,CAarF;AA4ED,wBAAgB,eAAe,CAAC,GAAG,SAAS,qBAAqB,EAC/D,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAChC,IAAI,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAC9B,8BAA8B,CA6ChC;AAED,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,CAAC"}
|
|
@@ -44,20 +44,28 @@ const nexus_contract_1 = require("./nexus-contract");
|
|
|
44
44
|
const search_attribute_constants_1 = require("./search-attribute-constants");
|
|
45
45
|
const WORKFLOW_EVENT_LINK_TYPE = 'temporal.api.common.v1.Link.WorkflowEvent';
|
|
46
46
|
const WORKFLOW_EVENT_LINK_PATH = /^\/namespaces\/([^/]+)\/workflows\//;
|
|
47
|
+
const CALLER_REFUSALS = new Set([nexus_constants_1.NEXUS_CALLER_NOT_BOUND, nexus_constants_1.NEXUS_CALLER_UNVERIFIABLE]);
|
|
47
48
|
function refuse(code, message) {
|
|
48
|
-
return new nexus.HandlerError(code
|
|
49
|
+
return new nexus.HandlerError(CALLER_REFUSALS.has(code) ? 'UNAUTHORIZED' : 'BAD_REQUEST', `[${code}] ${message}`, { retryableOverride: false });
|
|
49
50
|
}
|
|
50
51
|
function callerNamespaceOf(links) {
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
}
|
|
52
|
+
const events = links.filter((link) => link.type === WORKFLOW_EVENT_LINK_TYPE);
|
|
53
|
+
if (events.length === 0)
|
|
54
|
+
return { ok: false, reason: 'none' };
|
|
55
|
+
if (events.length > 1)
|
|
56
|
+
return { ok: false, reason: 'ambiguous' };
|
|
57
|
+
const [event] = events;
|
|
58
|
+
if (event.url.protocol !== 'temporal:')
|
|
59
|
+
return { ok: false, reason: 'malformed' };
|
|
60
|
+
const match = WORKFLOW_EVENT_LINK_PATH.exec(event.url.pathname);
|
|
61
|
+
if (match?.[1] === undefined)
|
|
62
|
+
return { ok: false, reason: 'malformed' };
|
|
63
|
+
try {
|
|
64
|
+
return { ok: true, namespace: decodeURIComponent(match[1]) };
|
|
65
|
+
}
|
|
66
|
+
catch {
|
|
67
|
+
return { ok: false, reason: 'malformed' };
|
|
59
68
|
}
|
|
60
|
-
return undefined;
|
|
61
69
|
}
|
|
62
70
|
function headerValue(headers, name) {
|
|
63
71
|
for (const [key, value] of Object.entries(headers)) {
|
|
@@ -67,10 +75,11 @@ function headerValue(headers, name) {
|
|
|
67
75
|
return undefined;
|
|
68
76
|
}
|
|
69
77
|
function admit(where, op, policy, ctx) {
|
|
70
|
-
const
|
|
71
|
-
if (
|
|
72
|
-
throw refuse(nexus_constants_1.
|
|
78
|
+
const caller = callerNamespaceOf(ctx.inboundLinks);
|
|
79
|
+
if (!caller.ok) {
|
|
80
|
+
throw refuse(nexus_constants_1.NEXUS_CALLER_UNVERIFIABLE, `${where}: the request does not carry exactly one well-formed calling-workflow link (${caller.reason}), so its caller cannot be verified.`);
|
|
73
81
|
}
|
|
82
|
+
const callerNamespace = caller.namespace;
|
|
74
83
|
if (!policy.allowedCallerNamespaces.has(callerNamespace)) {
|
|
75
84
|
throw refuse(nexus_constants_1.NEXUS_CALLER_NOT_BOUND, `${where}: namespace ${callerNamespace} is not bound to this service by the distribution lock.`);
|
|
76
85
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nexus-handler.js","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"nexus-handler.js","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmJA,8CAaC;AA4ED,0CAgDC;AA9PD,6CAK2B;AAC3B,iDAAmC;AAEnC,yCAA4C;AAC5C,6DAA6D;AAC7D,uDAAyG;AACzG,qDAQ0B;AAC1B,6EAAkE;AAMlE,MAAM,wBAAwB,GAAG,2CAA2C,CAAC;AAC7E,MAAM,wBAAwB,GAAG,qCAAqC,CAAC;AA6DvE,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,wCAAsB,EAAE,2CAAyB,CAAC,CAAC,CAAC;AAE1G,SAAS,MAAM,CAAC,IAAY,EAAE,OAAe;IAC3C,OAAO,IAAI,KAAK,CAAC,YAAY,CAC3B,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAC1D,IAAI,IAAI,KAAK,OAAO,EAAE,EACtB,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAC7B,CAAC;AACJ,CAAC;AAqBD,SAAgB,iBAAiB,CAAC,KAA4B;IAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAsB,CAAC;IACvC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClF,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxE,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAA+B,EAAE,IAAY;IAChE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,KAAK,CACZ,KAAa,EACb,EAAwC,EACxC,MAAyB,EACzB,GAAgC;IAEhC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,MAAM,CACV,2CAAyB,EACzB,GAAG,KAAK,+EAA+E,MAAM,CAAC,MAAM,sCAAsC,CAC3I,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,CACV,wCAAsB,EACtB,GAAG,KAAK,eAAe,eAAe,yDAAyD,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,0CAAqB,CAAC,CAAC;IAC/D,IAAI,KAAyB,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,GAAG,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,mCAAiB,EAAE,GAAG,KAAK,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,oCAAmB,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,MAAM,CACV,mCAAiB,EACjB,GAAG,KAAK,gDAAgD,0CAAqB,KAAK;YAChF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK;QACL,eAAe;QACf,KAAK,EAAE,GAAG;QACV,aAAa,CAAC,kBAAkB,EAAE,OAAO;YACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAgC,CAAC;YAC1D,IAAI,QAAQ,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,kFAAkF,CAC3F,CAAC;YACJ,CAAC;YACD,OAAO,IAAA,qBAAkB,EAAC,GAAG,EAAE,kBAAkB,EAAE;gBACjD,GAAG,OAAO;gBACV,GAAG,CAAC,KAAK,KAAK,SAAS;oBACrB,CAAC,CAAC;wBACE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;wBAC7C,gBAAgB,EAAE,EAAE,CAAC,+CAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE;qBACpD;oBACH,CAAC,CAAC,EAAE,CAAC;aACC,CAAC,CAAC;QACd,CAAC;KAC2B,CAAC;AACjC,CAAC;AASD,SAAgB,eAAe,CAC7B,QAAgC,EAChC,IAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,IAAgC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,4CAA4C;YACjG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CACN,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAA0C,CAAC,IAAI,CAAC,CAAC,CAC7F,CAAC;IAEF,SAAS,IAAI,CAAC,MAAyB;QACrC,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAyC,CAAC;YAC7E,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAChE,MAAM,GAAG,GAAI,IAAuF,CAAC,IAAI,CAGpF,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,CAAC,IAAI,KAAK,wCAAuB,CAAC,KAAK;oBACvC,CAAC,CAAC,IAAI,mCAA2B,CAC7B,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAqC,CAC9F;oBACH,CAAC,CAAC,CAAC,GAAgC,EAAE,KAAc,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CACzB,QAAQ,CAAC,UAAU,EACnB,QAA0C,CACD,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU;QACV,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proactive-token-refresher.d.ts","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,
|
|
1
|
+
{"version":3,"file":"proactive-token-refresher.d.ts","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAG/E,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAEnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAM7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAE3C,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IASzC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAOD,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AA8BD,qBAAa,uBAAuB;IAchC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAb1B,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IAEjD,OAAO;WAmBM,KAAK,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAwB7F,KAAK,IAAI,MAAM;IAKf,YAAY,IAAI,WAAW;IAerB,SAAS,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IASnE,IAAI,IAAI,IAAI;IASZ,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,GAAG;YAQG,OAAO;IA0DrB,OAAO,CAAC,IAAI;CAMb"}
|
|
@@ -100,6 +100,11 @@ class ProactiveTokenRefresher {
|
|
|
100
100
|
catch (error) {
|
|
101
101
|
if (this.stopped)
|
|
102
102
|
return;
|
|
103
|
+
if (error instanceof bounded_retry_1.PermanentFailureError) {
|
|
104
|
+
this.fail(new TokenRefreshFatalError(`The Temporal access token for ${this.options.description} cannot be refreshed: ` +
|
|
105
|
+
`${describe(error)}. Refusing to continue without a valid credential.`, error));
|
|
106
|
+
return;
|
|
107
|
+
}
|
|
103
108
|
const now = this.clock.now();
|
|
104
109
|
const delay = Math.min(this.retryMaxMs, this.retryInitialMs * 2 ** (attempt - 1));
|
|
105
110
|
if (now + delay >= this.current.expiresAt) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proactive-token-refresher.js","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":";;;AACA,
|
|
1
|
+
{"version":3,"file":"proactive-token-refresher.js","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":";;;AACA,mDAOyB;AAyCzB,MAAM,2BAA2B,GAAG,IAAI,CAAC;AACzC,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAC/C,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAG5C,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED,SAAS,aAAa,CAAC,KAAY;IACjC,YAAY,CAAC,GAAG,EAAE;QAChB,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,aAAa,GAAyB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;AAsB/F,MAAa,uBAAuB;IAcf;IAbX,OAAO,CAAc;IACrB,UAAU,CAAS;IACnB,KAAK,GAAY,IAAI,CAAC;IACtB,OAAO,GAAG,KAAK,CAAC;IACP,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,CAAa;IAClB,MAAM,CAAuB;IAC7B,QAAQ,CAAS;IACjB,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,OAAO,CAAyB;IAEjD,YACmB,OAAuC,EACxD,KAAkB;QADD,YAAO,GAAP,OAAO,CAAgC;QAGxD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,4BAAY,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,0BAA0B,IAAI,gCAAgC,CAAC;QAC7F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,sBAAsB,IAAI,4BAA4B,CAAC;QACjF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;IAOD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAuC;QACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QAC1E,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,4BAAY,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAgB,EAClC,2CAA2C,OAAO,CAAC,WAAW,EAAE,EAChE,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,YAAY,IAAI,4CAA4B,EACpD,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,IAAI,CACT,6BAA6B,OAAO,CAAC,WAAW,aAAa,OAAO,UAAU;YAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAClD,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,SAAS,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAGD,KAAK;QACH,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC;IACnC,CAAC;IAGD,YAAY;QACV,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAsB,CAC9B,2CAA2C,IAAI,CAAC,OAAO,CAAC,WAAW,cAAc,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAQD,KAAK,CAAC,SAAS,CAAC,QAA6B;QAC3C,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;IAGD,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,YAAY;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAEO,GAAG,CAAC,OAAe,EAAE,OAAe;QAC1C,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAAe;QACnC,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,IAAI,KAAK,YAAY,qCAAqB,EAAE,CAAC;gBAC3C,IAAI,CAAC,IAAI,CACP,IAAI,sBAAsB,CACxB,iCAAiC,IAAI,CAAC,OAAO,CAAC,WAAW,wBAAwB;oBAC/E,GAAG,QAAQ,CAAC,KAAK,CAAC,oDAAoD,EACxE,KAAK,CACN,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YAClF,IAAI,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1C,IAAI,CAAC,IAAI,CACP,IAAI,sBAAsB,CACxB,iCAAiC,IAAI,CAAC,OAAO,CAAC,WAAW,kBAAkB;oBACzE,mDAAmD,OAAO,WAAW;oBACrE,GAAG,QAAQ,CAAC,KAAK,CAAC,qDAAqD,EACzE,KAAK,CACN,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,IAAI,CAAC,OAAO,CAAC,WAAW,aAAa,OAAO,GAAG;gBAClF,WAAW,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK;gBACtD,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,uBAAuB,CAC1D,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnC,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CACP,IAAI,sBAAsB,CACxB,6CAA6C,IAAI,CAAC,OAAO,CAAC,WAAW,SAAS;oBAC5E,kCAAkC,QAAQ,CAAC,KAAK,CAAC,EAAE,EACrD,KAAK,CACN,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;QAC3B,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,IAAI,CAAC,KAA6B;QACxC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;CACF;AA5KD,0DA4KC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
import { type AccessTokenSource } from './access-token';
|
|
2
|
+
import { PermanentFailureError } from './bounded-retry';
|
|
3
|
+
import type { TokenRefresherLogger } from './proactive-token-refresher';
|
|
4
|
+
export interface WorkflowCredentialOptions {
|
|
5
|
+
readonly identityApiUrl: string;
|
|
6
|
+
readonly attestationFile: string;
|
|
7
|
+
}
|
|
8
|
+
export interface WorkflowCredentialDeps {
|
|
9
|
+
readonly fetch?: typeof fetch;
|
|
10
|
+
readonly readAttestationFile?: (path: string) => Promise<string>;
|
|
11
|
+
readonly now?: () => number;
|
|
12
|
+
readonly logger?: TokenRefresherLogger;
|
|
13
|
+
}
|
|
14
|
+
export declare class TemporalCredentialRefusedError extends PermanentFailureError {
|
|
15
|
+
readonly code: string;
|
|
16
|
+
readonly status: number | undefined;
|
|
17
|
+
constructor(message: string, code: string, status: number | undefined, cause: unknown);
|
|
18
|
+
}
|
|
19
|
+
export declare class TemporalCredentialMalformedError extends PermanentFailureError {
|
|
20
|
+
constructor(message: string);
|
|
21
|
+
}
|
|
22
|
+
export declare function validateWorkflowCredentialOptions(options: WorkflowCredentialOptions): void;
|
|
23
|
+
export declare function createWorkflowCredentialTokenSource(options: WorkflowCredentialOptions, deps?: WorkflowCredentialDeps): AccessTokenSource;
|
|
24
|
+
//# sourceMappingURL=workflow-credential-token-source.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"workflow-credential-token-source.d.ts","sourceRoot":"","sources":["../../src/lib/workflow-credential-token-source.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAaxE,MAAM,WAAW,yBAAyB;IAExC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAMhC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAGD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;CACxC;AAOD,qBAAa,8BAA+B,SAAQ,qBAAqB;IAIrE,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS;gBAHnC,OAAO,EAAE,MAAM,EAEN,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO;CAKjB;AAGD,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAa1F;AAcD,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,yBAAyB,EAClC,IAAI,GAAE,sBAA2B,GAChC,iBAAiB,CAsCnB"}
|
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.TemporalCredentialMalformedError = exports.TemporalCredentialRefusedError = void 0;
|
|
4
|
+
exports.validateWorkflowCredentialOptions = validateWorkflowCredentialOptions;
|
|
5
|
+
exports.createWorkflowCredentialTokenSource = createWorkflowCredentialTokenSource;
|
|
6
|
+
const identity_client_1 = require("@xemahq/identity-client");
|
|
7
|
+
const access_token_1 = require("./access-token");
|
|
8
|
+
const bounded_retry_1 = require("./bounded-retry");
|
|
9
|
+
class TemporalCredentialRefusedError extends bounded_retry_1.PermanentFailureError {
|
|
10
|
+
code;
|
|
11
|
+
status;
|
|
12
|
+
constructor(message, code, status, cause) {
|
|
13
|
+
super(message, { cause });
|
|
14
|
+
this.code = code;
|
|
15
|
+
this.status = status;
|
|
16
|
+
this.name = 'TemporalCredentialRefusedError';
|
|
17
|
+
}
|
|
18
|
+
}
|
|
19
|
+
exports.TemporalCredentialRefusedError = TemporalCredentialRefusedError;
|
|
20
|
+
class TemporalCredentialMalformedError extends bounded_retry_1.PermanentFailureError {
|
|
21
|
+
constructor(message) {
|
|
22
|
+
super(message);
|
|
23
|
+
this.name = 'TemporalCredentialMalformedError';
|
|
24
|
+
}
|
|
25
|
+
}
|
|
26
|
+
exports.TemporalCredentialMalformedError = TemporalCredentialMalformedError;
|
|
27
|
+
function validateWorkflowCredentialOptions(options) {
|
|
28
|
+
let url;
|
|
29
|
+
try {
|
|
30
|
+
url = new URL(options.identityApiUrl);
|
|
31
|
+
}
|
|
32
|
+
catch {
|
|
33
|
+
throw new Error(`Temporal identity-api URL is not a URL: ${options.identityApiUrl}`);
|
|
34
|
+
}
|
|
35
|
+
if (url.protocol !== 'https:' && url.protocol !== 'http:') {
|
|
36
|
+
throw new Error(`Temporal identity-api URL must be http(s): ${options.identityApiUrl}`);
|
|
37
|
+
}
|
|
38
|
+
if (options.attestationFile.trim().length === 0) {
|
|
39
|
+
throw new Error('Temporal workflow credential: attestationFile is required.');
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
function createWorkflowCredentialTokenSource(options, deps = {}) {
|
|
43
|
+
validateWorkflowCredentialOptions(options);
|
|
44
|
+
const now = deps.now ?? Date.now;
|
|
45
|
+
const source = new identity_client_1.WorkflowCredentialSource({
|
|
46
|
+
identityApiUrl: options.identityApiUrl,
|
|
47
|
+
readCredential: (0, identity_client_1.fileCredentialReader)(options.attestationFile, deps.readAttestationFile),
|
|
48
|
+
...(deps.fetch !== undefined ? { fetch: deps.fetch } : {}),
|
|
49
|
+
now,
|
|
50
|
+
});
|
|
51
|
+
return async () => {
|
|
52
|
+
source.invalidate();
|
|
53
|
+
const sentAt = now();
|
|
54
|
+
let value;
|
|
55
|
+
try {
|
|
56
|
+
value = await source.get();
|
|
57
|
+
}
|
|
58
|
+
catch (error) {
|
|
59
|
+
if (error instanceof identity_client_1.WorkflowCredentialError && error.code !== undefined) {
|
|
60
|
+
const refused = new TemporalCredentialRefusedError(`identity-api refused the Temporal workflow credential: ${error.code} ` +
|
|
61
|
+
`(HTTP ${error.status ?? 'unknown'}). ${error.message}`, error.code, error.status, error);
|
|
62
|
+
deps.logger?.error(refused.message);
|
|
63
|
+
throw refused;
|
|
64
|
+
}
|
|
65
|
+
throw error;
|
|
66
|
+
}
|
|
67
|
+
const { iat, exp } = (0, access_token_1.decodeAccessTokenClaims)(value);
|
|
68
|
+
if (iat === undefined || exp === undefined || exp <= iat) {
|
|
69
|
+
throw new TemporalCredentialMalformedError('The Temporal workflow credential carries no usable iat/exp; its refresh cannot be scheduled.');
|
|
70
|
+
}
|
|
71
|
+
return { value, expiresAt: sentAt + (exp - iat) * 1000 };
|
|
72
|
+
};
|
|
73
|
+
}
|
|
74
|
+
//# sourceMappingURL=workflow-credential-token-source.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"workflow-credential-token-source.js","sourceRoot":"","sources":["../../src/lib/workflow-credential-token-source.ts"],"names":[],"mappings":";;;AAuEA,8EAaC;AAcD,kFAyCC;AA3ID,6DAIiC;AAEjC,iDAIwB;AACxB,mDAAwD;AAsCxD,MAAa,8BAA+B,SAAQ,qCAAqB;IAI5D;IACA;IAJX,YACE,OAAe,EAEN,IAAY,EACZ,MAA0B,EACnC,KAAc;QAEd,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAJjB,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAoB;QAInC,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAXD,wEAWC;AAGD,MAAa,gCAAiC,SAAQ,qCAAqB;IACzE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AALD,4EAKC;AAGD,SAAgB,iCAAiC,CAAC,OAAkC;IAClF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAcD,SAAgB,mCAAmC,CACjD,OAAkC,EAClC,OAA+B,EAAE;IAEjC,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,0CAAwB,CAAC;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,cAAc,EAAE,IAAA,sCAAoB,EAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;QACvF,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG;KACJ,CAAC,CAAC;IAEH,OAAO,KAAK,IAA0B,EAAE;QACtC,MAAM,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yCAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACzE,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAChD,0DAA0D,KAAK,CAAC,IAAI,GAAG;oBACrE,SAAS,KAAK,CAAC,MAAM,IAAI,SAAS,MAAM,KAAK,CAAC,OAAO,EAAE,EACzD,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,MAAM,EACZ,KAAK,CACN,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpC,MAAM,OAAO,CAAC;YAChB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAA,sCAAuB,EAAC,KAAK,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,gCAAgC,CACxC,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IAC3D,CAAC,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/temporal-runtime",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.10.0",
|
|
4
4
|
"description": "Temporal workers and clients for Xema — connection management, on-behalf-of auth interceptors, schedules, and search attributes.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|
|
@@ -29,7 +29,7 @@
|
|
|
29
29
|
"@types/jest": "^30.0.0",
|
|
30
30
|
"@types/node": "25.2.3",
|
|
31
31
|
"@xemahq/contracts": "^0.60.0",
|
|
32
|
-
"@xemahq/identity-client": "^0.
|
|
32
|
+
"@xemahq/identity-client": "^0.18.0",
|
|
33
33
|
"jest": "^30.3.0",
|
|
34
34
|
"prettier": "3.6.2",
|
|
35
35
|
"reflect-metadata": "0.2.2",
|
|
@@ -40,7 +40,7 @@
|
|
|
40
40
|
"peerDependencies": {
|
|
41
41
|
"@nestjs/common": "^11.0.0",
|
|
42
42
|
"reflect-metadata": "^0.2",
|
|
43
|
-
"@xemahq/identity-client": ">=0.
|
|
43
|
+
"@xemahq/identity-client": ">=0.18.0",
|
|
44
44
|
"@xemahq/contracts": ">=0.60.0"
|
|
45
45
|
},
|
|
46
46
|
"dependencies": {
|
|
@@ -82,6 +82,6 @@
|
|
|
82
82
|
"test:integration": "jest --config jest.integration.config.ts --runInBand"
|
|
83
83
|
},
|
|
84
84
|
"xemaRelease": {
|
|
85
|
-
"sourceDigest": "sha256:
|
|
85
|
+
"sourceDigest": "sha256:cfeb8e0b6cc78f1ce2e36651dc51c1f62f793c5e5f0cabe7cb89cc849e66e0e0"
|
|
86
86
|
}
|
|
87
87
|
}
|
|
@@ -1,23 +0,0 @@
|
|
|
1
|
-
import { type AccessTokenSource } from './access-token';
|
|
2
|
-
export interface ClientCredentialsOptions {
|
|
3
|
-
readonly tokenEndpoint: string;
|
|
4
|
-
readonly clientId: string;
|
|
5
|
-
readonly clientSecretFile: string;
|
|
6
|
-
readonly audience: string;
|
|
7
|
-
readonly requestTimeoutMs?: number;
|
|
8
|
-
}
|
|
9
|
-
export interface ClientCredentialsDeps {
|
|
10
|
-
readonly fetch?: typeof fetch;
|
|
11
|
-
readonly readSecretFile?: (path: string) => Promise<string>;
|
|
12
|
-
readonly now?: () => number;
|
|
13
|
-
}
|
|
14
|
-
export declare class ClientCredentialsTokenError extends Error {
|
|
15
|
-
readonly status: number | undefined;
|
|
16
|
-
constructor(message: string, options?: {
|
|
17
|
-
status?: number;
|
|
18
|
-
cause?: unknown;
|
|
19
|
-
});
|
|
20
|
-
}
|
|
21
|
-
export declare function createClientCredentialsTokenSource(options: ClientCredentialsOptions, deps?: ClientCredentialsDeps): AccessTokenSource;
|
|
22
|
-
export declare function validateClientCredentialsOptions(options: ClientCredentialsOptions): void;
|
|
23
|
-
//# sourceMappingURL=client-credentials-token-source.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"client-credentials-token-source.d.ts","sourceRoot":"","sources":["../../src/lib/client-credentials-token-source.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AAYxB,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAK1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAOlC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAKD,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;gBAExB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAKhF;AAWD,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,qBAA0B,GAC/B,iBAAiB,CAsCnB;AAuDD,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAmBxF"}
|
|
@@ -1,108 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.ClientCredentialsTokenError = void 0;
|
|
4
|
-
exports.createClientCredentialsTokenSource = createClientCredentialsTokenSource;
|
|
5
|
-
exports.validateClientCredentialsOptions = validateClientCredentialsOptions;
|
|
6
|
-
const promises_1 = require("node:fs/promises");
|
|
7
|
-
const access_token_1 = require("./access-token");
|
|
8
|
-
const DEFAULT_REQUEST_TIMEOUT_MS = 10_000;
|
|
9
|
-
class ClientCredentialsTokenError extends Error {
|
|
10
|
-
status;
|
|
11
|
-
constructor(message, options = {}) {
|
|
12
|
-
super(message, options.cause === undefined ? undefined : { cause: options.cause });
|
|
13
|
-
this.name = 'ClientCredentialsTokenError';
|
|
14
|
-
this.status = options.status;
|
|
15
|
-
}
|
|
16
|
-
}
|
|
17
|
-
exports.ClientCredentialsTokenError = ClientCredentialsTokenError;
|
|
18
|
-
function createClientCredentialsTokenSource(options, deps = {}) {
|
|
19
|
-
validateClientCredentialsOptions(options);
|
|
20
|
-
const doFetch = deps.fetch ?? fetch;
|
|
21
|
-
const readSecret = deps.readSecretFile ?? ((path) => (0, promises_1.readFile)(path, 'utf8'));
|
|
22
|
-
const now = deps.now ?? Date.now;
|
|
23
|
-
const timeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
|
|
24
|
-
return async () => {
|
|
25
|
-
const secret = (await readSecret(options.clientSecretFile)).trim();
|
|
26
|
-
if (secret.length === 0) {
|
|
27
|
-
throw new ClientCredentialsTokenError(`Temporal client secret file ${options.clientSecretFile} is empty.`);
|
|
28
|
-
}
|
|
29
|
-
const sentAt = now();
|
|
30
|
-
const response = await doFetch(options.tokenEndpoint, {
|
|
31
|
-
method: 'POST',
|
|
32
|
-
headers: {
|
|
33
|
-
'Content-Type': 'application/x-www-form-urlencoded',
|
|
34
|
-
Accept: 'application/json',
|
|
35
|
-
},
|
|
36
|
-
body: new URLSearchParams({
|
|
37
|
-
grant_type: 'client_credentials',
|
|
38
|
-
client_id: options.clientId,
|
|
39
|
-
client_secret: secret,
|
|
40
|
-
}).toString(),
|
|
41
|
-
signal: AbortSignal.timeout(timeoutMs),
|
|
42
|
-
});
|
|
43
|
-
const text = await response.text();
|
|
44
|
-
if (!response.ok) {
|
|
45
|
-
throw new ClientCredentialsTokenError(`Temporal token request for client ${options.clientId} was refused ` +
|
|
46
|
-
`(HTTP ${response.status}): ${text.slice(0, 300)}`, { status: response.status });
|
|
47
|
-
}
|
|
48
|
-
return parseTokenResponse(text, options, sentAt);
|
|
49
|
-
};
|
|
50
|
-
}
|
|
51
|
-
function parseTokenResponse(text, options, sentAt) {
|
|
52
|
-
let body;
|
|
53
|
-
try {
|
|
54
|
-
body = JSON.parse(text);
|
|
55
|
-
}
|
|
56
|
-
catch (cause) {
|
|
57
|
-
throw new ClientCredentialsTokenError(`Temporal token response for client ${options.clientId} is not JSON.`, { cause });
|
|
58
|
-
}
|
|
59
|
-
const record = (typeof body === 'object' && body !== null ? body : {});
|
|
60
|
-
const value = record['access_token'];
|
|
61
|
-
if (typeof value !== 'string' || value.length === 0) {
|
|
62
|
-
throw new ClientCredentialsTokenError(`Temporal token response for client ${options.clientId} carries no access_token.`);
|
|
63
|
-
}
|
|
64
|
-
const claims = (0, access_token_1.decodeAccessTokenClaims)(value);
|
|
65
|
-
if (!claims.aud.includes(options.audience)) {
|
|
66
|
-
throw new ClientCredentialsTokenError(`Temporal token for client ${options.clientId} does not carry the required ` +
|
|
67
|
-
`audience "${options.audience}" (aud=${JSON.stringify(claims.aud)}). ` +
|
|
68
|
-
'The frontend would refuse it; the issuer-side audience mapper is missing.');
|
|
69
|
-
}
|
|
70
|
-
const expiresIn = record['expires_in'];
|
|
71
|
-
let expiresAt;
|
|
72
|
-
if (typeof expiresIn === 'number' && expiresIn > 0) {
|
|
73
|
-
expiresAt = sentAt + expiresIn * 1000;
|
|
74
|
-
}
|
|
75
|
-
else if (claims.exp !== undefined) {
|
|
76
|
-
expiresAt = claims.exp * 1000;
|
|
77
|
-
}
|
|
78
|
-
else {
|
|
79
|
-
throw new ClientCredentialsTokenError(`Temporal token for client ${options.clientId} has neither expires_in nor exp; ` +
|
|
80
|
-
'its refresh cannot be scheduled.');
|
|
81
|
-
}
|
|
82
|
-
if (expiresAt <= sentAt) {
|
|
83
|
-
throw new ClientCredentialsTokenError(`Temporal token for client ${options.clientId} was already expired when issued.`);
|
|
84
|
-
}
|
|
85
|
-
return { value, expiresAt };
|
|
86
|
-
}
|
|
87
|
-
function validateClientCredentialsOptions(options) {
|
|
88
|
-
let url;
|
|
89
|
-
try {
|
|
90
|
-
url = new URL(options.tokenEndpoint);
|
|
91
|
-
}
|
|
92
|
-
catch {
|
|
93
|
-
throw new Error(`Temporal token endpoint is not a URL: ${options.tokenEndpoint}`);
|
|
94
|
-
}
|
|
95
|
-
if (url.protocol !== 'https:' && url.protocol !== 'http:') {
|
|
96
|
-
throw new Error(`Temporal token endpoint must be http(s): ${options.tokenEndpoint}`);
|
|
97
|
-
}
|
|
98
|
-
for (const [name, value] of [
|
|
99
|
-
['clientId', options.clientId],
|
|
100
|
-
['clientSecretFile', options.clientSecretFile],
|
|
101
|
-
['audience', options.audience],
|
|
102
|
-
]) {
|
|
103
|
-
if (value.trim().length === 0) {
|
|
104
|
-
throw new Error(`Temporal client credentials: ${name} is required.`);
|
|
105
|
-
}
|
|
106
|
-
}
|
|
107
|
-
}
|
|
108
|
-
//# sourceMappingURL=client-credentials-token-source.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"client-credentials-token-source.js","sourceRoot":"","sources":["../../src/lib/client-credentials-token-source.ts"],"names":[],"mappings":";;;AAoEA,gFAyCC;AAuDD,4EAmBC;AAvLD,+CAA4C;AAE5C,iDAIwB;AAwCxB,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAG1C,MAAa,2BAA4B,SAAQ,KAAK;IAC3C,MAAM,CAAqB;IAEpC,YAAY,OAAe,EAAE,UAAgD,EAAE;QAC7E,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;CACF;AARD,kEAQC;AAWD,SAAgB,kCAAkC,CAChD,OAAiC,EACjC,OAA8B,EAAE;IAEhC,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAEzE,OAAO,KAAK,IAA0B,EAAE;QACtC,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,2BAA2B,CACnC,+BAA+B,OAAO,CAAC,gBAAgB,YAAY,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,aAAa,EAAE,MAAM;aACtB,CAAC,CAAC,QAAQ,EAAE;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,2BAA2B,CACnC,qCAAqC,OAAO,CAAC,QAAQ,eAAe;gBAClE,SAAS,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EACpD,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;QACJ,CAAC;QACD,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,OAAiC,EACjC,MAAc;IAEd,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,2BAA2B,CACnC,sCAAsC,OAAO,CAAC,QAAQ,eAAe,EACrE,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAGpE,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,2BAA2B,CACnC,sCAAsC,OAAO,CAAC,QAAQ,2BAA2B,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,sCAAuB,EAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,2BAA2B,CACnC,6BAA6B,OAAO,CAAC,QAAQ,+BAA+B;YAC1E,aAAa,OAAO,CAAC,QAAQ,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK;YACtE,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,SAAiB,CAAC;IACtB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACnD,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IACxC,CAAC;SAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACpC,SAAS,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,2BAA2B,CACnC,6BAA6B,OAAO,CAAC,QAAQ,mCAAmC;YAC9E,kCAAkC,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,2BAA2B,CACnC,6BAA6B,OAAO,CAAC,QAAQ,mCAAmC,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAGD,SAAgB,gCAAgC,CAAC,OAAiC;IAChF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,4CAA4C,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC9B,CAAC,kBAAkB,EAAE,OAAO,CAAC,gBAAgB,CAAC;QAC9C,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC;KACtB,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,eAAe,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC"}
|