data-primals-engine 1.1.1 → 1.1.3

package/src/modules/workflow.js

@@ -4,10 +4,11 @@ import schedule from "node-schedule";
 import {ObjectId} from "mongodb";
 import crypto from "node:crypto";
 
-import {VM, VMScript} from 'vm2';
+import ivm from 'isolated-vm';
+
 import {Logger} from "../gameObject.js";
 import {deleteData, insertData, patchData, searchData} from "./data.js";
-import {maxExecutionsByStep, maxWorkflowSteps} from "../constants.js";
+import {maxExecutionsByStep, maxWorkflowSteps, timeoutVM} from "../constants.js";
 import {ChatOpenAI} from "@langchain/openai";
 import {ChatGoogleGenerativeAI} from "@langchain/google-genai";
 import {ChatPromptTemplate} from "@langchain/core/prompts";
@@ -180,68 +181,99 @@ export async function scheduleWorkflowTriggers() {
 }
 
 
-/* Remplacement de la fonction executeSafeJavascript
-async function executeWithIsolatedVm(actionDef, context) {
+export async function executeSafeJavascript(actionDef, context, user) {
     const code = actionDef.script;
-    const isolate = new ivm.Isolate({ memoryLimit: 128 }); // Limite de 128MB de mémoire
+    const collectedLogs = [];
+    const isolate = new ivm.Isolate({ memoryLimit: 128 }); // 128MB memory limit
 
     try {
         const vmContext = await isolate.createContext();
         const jail = vmContext.global;
 
-        // On expose une fonction 'log' sécurisée à l'intérieur de la VM.
-        // C'est une référence, pas la fonction elle-même.
-        await jail.set('log', new ivm.Reference(function(...args) {
-            // On peut préfixer les logs pour savoir qu'ils viennent de la VM
-            logger.info('[VM Script Log]', ...args);
+        // Helper to create a secure reference for our API functions
+        const createJailFunction = (fn) => new ivm.Reference(fn);
+
+        // 1. Build the sandboxed API
+        await jail.set('db', createJailFunction({
+            create: (modelName, dataObject) => insertData(modelName, dataObject, {}, user),
+            find: async (modelName, filter) => {
+                const result = await searchData({ user, query: { model: modelName, filter } });
+                return new ivm.ExternalCopy(result.data).copyInto();
+            },
+            findOne: async (modelName, filter) => {
+                const result = await searchData({ user, query: { model: modelName, filter, limit: 1 } });
+                return new ivm.ExternalCopy(result.data?.[0] || null).copyInto();
+            },
+            update: (modelName, filter, updateObject) => patchData(modelName, filter, updateObject, {}, user),
+            delete: (modelName, filter) => deleteData(modelName, null, filter, user)
         }));
 
-        // On injecte les données du contexte. Elles sont COPIÉES, pas référencées.
-        // C'est une caractéristique de sécurité clé.
-        await jail.set('contextData', new ivm.ExternalCopy(context).copyInto());
-        // On peut aussi exposer des fonctions spécifiques de votre application
-        // await jail.set('myApiFunction', new ivm.Reference(async (params) => { ... }));
+        const createLoggerFunction = (level) => {
+            return (...args) => {
+                const finalMessage = logger.trace(level, '[VM Script]', ...args);
+                collectedLogs.push({
+                    level: level,
+                    message: finalMessage,
+                    timestamp: new Date().toISOString()
+                });
+            };
+        };
 
-        // On compile le script
-        const script = await isolate.compileScript(code);
+        await jail.set('logger', createJailFunction({
+            info: createLoggerFunction('info'),
+            warn: createLoggerFunction('warn'),
+            error: createLoggerFunction('error')
+        }));
+
+        await jail.set('env', createJailFunction({
+            get: async (variableName) => {
+                if (!variableName) return null;
+                const result = await searchData({ user, query: { model: 'env', filter: { name: variableName }, limit: 1 } });
+                return new ivm.ExternalCopy(result.data?.[0]?.value || null).copyInto();
+            },
+            getAll: async () => {
+                const result = await searchData({ user, query: { model: 'env' } });
+                const envObject = result.data.reduce((acc, v) => {
+                    acc[v.name] = v.value;
+                    return acc;
+                }, {});
+                return new ivm.ExternalCopy(envObject).copyInto();
+            }
+        }));
 
-        // On exécute le script avec un timeout
-        const result = await script.run(vmContext, { timeout: 1000 });
+        // Inject the context data securely
+        await jail.set('context', new ivm.ExternalCopy(context).copyInto());
 
-        // Le résultat est une référence, on le copie pour l'utiliser dans notre contexte principal.
-        return result;
+        // 2. Prepare and run the script
+        // The script is wrapped in an async IIFE to handle promises correctly
+        const fullScript = `
+            (async () => {
+                ${code}
+            })();
+        `;
+
+        const script = await isolate.compileScript(fullScript);
+        const result = await script.run(vmContext, { timeout: timeoutVM, promise: true });
+
+        // The result is returned as an ExternalCopy, we need to copy it out
+        return { success: true, data: result, logs: collectedLogs };
 
     } catch (error) {
-        logger.error("Error executing script with isolated-vm:", error.stack);
-        // On propage une erreur propre
-        throw new Error(`Script execution failed: ${error.message}`);
+        const errorMessage = `Script execution failed: ${error.message}`;
+        const finalErrorMessage = logger.trace('critical', `[VM Script] ${errorMessage}\n${error.stack}`);
+        collectedLogs.push({
+            level: 'critical',
+            message: finalErrorMessage,
+            timestamp: new Date().toISOString()
+        });
+        return { success: false, message: errorMessage, logs: collectedLogs };
     } finally {
-        // TRÈS IMPORTANT : Toujours libérer l'isolate pour éviter les fuites de mémoire.
+        // 3. CRUCIAL: Dispose of the isolate to prevent memory leaks
         if (isolate && !isolate.isDisposed) {
             isolate.dispose();
         }
     }
 }
-REQUIRES NODE >=20
- */
-async function executeSafeJavascript(actionDef, context) {
-    const code = actionDef.script;
-    const vm = new VM({
-        timeout: 1000, // Time out after 1 second
-        sandbox: context, // Pass the context object
-        console: 'redirect', // Redirect console output
-        require: false, // Disable require
-        wasm: false // disable WebAssembly
-    });
-
-    try {
-        const script = new VMScript(code);
-        return vm.run(script);
-    } catch (error) {
-        console.error("Error executing script:", error);
-        throw error; // or return an error object
-    }
-}
 
 /**
  * Handles the 'Webhook' workflow action.
@@ -734,10 +766,8 @@ export async function executeStepAction(actionDef, contextData, user, dbCollecti
             result = await handleSendEmailAction(actionDef, contextData, user);
             break;
         case 'ExecuteScript':
-            result = await executeSafeJavascript(actionDef, contextData);
+            result = await executeSafeJavascript(actionDef, contextData, user);
             break;
-
-            // ... autres cases à venir ...
         default:
             logger.error(`[executeStepAction] Unknown action type: ${actionDef.type}`);
             return { success: false, message: `Unknown action type: ${actionDef.type}` };
@@ -1244,7 +1274,7 @@ export async function processWorkflowRun(workflowRunId, user) {
             );
 
             let stepSucceeded = true;
-            let stepError = null;
+            let logInfo = null;
             let conditionsMet = true;
 
             try {
@@ -1266,8 +1296,10 @@ export async function processWorkflowRun(workflowRunId, user) {
                             const actionResult = await workflowModule.executeStepAction(actionDef, contextData, user, dbCollection);
                             if (!actionResult.success) {
                                 stepSucceeded = false;
-                                stepError = actionResult.message || `Action ${actionDef.name || actionId} failed.`;
+                                logInfo = actionResult.message || `Action ${actionDef.name || actionId} failed.`;
                                 break;
+                            }else{
+                                logInfo = `Action ${actionDef.name || actionId} : ${actionResult.message}`;
                             }
                             if (actionResult.updatedContext) {
                                 contextData = { ...contextData, ...actionResult.updatedContext };
@@ -1281,7 +1313,7 @@ export async function processWorkflowRun(workflowRunId, user) {
             } catch (error) {
                 logger.error(`[processWorkflowRun] Run ID: ${runId}, Step ID: ${currentStepId}: Error during condition/action execution: ${error.message}`);
                 stepSucceeded = false;
-                stepError = error.message;
+                logInfo = error.message;
             }
 
             // --- 9. Détermination de la prochaine étape ---
@@ -1298,13 +1330,13 @@ export async function processWorkflowRun(workflowRunId, user) {
                 }
             } else {
                 // CHEMIN ÉCHEC/BRANCHE : Une action a échoué OU les conditions n'ont pas été remplies.
-                const reason = stepError ? `Action failed: ${stepError}` : 'Step conditions not met.';
+                const reason = logInfo ? `Action failed: ${logInfo}` : 'Step conditions not met.';
                 logger.warn(`[processWorkflowRun] Run ID: ${runId}, Step ID: ${currentStepId}: Taking failure/branching path. Reason: ${reason}`);
                 nextStepId = currentStepDef.onFailureStep;
 
                 if (!nextStepId || !isObjectId(nextStepId)) {
                     // Fin du workflow. Le statut est 'failed' seulement si une vraie erreur s'est produite.
-                    finalStatusForRun = stepError ? 'failed' : 'completed';
+                    finalStatusForRun = logInfo ? 'failed' : 'completed';
                     nextStepId = null;
                 }
             }
@@ -1317,9 +1349,7 @@ export async function processWorkflowRun(workflowRunId, user) {
                 updatePayload.status = finalStatusForRun;
                 updatePayload.completedAt = new Date();
                 updatePayload.currentStep = null;
-                if (finalStatusForRun === 'failed' && stepError) {
-                    updatePayload.error = stepError;
-                }
+                updatePayload.log = logInfo;
             } else {
                 updatePayload.currentStep = currentStepId;
             }

package/test/data.integration.test.js

@@ -723,7 +723,7 @@ describe('Intégration des fonctions CRUD de données avec validation complète'
             const packId = packInsertResult.insertedId;
 
             // 3. Appeler la fonction à tester avec la nouvelle signature
-            const result = await installPack(console, packId, currentTestUser, 'en');
+            const result = await installPack(packId, currentTestUser, 'en');
 
             // 4. Assertions sur le résumé de l'installation
             expect(result.success, `L'installation du pack a échoué: ${result.errors?.join('; ')}`).toBe(true);
@@ -776,7 +776,7 @@ describe('Intégration des fonctions CRUD de données avec validation complète'
             const packInsertResult = await testPacksColInstance.insertOne(mockPackWithInvalidModel);
             const packId = packInsertResult.insertedId;
 
-            const result = await installPack(console, packId, currentTestUser, 'en');
+            const result = await installPack(packId, currentTestUser, 'en');
 
             // Le succès global est faux s'il y a des erreurs
             expect(result.success).toBe(false);