inngest 4.2.5 → 4.2.6

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # inngest
 
+## 4.2.6
+
+### Patch Changes
+
+- [#1492](https://github.com/inngest/inngest-js/pull/1492) [`68dcd8aa`](https://github.com/inngest/inngest-js/commit/68dcd8aa3810a1285dca62321d63c39476c75840) Thanks [@amh4r](https://github.com/amh4r)! - Reduce response info when unauthorized
+
+- [#1490](https://github.com/inngest/inngest-js/pull/1490) [`a8027116`](https://github.com/inngest/inngest-js/commit/a80271163fa5e28b316f218cf5fa81a5600c5048) Thanks [@amh4r](https://github.com/amh4r)! - Authed introspection returns partial signing key hash
+
 ## 4.2.5
 
 ### Patch Changes

package/api/api.cjs

@@ -2,8 +2,8 @@ const require_rolldown_runtime = require('../_virtual/rolldown_runtime.cjs');
 const require_errors = require('../helpers/errors.cjs');
 const require_types = require('../types.cjs');
 const require_schema = require('./schema.cjs');
-const require_net = require('../helpers/net.cjs');
 const require_strings = require('../helpers/strings.cjs');
+const require_net = require('../helpers/net.cjs');
 let zod_v3 = require("zod/v3");
 
 //#region src/api/api.ts

package/api/api.js

@@ -1,8 +1,8 @@
 import { getErrorMessage } from "../helpers/errors.js";
 import { err, ok } from "../types.js";
 import { batchSchema, errorSchema, stepSchema } from "./schema.js";
-import { fetchWithAuthFallback } from "../helpers/net.js";
 import { hashSigningKey } from "../helpers/strings.js";
+import { fetchWithAuthFallback } from "../helpers/net.js";
 import { z } from "zod/v3";
 
 //#region src/api/api.ts

package/components/Inngest.cjs

@@ -3,8 +3,8 @@ const require_env = require('../helpers/env.cjs');
 const require_errors = require('../helpers/errors.cjs');
 const require_types = require('../types.cjs');
 const require_log = require('../helpers/log.cjs');
-const require_promises = require('../helpers/promises.cjs');
 const require_strings = require('../helpers/strings.cjs');
+const require_promises = require('../helpers/promises.cjs');
 const require_als = require('./execution/als.cjs');
 const require_api = require('../api/api.cjs');
 const require_crypto = require('../helpers/crypto.cjs');

package/components/Inngest.js

@@ -3,8 +3,8 @@ import { getFetch, getProcessEnv, inngestHeaders, normalizeUrl, parseAsBoolean,
 import { fixEventKeyMissingSteps } from "../helpers/errors.js";
 import { sendEventResponseSchema } from "../types.js";
 import { formatLogMessage } from "../helpers/log.js";
-import { retryWithBackoff } from "../helpers/promises.js";
 import { stringify } from "../helpers/strings.js";
+import { retryWithBackoff } from "../helpers/promises.js";
 import { getAsyncCtx } from "./execution/als.js";
 import { InngestApi } from "../api/api.js";
 import { createEntropy } from "../helpers/crypto.js";

package/components/InngestCommHandler.cjs

@@ -9,10 +9,10 @@ const require_InngestExecution = require('./execution/InngestExecution.cjs');
 const require_types$1 = require('../helpers/types.cjs');
 const require_log = require('../helpers/log.cjs');
 const require_functions = require('../helpers/functions.cjs');
+const require_strings = require('../helpers/strings.cjs');
 const require_net = require('../helpers/net.cjs');
 const require_promises = require('../helpers/promises.cjs');
 const require_ServerTiming = require('../helpers/ServerTiming.cjs');
-const require_strings = require('../helpers/strings.cjs');
 const require_stream = require('../helpers/stream.cjs');
 const require_als = require('./execution/als.cjs');
 const require_InngestFunction = require('./InngestFunction.cjs');
@@ -604,7 +604,21 @@ var InngestCommHandler = class {
 				mwInstances
 			}));
 			actionResponseVersion = rawRes.version;
-			return prepareActionRes(rawRes);
+			const prepared = await prepareActionRes(rawRes);
+			if (!(await signatureValidation).success) {
+				const filteredHeaders = {};
+				for (const [k, v] of Object.entries(prepared.headers)) {
+					const lower = k.toLowerCase();
+					if (lower === "user-agent") continue;
+					if (lower.startsWith("x-inngest-") && lower !== require_consts.headerKeys.SdkHandled.toLowerCase()) continue;
+					filteredHeaders[k] = v;
+				}
+				return {
+					...prepared,
+					headers: filteredHeaders
+				};
+			}
+			return prepared;
 		};
 		let chainResult;
 		if (method === "POST") {
@@ -782,19 +796,22 @@ var InngestCommHandler = class {
 				if (!forceExecution && isMissingBody) {
 					this.client[require_Inngest.internalLoggerSymbol].error("Missing body when executing, possibly due to missing request body middleware");
 					return {
-						status: 500,
+						status: 401,
 						headers: { "Content-Type": "application/json" },
-						body: require_strings.stringify(require_errors.serializeError(/* @__PURE__ */ new Error("Missing request body when executing, possibly due to missing request body middleware"))),
+						body: require_strings.stringify({ message: "Unauthorized" }),
 						version: void 0
 					};
 				}
 				const validationResult = await signatureValidation;
-				if (!validationResult.success) return {
-					status: 401,
-					headers: { "Content-Type": "application/json" },
-					body: require_strings.stringify(require_errors.serializeError(validationResult.err)),
-					version: void 0
-				};
+				if (!validationResult.success) {
+					this.client[require_Inngest.internalLoggerSymbol].error({ err: validationResult.err }, "Signature validation failed");
+					return {
+						status: 401,
+						headers: { "Content-Type": "application/json" },
+						body: require_strings.stringify({ message: "Unauthorized" }),
+						version: void 0
+					};
+				}
 				let fn;
 				let fnId;
 				if (forceExecution) {
@@ -993,17 +1010,31 @@ var InngestCommHandler = class {
 				}
 			}
 			const env = (await getHeaders())[require_consts.headerKeys.Environment] ?? null;
-			if (method === "GET") return {
-				status: 200,
-				body: require_strings.stringify(await this.introspectionBody({
-					actions,
-					env,
-					signatureValidation,
-					url
-				})),
-				headers: { "Content-Type": "application/json" },
-				version: void 0
-			};
+			if (method === "GET") {
+				if (this.client.mode === "cloud") {
+					const validationResult = await signatureValidation;
+					if (!validationResult.success) {
+						this.client[require_Inngest.internalLoggerSymbol].error({ err: validationResult.err }, "Signature validation failed");
+						return {
+							status: 401,
+							headers: { "Content-Type": "application/json" },
+							body: require_strings.stringify({ message: "Unauthorized" }),
+							version: void 0
+						};
+					}
+				}
+				return {
+					status: 200,
+					body: require_strings.stringify(await this.introspectionBody({
+						actions,
+						env,
+						signatureValidation,
+						url
+					})),
+					headers: { "Content-Type": "application/json" },
+					version: void 0
+				};
+			}
 			if (method === "PUT") {
 				const [deployId, inBandSyncRequested] = await Promise.all([actions.queryStringWithDefaults("processing deployment request", require_consts.queryKeys.DeployId).then((deployId$1) => {
 					return deployId$1 === "undefined" ? void 0 : deployId$1;
@@ -1084,11 +1115,8 @@ var InngestCommHandler = class {
 		this.client[require_Inngest.internalLoggerSymbol].error({ method }, "Received unhandled HTTP method; expected POST, PUT, or GET");
 		return {
 			status: 405,
-			body: JSON.stringify({
-				message: `No action found; expected POST, PUT, or GET but received "${method}"`,
-				mode: this.client.mode
-			}),
-			headers: {},
+			body: JSON.stringify({ message: "Method not allowed" }),
+			headers: { "Content-Type": "application/json" },
 			version: void 0
 		};
 	}
@@ -1258,6 +1286,10 @@ var InngestCommHandler = class {
 		};
 		if (this.client.mode === "cloud") try {
 			if (!(await signatureValidation).success) throw new Error("Signature validation failed");
+			let signingKeyHash = null;
+			if (this.hashedSigningKey) signingKeyHash = require_strings.removeSigningKeyPrefix(this.hashedSigningKey).slice(0, 12);
+			let signingKeyFallbackHash = null;
+			if (this.hashedSigningKeyFallback) signingKeyFallbackHash = require_strings.removeSigningKeyPrefix(this.hashedSigningKeyFallback).slice(0, 12);
 			introspection = {
 				...introspection,
 				authentication_succeeded: true,
@@ -1280,8 +1312,8 @@ var InngestCommHandler = class {
 				sdk_version: require_version.version,
 				serve_origin: this.serveOrigin ?? null,
 				serve_path: this.servePath ?? null,
-				signing_key_fallback_hash: this.hashedSigningKeyFallback ?? null,
-				signing_key_hash: this.hashedSigningKey ?? null
+				signing_key_fallback_hash: signingKeyFallbackHash,
+				signing_key_hash: signingKeyHash
 			};
 		} catch {
 			introspection = { ...introspection };