okengine 0.22.0 → 0.23.1

package/src/kernel/http-frame.ts

@@ -0,0 +1,203 @@
+/**
+ * HTTP wire frame stored on a wide event — query, headers, status.
+ *
+ * Credential headers are replaced before the row is written. The body stays
+ * on `input` / `output`; this frame is the rest of the message.
+ */
+
+import type { RunHttpFrame } from "../runs/types.ts";
+
+/** Replacement for credential header and query values. */
+export const HTTP_FRAME_REDACTED = "[redacted]";
+
+const EXACT_HEADERS = new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "dpop",
+]);
+
+/**
+ * Build the Request a Console invoke would have sent for an HTTP flow.
+ *
+ * Call API runs `execute` directly, so there is no socket request. The frame
+ * still needs a method, path, query, and the headers the invoke actually
+ * uses (`accept`, `x-oke-client: console`, and `content-type` when there is a body).
+ * The operator's browser user-agent is not copied onto the flow.
+ *
+ * @param trigger - HTTP method and path template
+ * @param options - Path params and the assembled flow input
+ */
+export function requestForHttpInvoke(
+  trigger: { readonly method: string; readonly path: string },
+  options: {
+    readonly pathParams?: Readonly<Record<string, string>>;
+    readonly input?: unknown;
+  } = {},
+): Request {
+  let path = trigger.path;
+  const params = options.pathParams ?? {};
+  for (const [key, value] of Object.entries(params)) {
+    path = path.replaceAll(`:${key}`, encodeURIComponent(value));
+  }
+  const url = new URL(path, "http://127.0.0.1");
+  const method = trigger.method.toUpperCase();
+  const headers = new Headers({ accept: "application/json", "x-oke-client": "console" });
+  if (!methodCarriesBody(method)) {
+    appendScalarQuery(url, options.input, new Set(Object.keys(params)));
+    return new Request(url.href, { method, headers });
+  }
+  headers.set("content-type", "application/json");
+  const body = options.input === undefined ? undefined : JSON.stringify(options.input);
+  return new Request(url.href, {
+    method,
+    headers,
+    ...(body !== undefined ? { body } : {}),
+  });
+}
+
+/**
+ * Build the wire frame for an HTTP run.
+ *
+ * Does not read the body. Safe to call after the handler has consumed it,
+ * including streamed responses.
+ *
+ * @param request - Incoming request
+ * @param response - Final response after `onResponse`, when one exists
+ */
+export function captureHttpFrame(request: Request, response: Response | undefined): RunHttpFrame {
+  const url = new URL(request.url);
+  const query: Record<string, string> = {};
+  for (const [key, value] of url.searchParams) {
+    query[key] = sensitiveQuery(key) ? HTTP_FRAME_REDACTED : value;
+  }
+  return redactHttpFrame({
+    request: {
+      method: request.method,
+      path: url.pathname,
+      query,
+      headers: headerMap(request.headers),
+    },
+    ...(response !== undefined
+      ? { response: { status: response.status, headers: headerMap(response.headers) } }
+      : {}),
+  });
+}
+
+/**
+ * Mask credential headers and query values on a stored frame.
+ *
+ * Applied again at Console projection so a row that skipped capture still
+ * does not show secrets.
+ *
+ * @param frame - Stored HTTP frame
+ */
+export function redactHttpFrame(frame: RunHttpFrame): RunHttpFrame {
+  return {
+    request: {
+      method: frame.request.method,
+      path: frame.request.path,
+      query: redactQuery(frame.request.query),
+      headers: redactHeaders(frame.request.headers),
+    },
+    ...(frame.response !== undefined
+      ? {
+          response: {
+            status: frame.response.status,
+            headers: redactHeaders(frame.response.headers),
+          },
+        }
+      : {}),
+  };
+}
+
+/**
+ * True when a header name carries a credential.
+ *
+ * @param name - Lower-case header name
+ */
+export function sensitiveHeader(name: string): boolean {
+  const key = name.toLowerCase();
+  if (EXACT_HEADERS.has(key)) return true;
+  if (key === "idempotency-key") return false;
+  return (
+    key.includes("token") ||
+    key.includes("secret") ||
+    key.includes("api-key") ||
+    key.endsWith("-key") ||
+    key.endsWith("_key")
+  );
+}
+
+function methodCarriesBody(method: string): boolean {
+  switch (method) {
+    case "GET":
+    case "HEAD":
+    case "DELETE":
+      return false;
+    default:
+      return true;
+  }
+}
+
+function appendScalarQuery(url: URL, input: unknown, skip: ReadonlySet<string>): void {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) return;
+  for (const [key, value] of Object.entries(input as Record<string, unknown>)) {
+    if (skip.has(key)) continue;
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      url.searchParams.set(key, String(value));
+    }
+  }
+}
+
+function sensitiveQuery(name: string): boolean {
+  const key = name.toLowerCase();
+  return (
+    key === "token" ||
+    key.endsWith("_token") ||
+    key.endsWith("-token") ||
+    key === "api_key" ||
+    key === "apikey" ||
+    key === "api-key" ||
+    key === "secret" ||
+    key === "password" ||
+    key === "access_token" ||
+    key === "refresh_token"
+  );
+}
+
+function headerMap(headers: Headers): Record<string, string> {
+  const out: Record<string, string> = {};
+  headers.forEach((value, key) => {
+    const name = key.toLowerCase();
+    if (sensitiveHeader(name)) {
+      out[name] = HTTP_FRAME_REDACTED;
+      return;
+    }
+    const prev = out[name];
+    out[name] = prev === undefined ? value : `${prev}, ${value}`;
+  });
+  return sortRecord(out);
+}
+
+function redactHeaders(headers: Readonly<Record<string, string>>): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(headers)) {
+    out[key.toLowerCase()] = sensitiveHeader(key) ? HTTP_FRAME_REDACTED : value;
+  }
+  return sortRecord(out);
+}
+
+function redactQuery(query: Readonly<Record<string, string>>): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(query)) {
+    out[key] = sensitiveQuery(key) ? HTTP_FRAME_REDACTED : value;
+  }
+  return sortRecord(out);
+}
+
+function sortRecord(record: Record<string, string>): Record<string, string> {
+  return Object.fromEntries(Object.entries(record).sort(([a], [b]) => a.localeCompare(b)));
+}

package/src/kernel/idempotency.test.ts

@@ -353,7 +353,8 @@ describe("HTTP idempotency", () => {
     expect(step1).toEqual(["step1"]);
     blockers[0]!();
     blockers[1]!();
-    expect((await hung).status).toBe(200);
+    // The forfeited holder kept the old lease token. Its later write is rejected.
+    await expect(hung).rejects.toThrow(/OKE1074/);
     expect((await resumed).status).toBe(200);
     expect(step1).toEqual(["step1"]);
   }, 30_000);

package/src/kernel/journal.test.ts

@@ -5,6 +5,8 @@
 
 import { describe, expect, test } from "bun:test";
 
+import { runDurable } from "../elements/clock/durable.ts";
+import { flow } from "./flow.ts";
 import {
   createJournal,
   createMemoryJournalStore,
@@ -13,6 +15,7 @@ import {
   isJournalSuspend,
   JOURNAL_DEFAULT_LEASE_MS,
 } from "./journal.ts";
+import { OkeError } from "./errors.ts";
 
 describe("journal lease (memory store)", () => {
   test("built-in stores expose the lease surface", () => {
@@ -139,4 +142,115 @@ describe("journal lease (memory store)", () => {
     const again = await journal.resume(session.runId);
     expect(await again.step("s", () => 2)).toBe(1);
   });
+
+  test("a stale lease holder cannot append", async () => {
+    let t = 1_000;
+    const store = createMemoryJournalStore();
+    const a = createJournal({
+      store,
+      now: () => t,
+      lease: { instanceId: "a", leaseMs: 100 },
+      codeVersion: "v1",
+    });
+    const session = await a.start("charge");
+    await session.step("create-intent", () => ({ id: "pi_1" }));
+    t = 1_200;
+    const b = createJournal({
+      store,
+      now: () => t,
+      lease: { instanceId: "b", leaseMs: 100 },
+      codeVersion: "v1",
+    });
+    await b.resume(session.runId);
+    try {
+      await session.step("capture", () => ({ ok: true }));
+      expect.unreachable("stale holder must be rejected");
+    } catch (err) {
+      expect(err).toBeInstanceOf(OkeError);
+      expect((err as OkeError).code).toBe(1074);
+    }
+  });
+
+  test("replay throws when the next call does not match the journal", async () => {
+    const store = createMemoryJournalStore();
+    const journal = createJournal({ store, now: () => 1, codeVersion: "v1" });
+    const session = await journal.start("charge");
+    await session.step("a", () => 1);
+    const resumed = await journal.resume(session.runId);
+    try {
+      await resumed.step("b", () => 2);
+      expect.unreachable("divergent replay must throw");
+    } catch (err) {
+      expect(err).toBeInstanceOf(OkeError);
+      expect((err as OkeError).code).toBe(1075);
+    }
+  });
+
+  test("a non-JSON journal value is OKE1077", async () => {
+    const store = createMemoryJournalStore();
+    const session = await createJournal({ store, now: () => 1 }).start("charge");
+    try {
+      await session.effect("call", "charge", () => 1n);
+      expect.unreachable("bigint must not journal");
+    } catch (err) {
+      expect(err).toBeInstanceOf(OkeError);
+      expect((err as OkeError).code).toBe(1077);
+    }
+  });
+
+  test("resume rejects a run stamped with another code version", async () => {
+    const store = createMemoryJournalStore();
+    const started = await createJournal({ store, now: () => 1, codeVersion: "v1" }).start("charge");
+    try {
+      await createJournal({ store, now: () => 2, codeVersion: "v2" }).resume(started.runId);
+      expect.unreachable("version skew must throw");
+    } catch (err) {
+      expect(err).toBeInstanceOf(OkeError);
+      expect((err as OkeError).code).toBe(1076);
+    }
+  });
+});
+
+describe("journal fetch snapshot", () => {
+  test("a durable flow replays fx.fetch without calling the network again", async () => {
+    const store = createMemoryJournalStore();
+    let calls = 0;
+    const original = globalThis.fetch;
+    globalThis.fetch = (async () => {
+      calls += 1;
+      return new Response("hello", { status: 201 });
+    }) as unknown as typeof fetch;
+    const load = flow("load", {
+      durable: true,
+      do: async (_input, fx) => {
+        const res = await fx.step("load", () => fx.fetch("https://example.com/data"));
+        return { status: res.status, text: await res.text() };
+      },
+    });
+    try {
+      const first = await runDurable({
+        flow: load,
+        input: {},
+        journalStore: store,
+        now: () => 1,
+      });
+      expect(first).toMatchObject({ status: "completed", output: { status: 201, text: "hello" } });
+      expect(calls).toBe(1);
+      const row = await store.get(first.runId);
+      expect(row?.entries.some((entry) => entry.kind === "step" && entry.name === "load")).toBe(
+        true,
+      );
+      const replay = await createJournal({ store, now: () => 2 }).resume(first.runId);
+      const again = await replay.step("load", () => {
+        calls += 1;
+        return new Response("nope", { status: 500 });
+      });
+      expect(again).toBeInstanceOf(Response);
+      expect(again.status).toBe(201);
+      expect(await again.text()).toBe("hello");
+      expect(calls).toBe(1);
+    } finally {
+      globalThis.fetch = original;
+    }
+  });
 });