Flow route queue auth, stage 3: a signing mode for Worlds on external push-based queues

オープン
  • 何か問題がありますか？
#5,427 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
15/100
issue の種類
機能追加
明瞭さ
説明が足りない
活発さ
活発
技術スタック
typescript
領域
authentication, security

調査の方向性

This is design work, so start by reading the QueueAuthMode type and its TODO in packages/world/src/queue.ts, then authorizeQueueDelivery() in packages/core/src/runtime/queue-auth.ts, and how keys are registered in @workflow/utils. The issue asks for a signed-delivery mode with key rotation and conformance tests in @workflow/world-testing, but the design is still a sketch. Done means an agreed design, then a mode whose refusals return 401 with the refused marker, never write to a run, and pass the gated conformance tests.

索引モデルが issue の本文から書いたものです。

説明

Summary

Queue.queueAuthMode (@workflow/world) tells the runtime how to authenticate a delivery that reaches the flow route (POST /.well-known/workflow/v1/flow). After #5179 and #5315 the modes are:

  • 'deny': a pull-based World. The World's worker runs inside the app's process and delivers to the route's in-process entry; the route refuses every HTTP request with a final 403. The Postgres World declares it.
  • 'allow': the route accepts HTTP because the platform already restricts who can reach it. The Vercel World declares it: only Vercel Queues can trigger the route, and the handler receives a message ID and leases the message through Vercel Queues. (Named 'skip' in @workflow/world 5.2.0; 'skip' is still accepted as a deprecated spelling.)
  • 'loopback': the Local World's shared queue key, a temporary mode until the Local World no longer delivers back to the app over its own routes.

None of these fits a World backed by an external push-based queue, such as Amazon SQS or Cloudflare Queues, that delivers to the flow route over HTTP from outside the app's platform: 'allow' leaves the route open to anyone who can reach it, and 'deny' cannot receive the delivery at all.

Stage 3: a signing mode

Add a mode in which the World signs each delivery and the runtime verifies the signature before it reads the body or touches any run.

Sketch, to be refined when the work starts:

  • The World holds the signing key and attaches a signature header to each delivery, over the body, the message ID, the attempt and a timestamp, so a captured delivery cannot be replayed later or against another message.
  • The runtime verifies with a key the World provides through the existing key-source registration in @workflow/utils, refuses a bad or stale signature with a 401 that carries the existing refused marker (so a sender can rotate keys and retry), and never writes to a run on a refusal.
  • Key rotation: accept the current and the previous key for a bounded window.
  • WORKFLOW_QUEUE_AUTH=off keeps its meaning (an emergency override, refused while dynamic workflows are enabled).
  • Conformance coverage in @workflow/world-testing, gated on the declared mode like the existing skipUnlessKeyChecked and skipUnlessDenied helpers.

The extension point is QueueAuthMode in packages/world/src/queue.ts and authorizeQueueDelivery() in packages/core/src/runtime/queue-auth.ts; a TODO next to the type points here.

Out of scope

Changing how 'deny' or 'allow' Worlds are checked, and the Local World's 'loopback' mode.

主要言語
TypeScript
スター
2.5k
フォーク
401
平均マージ
2日 36分
マージ済み PR（30日）
150

環境構築

  • Dockerfile・Docker Compose ファイルなし
  • プルリクエストのテンプレートあり
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

vercel/workflow のほかの issue

vercel/workflow の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。