security: remove caller-supplied workflow identity - #39
Conversation
Includes branch changelog.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2fb61ae462
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| async start(name, data = {}, options = {}): Promise<IInstanceData> { | ||
| const ret = await this.client.post('engine/start', | ||
| { name, data, user, options }); | ||
| { name, data, options }); |
There was a problem hiding this comment.
Keep legacy principals out of the options field
When an existing JavaScript consumer uses the previous start(name, data, user, options) call shape, this signature binds user to options, serializes that principal under options, and silently discards the real fourth-argument options; invoke, throwMessage, and throwSignal have the same positional shift. This both defeats the stated identity-removal guarantee for unmigrated consumers and can change workflow behavior such as dropping noWait, so retain and ignore a legacy user slot or otherwise prevent old principals from being reinterpreted as options.
Useful? React with 👍 / 👎.
| constructor(host, port, apiKey, accessToken = null) { | ||
| super(host, port, apiKey, '/admin/api2/', accessToken); |
There was a problem hiding this comment.
Forward the admin access token during model imports
When BPMNAdminClientV1 or BPMNAdminClient2 is constructed with an access token and model.import() is called, the token accepted here is never sent: imports bypass request() and build upload headers containing only x-api-key. Servers whose principal resolver requires the bearer token will therefore reject or fail to attribute imports even though every other admin model operation carries it; include the authorization header in the upload options as well.
Useful? React with 👍 / 👎.
Summary
Makes client requests identity-neutral and delegates principal resolution to the trusted web layer.
CHANGELOG.mdStack
Depends on
refactor/canonical-api-v1(#3). This is client #4.Validation