security: require trusted workflow principals - #272
Conversation
Includes branch changelog.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b796e5260e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| getUser(user) { | ||
| if (!user) | ||
| return this.api.defaultUser; | ||
| else | ||
| return user; | ||
|
|
||
| if (!user) throw new Error('A trusted authenticated principal is required'); | ||
| return user; |
There was a problem hiding this comment.
When a runtime integration calls api.engine.upgrade(model, afterNodeIds), that method bypasses this new principal check entirely and invokes server.engine.upgrade without any user argument. The server implementation then replaces the stored source for every matching running instance, so an untrusted runtime client can still perform a cross-instance workflow mutation despite the new authenticated-principal boundary; route upgrade through this check or move it to the privileged API.
Useful? React with 👍 / 👎.
| continue with the execution of a particular item that is in a wait state, typically a user task | ||
| */ | ||
| invoke(query, data: {}, user?: ISecureUser, options?:IEngineOptions): Promise<IExecution>; | ||
| invoke(query, data: {}, user: ISecureUser, options?:IEngineOptions): Promise<IExecution>; |
There was a problem hiding this comment.
These interface changes do not affect the normal exported API type: BPMNAPI.engine is declared as the concrete APIEngine, whose start, invoke, assign, throwMessage, throwSignal, and startEvent implementations still declare user?. Consequently, a TypeScript consumer using new BPMNAPI(...).engine.invoke(query, data) compiles successfully and only fails at runtime, rather than receiving the intended compile-time requirement; update the concrete method signatures as well.
Useful? React with 👍 / 👎.
1 participant
Summary
Removes implicit or caller-controlled workflow identity from the engine boundary.
CHANGELOG.mdStack
Depends on
refactor/separate-admin-api(#2). There is no server-side #3 change.Validation