10b5f655d5
HTTP (`http::*`):
- `HttpService` trait (picloud-shared) + reqwest-backed `HttpServiceImpl`
(manager-core), wired into the `Services` bundle.
- SSRF deny-list applied to the resolved IP via a custom reqwest
`dns_resolver` (covers every redirect hop + defeats DNS rebinding) plus
a literal-IP check at URL-parse time. Scheme/port restrictions, request
+ response body caps (stream-with-cap), layered timeout. Error reason is
a CIDR category, never the IP. `PICLOUD_HTTP_ALLOW_PRIVATE` dev override
(logs a startup warning).
- Rhai bridge with three-arg split `verb(url, body, opts)` (resolves the
brief's body-vs-opts contradiction; unknown opt keys throw). Body
dispatch by type; response `#{status,headers,body,body_raw}` with JSON
auto-parse; non-2xx does not throw.
- `Capability::AppHttpRequest` → existing `script:write` scope (no new
Scope variant). `SdkCallCx` gains `script_id` (attribution + User-Agent).
Cron triggers (4th trigger kind):
- Migration 0017 widens the kind/source_kind CHECKs and adds
`cron_trigger_details`. `cron`/`chrono-tz` parse + validate 6-field
schedules and IANA timezones.
- `spawn_cron_scheduler` polls due triggers and enqueues to the universal
outbox; the dispatcher delivers them (one-line match-arm extension).
Catch-up fires exactly once per trigger per tick, not once per missed
window. `ctx.event.cron` for handlers.
- `POST /api/v1/admin/apps/{id}/triggers/cron` reuses the v1.1.3
cross-app + kind!=module target check.
- Dashboard: admin-gated Triggers tab (cron create form + list).
Follow-ups: redact module backend errors at the resolver boundary (log
original at error level); pin `rhai = "=1.24"`; CHANGELOG incl. retroactive
v1.1.3 cross-app-trigger security note. Version bumps: workspace 1.1.4,
SDK 1.5, dashboard 0.10.0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
75 lines
3.5 KiB
Rust
75 lines
3.5 KiB
Rust
//! `SdkCallCx` — per-call context every stateful SDK service receives.
|
|
//!
|
|
//! Service trait methods (added by subsequent v1.1.x PRs starting with
|
|
//! KV) all take `&SdkCallCx` so they can:
|
|
//! * scope by `app_id` for cross-app isolation,
|
|
//! * audit `principal` when authenticated,
|
|
//! * carry `execution_id` / `request_id` into emitted events,
|
|
//! * bound trigger chains via `trigger_depth` / `root_execution_id`.
|
|
//!
|
|
//! The struct lives in `picloud-shared` (not `executor-core`) because
|
|
//! future service impls live in `manager-core` and the trait that hands
|
|
//! the cx in is shared by both sides. Pure value type — no handles, no
|
|
//! DB pool references, no allocations beyond what's in `Principal`.
|
|
|
|
use crate::{AppId, ExecutionId, Principal, RequestId, ScriptId, TriggerEvent};
|
|
|
|
/// Per-invocation context for every stateful SDK service call.
|
|
///
|
|
/// Constructed once at the start of an invocation by `executor-core`
|
|
/// from the incoming `ExecRequest`, then handed (by reference) to every
|
|
/// service trait method the script triggers during execution. Services
|
|
/// MUST derive `app_id` from this struct — never from script-passed
|
|
/// arguments — to preserve cross-app isolation.
|
|
#[derive(Debug, Clone)]
|
|
pub struct SdkCallCx {
|
|
/// Owning application for this invocation. Source of truth for
|
|
/// every `(app_id, …)` storage lookup the script makes.
|
|
pub app_id: AppId,
|
|
|
|
/// The script being executed. Used for audit-log attribution and
|
|
/// the default outbound-HTTP `User-Agent` (`picloud/<v>
|
|
/// (script:<id>)`). Added in v1.1.4 for the `http::*` SDK.
|
|
pub script_id: ScriptId,
|
|
|
|
/// Caller identity, when authenticated. `None` for unauthenticated
|
|
/// data-plane HTTP requests (the common case for public endpoints);
|
|
/// `Some` when the call came in via the dashboard, an API key, or a
|
|
/// future authed surface.
|
|
pub principal: Option<Principal>,
|
|
|
|
/// Unique id for THIS execution. Matches `ExecRequest.execution_id`.
|
|
pub execution_id: ExecutionId,
|
|
|
|
/// Unique id for the ingress request that started the chain. The
|
|
/// same `request_id` is shared across every execution triggered by
|
|
/// the same request (direct + trigger fan-out).
|
|
pub request_id: RequestId,
|
|
|
|
/// `0` for direct invocations (HTTP request, manual run). Each
|
|
/// indirect invocation through the triggers framework (v1.1.1)
|
|
/// increments this; the dispatcher rejects beyond a configured
|
|
/// ceiling to prevent runaway feedback loops.
|
|
pub trigger_depth: u32,
|
|
|
|
/// `== execution_id` when `trigger_depth == 0`; otherwise the
|
|
/// `execution_id` of the original ingress execution. Lets the audit
|
|
/// log group every fan-out execution under the originating event.
|
|
pub root_execution_id: ExecutionId,
|
|
|
|
/// `true` only when this invocation is a `dead_letter` trigger
|
|
/// handler. Set by the dispatcher when it picks an outbox row
|
|
/// whose trigger has `kind = 'dead_letter'`. The retry / dead-
|
|
/// letter machinery short-circuits when this is set: handlers
|
|
/// execute once, with no retry, and a failed run can NEVER be
|
|
/// dead-lettered itself (design notes §4 recursion-stop rule).
|
|
/// `false` for every other invocation, including the script
|
|
/// being used as a non-DL trigger handler.
|
|
pub is_dead_letter_handler: bool,
|
|
|
|
/// The event that fired this script, when it's a triggered
|
|
/// invocation. `None` for direct ingress (HTTP request, manual
|
|
/// run). Surfaced to scripts as `ctx.event`.
|
|
pub event: Option<TriggerEvent>,
|
|
}
|