Repository navigation
hub: bind workflow run token to its allocation's runs (CL-9906) - #1105
Merged
Merged
Conversation
Extract createWorkflowRunAuthenticator unchanged; the cross-run and released-allocation cases fail against it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem: the workflow run authenticator accepted any sidecar token and returned the scope of whatever run address the caller named, so a token for run A authenticated as run B and a released sidecar's token kept working.
Fix: extract it to apps/hub/src/workflow-run-authenticator.ts and resolve the token through Interchange's bound
createSidecarCredentialResolver(live allocation only). The run must share the allocation's anchor run id (the anchor itself or its children) and tenant.Reproduced: e2e/hub/workflow-run-authenticator.test.ts failed the cross-run and released-allocation cases against the unchanged extracted code, passes after the fix.
Gates: focused suite (own migrated schema), typecheck, lint, fmt:check. Full test run skipped (machine load).