hanzoai/base
2
0
Fork 0
mirror of https://github.com/hanzoai/base.git synced 2026-10-21 03:41:50 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,284 Commits 5 Branches 401 Tags
dev
Commit Graph
5 Commits
Author SHA1 Message Date
zeekay 157b7127ab security: fix critical and high findings from red team review 
- C1: add orgId field to _tasks/_workflows, filter all queries by org
- C2: validate spaceID/orgID with regex before Temporal visibility queries
- H1: add sync.RWMutex to orgClients map (prevent concurrent map panic)
- H2: atomic FailTask with CASE expression (eliminate TOCTOU race)
- H4: extractCreator uses authenticated user ID, not raw headers
- Add orgId to collection schemas, store methods, and API filters
 2026-03-02 01:02:45 -07:00
zeekay 05bfa4c91c fix(tasks): critical race condition + signal-driven workflows 
- durable.go: add sync.RWMutex to orgClients map — concurrent writes
  to unprotected map caused panics under load. Double-checked locking
  pattern for connection caching.
- workflows.go: AgentTaskWorkflow now listens for claim/complete/fail/
  progress/cancel signals. Previously signals were accepted by Temporal
  but silently dropped (workflow had no signal channels). Now supports
  both auto-execute (activity) and signal-driven (human/agent-in-loop)
  patterns simultaneously via selector.
 2026-03-02 00:44:03 -07:00
zeekay 512ffccfd9 feat(tasks): multi-tenant org isolation — IAM org ID maps to Temporal namespace 2026-03-02 12:42:49 -07:00
zeekay 8fa947426f feat(tasks): add ListTasks, GetNextTask, ListWorkflows to DurableStore via visibility API 2026-03-02 11:04:47 -07:00
zeekay bb905e0226 feat(tasks): embed Temporal durable execution into base plugin 
Adds native Temporal SDK integration to the tasks plugin:

- durable.go: DurableStore client (submit/cancel/signal/status workflows)
- workflows.go: AgentTaskWorkflow, PipelineWorkflow, FanOutWorkflow
- activities.go: ExecuteTaskActivity with heartbeat + pluggable executor
- worker.go: Embedded Temporal worker (polls task queue in-process)

SQLite remains authoritative state. Temporal provides crash-safe execution
that survives restarts. When durable is enabled:
- Task create → SQLite + Temporal workflow submission
- Task cancel → SQLite + Temporal workflow cancellation
- Task signal → forwarded to Temporal workflow

Multi-tenant via namespace-per-org (TASKS_NAMESPACE=org-acme).
Env config: TASKS_ENABLED, TASKS_ADDRESS, TASKS_NAMESPACE, TASKS_QUEUE.
Default cloud: tasks.hanzo.ai:7233. Falls back to SQLite-only if unreachable.
 2026-03-01 17:12:06 -07:00