3 Commits
Author SHA1 Message Date
zeekay 157b7127ab security: fix critical and high findings from red team review
- C1: add orgId field to _tasks/_workflows, filter all queries by org
- C2: validate spaceID/orgID with regex before Temporal visibility queries
- H1: add sync.RWMutex to orgClients map (prevent concurrent map panic)
- H2: atomic FailTask with CASE expression (eliminate TOCTOU race)
- H4: extractCreator uses authenticated user ID, not raw headers
- Add orgId to collection schemas, store methods, and API filters
2026-03-02 01:02:45 -07:00
zeekay 512ffccfd9 feat(tasks): multi-tenant org isolation — IAM org ID maps to Temporal namespace 2026-03-02 12:42:49 -07:00
zeekay 3d88b99f8d feat(tasks): native SQLite-backed task execution plugin
Embeds a complete task queue and workflow scheduler into base using
the collection/record system backed by embedded SQLite.

Plugin creates _tasks and _workflows system collections on bootstrap
and runs a background scheduler that checks timeouts, advances
workflow state, and optionally auto-executes tasks via OnExecute callback.

API endpoints: create/get/list/update/claim/start/complete/fail/cancel/
progress/next (work-stealing) for tasks, plus create/get/list for
workflows with auto-chained pipeline and parallel (fan-out) support.

10 tests covering full lifecycle: CRUD, atomic claims, retry with
re-queue, dependency blocking, priority ordering, workflow advancement.
2026-03-02 16:58:15 -07:00