Files
tasks/common/headers/caller_info.go
Vladyslav SimonenkoandGitHub ed2a8484f4 Propagate principal into workflow history (#9582)
## What changed?
This PR implements the server-side plumbing for Principal Attribution -
attaching a server-computed, immutable caller identity (Principal) to
workflow history events.
* Extended the Authorizer Result struct to include a Principal struct
* Added the authorization interceptor logic to propagate Principal via
gRPC metadata headers when enabled via dynamic config
(frontend.enablePrincipalPropagation)
* The default authorizer sets principal based on sub JWT claim
* On the history service side, Principal is read from context headers
and stamped onto every history event
* Principal is set per-operation at two entry points:
UpdateWorkflowWithNew (existing workflows) and NewWorkflowWithSignal
(new workflows)
* Added Principal headers to the Nexus disallowed operation headers
blocklist to prevent leaking internal identity to external endpoints

## Why?
The existing identity field on history events is client-supplied and
spoofable. Principal Attribution provides a trusted, server-computed
identity derived from authentication context (e.g. JWT claims, mTLS
certificates), enabling
 reliable audit trails for workflow operations.

## How did you test it?
- [X] built
- [X] run locally and tested manually
- [X] covered by existing tests
- [X] added new unit test(s)

I ran a simple test with local JWT server (PR here:
https://github.com/temporalio/temporal/pull/9647). There a test client
sends a signal to a running workflow using a separate JWT identity, then
waits for the workflow to complete. Here is the workflow history:

| eventId | eventType | principal |
  |---------|-----------|-----------|
  | 1 | WORKFLOW_EXECUTION_STARTED | jwt/workflow-starter |
  | 2 | WORKFLOW_TASK_SCHEDULED | jwt/workflow-starter |
  | 3 | WORKFLOW_TASK_STARTED | jwt/workflow-starter |
  | 4 | WORKFLOW_TASK_COMPLETED | jwt/workflow-starter |
  | 5 | WORKFLOW_EXECUTION_SIGNALED | jwt/signal-sender |
  | 6 | WORKFLOW_TASK_SCHEDULED | jwt/signal-sender |
  | 7 | WORKFLOW_TASK_STARTED | jwt/workflow-starter |
  | 8 | WORKFLOW_TASK_COMPLETED | jwt/workflow-starter |
  | 9 | ACTIVITY_TASK_SCHEDULED | jwt/workflow-starter |
  | 10 | ACTIVITY_TASK_STARTED | jwt/workflow-starter |
  | 11 | ACTIVITY_TASK_COMPLETED | jwt/workflow-starter |
  | 12 | WORKFLOW_TASK_SCHEDULED | jwt/workflow-starter |
  | 13 | WORKFLOW_TASK_STARTED | jwt/workflow-starter |
  | 14 | WORKFLOW_TASK_COMPLETED | jwt/workflow-starter |
  | 15 | WORKFLOW_EXECUTION_COMPLETED | jwt/workflow-starter |

## Potential risks
- Feature-gated: Principal propagation is behind
frontend.enablePrincipalPropagation dynamic config (default off), so no
impact unless explicitly enabled.
- Nexus blocklist addition: Adding principal-type/principal-name to the
Nexus disallowed headers blocklist could reject operations that happen
to use these header names
2026-03-30 11:30:14 -07:00

166 lines
4.5 KiB
Go

package headers
import (
"context"
)
const (
CallerTypeOperator = "operator"
CallerTypeAPI = "api"
CallerTypeBackgroundHigh = "background_high"
CallerTypeBackgroundLow = "background_low"
CallerTypePreemptable = "preemptable"
CallerNameSystem = "system"
)
var (
ValidCallerTypes = map[string]struct{}{
CallerTypeOperator: {},
CallerTypeAPI: {},
CallerTypeBackgroundHigh: {},
CallerTypeBackgroundLow: {},
CallerTypePreemptable: {},
}
)
var (
SystemOperatorCallerInfo = CallerInfo{
CallerName: CallerNameSystem,
CallerType: CallerTypeOperator,
}
SystemBackgroundHighCallerInfo = CallerInfo{
CallerName: CallerNameSystem,
CallerType: CallerTypeBackgroundHigh,
}
SystemBackgroundLowCallerInfo = CallerInfo{
CallerName: CallerNameSystem,
CallerType: CallerTypeBackgroundLow,
}
SystemPreemptableCallerInfo = CallerInfo{
CallerName: CallerNameSystem,
CallerType: CallerTypePreemptable,
}
)
type (
CallerInfo struct {
// CallerName is the name of the caller.
// It can either user namespace name or
// the predefined CallerNameSystem.
CallerName string
// CallerType indicates if the call originates from
// user API calls or from system background operations.
CallerType string
// CallOrigin is the first API method name in the call chain.
// Currently, its value is valid only when CallerType is CallerTypeAPI or CallerTypeOperator.
CallOrigin string
}
)
// NewCallerInfo creates a new CallerInfo
func NewCallerInfo(
callerName string,
callerType string,
callOrigin string,
) CallerInfo {
return CallerInfo{
CallerName: callerName,
CallerType: callerType,
CallOrigin: callOrigin,
}
}
// NewBackgroundHighCallerInfo creates a new CallerInfo with BackgroundHigh callerType
// and empty callOrigin.
// This is equivalent to NewCallerInfo(callerName, CallerTypeBackgroundHigh, "")
func NewBackgroundHighCallerInfo(
callerName string,
) CallerInfo {
return CallerInfo{
CallerName: callerName,
CallerType: CallerTypeBackgroundHigh,
}
}
// NewBackgroundLowCallerInfo creates a new CallerInfo with BackgroundLow callerType
// and empty callOrigin.
// This is equivalent to NewCallerInfo(callerName, CallerTypeBackgroundLow, "")
func NewBackgroundLowCallerInfo(
callerName string,
) CallerInfo {
return CallerInfo{
CallerName: callerName,
CallerType: CallerTypeBackgroundLow,
}
}
// NewPreemptableCallerInfo creates a new CallerInfo with Preemptable callerType
// and empty callOrigin.
// This is equivalent to NewCallerInfo(callerName, CallerTypePreemptable, "")
func NewPreemptableCallerInfo(
callerName string,
) CallerInfo {
return CallerInfo{
CallerName: callerName,
CallerType: CallerTypePreemptable,
}
}
// SetCallerInfo sets callerName, callerType and CallOrigin in the context.
// Existing values will be overwritten if new value is not empty.
// TODO: consider only set the caller info to golang context instead of grpc metadata
// and propagate to grpc outgoing context upon making an rpc call
func SetCallerInfo(
ctx context.Context,
info CallerInfo,
) context.Context {
return setIncomingMD(ctx, map[string]string{
CallerNameHeaderName: info.CallerName,
CallerTypeHeaderName: info.CallerType,
CallOriginHeaderName: info.CallOrigin,
})
}
// SetCallerName set caller name in the context.
// Existing caller name will be overwritten if exists and new caller name is not empty.
func SetCallerName(
ctx context.Context,
callerName string,
) context.Context {
return setIncomingMD(ctx, map[string]string{CallerNameHeaderName: callerName})
}
// SetCallerType set caller type in the context.
// Existing caller type will be overwritten if exists and new caller type is not empty.
func SetCallerType(
ctx context.Context,
callerType string,
) context.Context {
return setIncomingMD(ctx, map[string]string{CallerTypeHeaderName: callerType})
}
// SetOrigin set call origin in the context.
// Existing call origin will be overwritten if exists and new call origin is not empty.
func SetOrigin(
ctx context.Context,
callOrigin string,
) context.Context {
return setIncomingMD(ctx, map[string]string{CallOriginHeaderName: callOrigin})
}
// GetCallerInfo retrieves caller information from the context if exists. Empty value is returned
// if any piece of caller information is not specified in the context.
func GetCallerInfo(
ctx context.Context,
) CallerInfo {
values := GetValues(ctx, CallerNameHeaderName, CallerTypeHeaderName, CallOriginHeaderName)
return CallerInfo{
CallerName: values[0],
CallerType: values[1],
CallOrigin: values[2],
}
}