mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-30 14:56:19 +00:00
## What changed? This PR implements the server-side plumbing for Principal Attribution - attaching a server-computed, immutable caller identity (Principal) to workflow history events. * Extended the Authorizer Result struct to include a Principal struct * Added the authorization interceptor logic to propagate Principal via gRPC metadata headers when enabled via dynamic config (frontend.enablePrincipalPropagation) * The default authorizer sets principal based on sub JWT claim * On the history service side, Principal is read from context headers and stamped onto every history event * Principal is set per-operation at two entry points: UpdateWorkflowWithNew (existing workflows) and NewWorkflowWithSignal (new workflows) * Added Principal headers to the Nexus disallowed operation headers blocklist to prevent leaking internal identity to external endpoints ## Why? The existing identity field on history events is client-supplied and spoofable. Principal Attribution provides a trusted, server-computed identity derived from authentication context (e.g. JWT claims, mTLS certificates), enabling reliable audit trails for workflow operations. ## How did you test it? - [X] built - [X] run locally and tested manually - [X] covered by existing tests - [X] added new unit test(s) I ran a simple test with local JWT server (PR here: https://github.com/temporalio/temporal/pull/9647). There a test client sends a signal to a running workflow using a separate JWT identity, then waits for the workflow to complete. Here is the workflow history: | eventId | eventType | principal | |---------|-----------|-----------| | 1 | WORKFLOW_EXECUTION_STARTED | jwt/workflow-starter | | 2 | WORKFLOW_TASK_SCHEDULED | jwt/workflow-starter | | 3 | WORKFLOW_TASK_STARTED | jwt/workflow-starter | | 4 | WORKFLOW_TASK_COMPLETED | jwt/workflow-starter | | 5 | WORKFLOW_EXECUTION_SIGNALED | jwt/signal-sender | | 6 | WORKFLOW_TASK_SCHEDULED | jwt/signal-sender | | 7 | WORKFLOW_TASK_STARTED | jwt/workflow-starter | | 8 | WORKFLOW_TASK_COMPLETED | jwt/workflow-starter | | 9 | ACTIVITY_TASK_SCHEDULED | jwt/workflow-starter | | 10 | ACTIVITY_TASK_STARTED | jwt/workflow-starter | | 11 | ACTIVITY_TASK_COMPLETED | jwt/workflow-starter | | 12 | WORKFLOW_TASK_SCHEDULED | jwt/workflow-starter | | 13 | WORKFLOW_TASK_STARTED | jwt/workflow-starter | | 14 | WORKFLOW_TASK_COMPLETED | jwt/workflow-starter | | 15 | WORKFLOW_EXECUTION_COMPLETED | jwt/workflow-starter | ## Potential risks - Feature-gated: Principal propagation is behind frontend.enablePrincipalPropagation dynamic config (default off), so no impact unless explicitly enabled. - Nexus blocklist addition: Adding principal-type/principal-name to the Nexus disallowed headers blocklist could reject operations that happen to use these header names
166 lines
4.5 KiB
Go
166 lines
4.5 KiB
Go
package headers
|
|
|
|
import (
|
|
"context"
|
|
)
|
|
|
|
const (
|
|
CallerTypeOperator = "operator"
|
|
CallerTypeAPI = "api"
|
|
CallerTypeBackgroundHigh = "background_high"
|
|
CallerTypeBackgroundLow = "background_low"
|
|
CallerTypePreemptable = "preemptable"
|
|
|
|
CallerNameSystem = "system"
|
|
)
|
|
|
|
var (
|
|
ValidCallerTypes = map[string]struct{}{
|
|
CallerTypeOperator: {},
|
|
CallerTypeAPI: {},
|
|
CallerTypeBackgroundHigh: {},
|
|
CallerTypeBackgroundLow: {},
|
|
CallerTypePreemptable: {},
|
|
}
|
|
)
|
|
|
|
var (
|
|
SystemOperatorCallerInfo = CallerInfo{
|
|
CallerName: CallerNameSystem,
|
|
CallerType: CallerTypeOperator,
|
|
}
|
|
SystemBackgroundHighCallerInfo = CallerInfo{
|
|
CallerName: CallerNameSystem,
|
|
CallerType: CallerTypeBackgroundHigh,
|
|
}
|
|
SystemBackgroundLowCallerInfo = CallerInfo{
|
|
CallerName: CallerNameSystem,
|
|
CallerType: CallerTypeBackgroundLow,
|
|
}
|
|
SystemPreemptableCallerInfo = CallerInfo{
|
|
CallerName: CallerNameSystem,
|
|
CallerType: CallerTypePreemptable,
|
|
}
|
|
)
|
|
|
|
type (
|
|
CallerInfo struct {
|
|
// CallerName is the name of the caller.
|
|
// It can either user namespace name or
|
|
// the predefined CallerNameSystem.
|
|
CallerName string
|
|
|
|
// CallerType indicates if the call originates from
|
|
// user API calls or from system background operations.
|
|
CallerType string
|
|
|
|
// CallOrigin is the first API method name in the call chain.
|
|
// Currently, its value is valid only when CallerType is CallerTypeAPI or CallerTypeOperator.
|
|
CallOrigin string
|
|
}
|
|
)
|
|
|
|
// NewCallerInfo creates a new CallerInfo
|
|
func NewCallerInfo(
|
|
callerName string,
|
|
callerType string,
|
|
callOrigin string,
|
|
) CallerInfo {
|
|
return CallerInfo{
|
|
CallerName: callerName,
|
|
CallerType: callerType,
|
|
CallOrigin: callOrigin,
|
|
}
|
|
}
|
|
|
|
// NewBackgroundHighCallerInfo creates a new CallerInfo with BackgroundHigh callerType
|
|
// and empty callOrigin.
|
|
// This is equivalent to NewCallerInfo(callerName, CallerTypeBackgroundHigh, "")
|
|
func NewBackgroundHighCallerInfo(
|
|
callerName string,
|
|
) CallerInfo {
|
|
return CallerInfo{
|
|
CallerName: callerName,
|
|
CallerType: CallerTypeBackgroundHigh,
|
|
}
|
|
}
|
|
|
|
// NewBackgroundLowCallerInfo creates a new CallerInfo with BackgroundLow callerType
|
|
// and empty callOrigin.
|
|
// This is equivalent to NewCallerInfo(callerName, CallerTypeBackgroundLow, "")
|
|
func NewBackgroundLowCallerInfo(
|
|
callerName string,
|
|
) CallerInfo {
|
|
return CallerInfo{
|
|
CallerName: callerName,
|
|
CallerType: CallerTypeBackgroundLow,
|
|
}
|
|
}
|
|
|
|
// NewPreemptableCallerInfo creates a new CallerInfo with Preemptable callerType
|
|
// and empty callOrigin.
|
|
// This is equivalent to NewCallerInfo(callerName, CallerTypePreemptable, "")
|
|
func NewPreemptableCallerInfo(
|
|
callerName string,
|
|
) CallerInfo {
|
|
return CallerInfo{
|
|
CallerName: callerName,
|
|
CallerType: CallerTypePreemptable,
|
|
}
|
|
}
|
|
|
|
// SetCallerInfo sets callerName, callerType and CallOrigin in the context.
|
|
// Existing values will be overwritten if new value is not empty.
|
|
// TODO: consider only set the caller info to golang context instead of grpc metadata
|
|
// and propagate to grpc outgoing context upon making an rpc call
|
|
func SetCallerInfo(
|
|
ctx context.Context,
|
|
info CallerInfo,
|
|
) context.Context {
|
|
return setIncomingMD(ctx, map[string]string{
|
|
CallerNameHeaderName: info.CallerName,
|
|
CallerTypeHeaderName: info.CallerType,
|
|
CallOriginHeaderName: info.CallOrigin,
|
|
})
|
|
}
|
|
|
|
// SetCallerName set caller name in the context.
|
|
// Existing caller name will be overwritten if exists and new caller name is not empty.
|
|
func SetCallerName(
|
|
ctx context.Context,
|
|
callerName string,
|
|
) context.Context {
|
|
return setIncomingMD(ctx, map[string]string{CallerNameHeaderName: callerName})
|
|
}
|
|
|
|
// SetCallerType set caller type in the context.
|
|
// Existing caller type will be overwritten if exists and new caller type is not empty.
|
|
func SetCallerType(
|
|
ctx context.Context,
|
|
callerType string,
|
|
) context.Context {
|
|
return setIncomingMD(ctx, map[string]string{CallerTypeHeaderName: callerType})
|
|
}
|
|
|
|
// SetOrigin set call origin in the context.
|
|
// Existing call origin will be overwritten if exists and new call origin is not empty.
|
|
func SetOrigin(
|
|
ctx context.Context,
|
|
callOrigin string,
|
|
) context.Context {
|
|
return setIncomingMD(ctx, map[string]string{CallOriginHeaderName: callOrigin})
|
|
}
|
|
|
|
// GetCallerInfo retrieves caller information from the context if exists. Empty value is returned
|
|
// if any piece of caller information is not specified in the context.
|
|
func GetCallerInfo(
|
|
ctx context.Context,
|
|
) CallerInfo {
|
|
values := GetValues(ctx, CallerNameHeaderName, CallerTypeHeaderName, CallOriginHeaderName)
|
|
return CallerInfo{
|
|
CallerName: values[0],
|
|
CallerType: values[1],
|
|
CallOrigin: values[2],
|
|
}
|
|
}
|