mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
ed182af8f0
## What changed? Patching 1.29 with 2 commits ## Why? These two commits fixes bugs & security issues in 1.29 ## How did you test it? - [x] built - [ ] run locally and tested manually - [ ] covered by existing tests - [ ] added new unit test(s) - [ ] added new functional test(s) --- > [!NOTE] > Adds auth checks for cross-namespace workflow commands, enforces per-op namespace matching in MultiOperation, and bumps server version to 1.29.2. > > - **Authorization**: > - Add cross-namespace authorization for `RespondWorkflowTaskCompleted` commands (`SignalWorkflowExecution`, `StartWorkflowExecution`, `RequestCancelWorkflowExecution`) via `authorizeTargetNamespaces`, gated by `dynamicconfig.EnableCrossNamespaceCommands`. > - Wire new flag into interceptor provider in `service/frontend/fx.go`; update tests to cover enabled/disabled paths and deduping. > - **Frontend**: > - `ExecuteMultiOperation`: require each operation's `Namespace` to match the request; return `errMultiOpNamespaceMismatch` on mismatch. > - Update `convertToHistoryMultiOperationItem` signature and validation; extend tests for namespace mismatch and error aggregation. > - **Version**: > - Bump `ServerVersion` to `1.29.2`. > > <sup>Written by [Cursor Bugbot]() for commit bbccb4174f6b17f47a20f6c8578dd7fd9aea32a0. This will update automatically on new commits. Configure [here]().</sup> --------- Co-authored-by: Stephan Behnke <[email protected]> Co-authored-by: Prathyush PV <[email protected]>