mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
zeekay
40351cce6f
Goes from 135 MB binary with 1153 files importing go.temporal.io and 224
importing google.golang.org/grpc to a 10 MB native binary with ZERO of
either.
Deleted:
- tasks/, tasktests/, service/, chasm/, client/, api/, proto/, tools/
- cmd/tools/, components/, docker/
- schema/{cassandra,elasticsearch,mysql,postgresql,sqlite}/
- 40 tainted common/ subdirs + 7 top-level common files
- tests/testutils (no longer referenced after surviving deps drop common)
New cmd/tasksd (~100 lines) boots tasks.Embed (zap.Node) + http.Server.
New pkg/tasks/embed.go registers ZAP handlers for the SDK opcode surface
(0x0060-0x00A5). Workflow handlers return a 501 "not yet implemented"
envelope; native engine lands behind this contract.
Build: go build ./cmd/tasksd → 10 MB
Vet: go vet ./... → clean
Boot: tasksd --zap-port 9999 --http :7243
Probes: /healthz, /v1/tasks/health → 200
UI: /_/tasks/, / → 200 (embedded Vite bundle)
ZAP: _tasks._tcp on :9999 (mDNS disabled; direct connect)
go.mod: tidy. No go.temporal.io. No google.golang.org/grpc.
79 lines
2.1 KiB
Go
79 lines
2.1 KiB
Go
//go:generate mockgen -package $GOPACKAGE -source $GOFILE -destination authorizer_mock.go
|
|
|
|
package authorization
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"strings"
|
|
|
|
commonpb "go.temporal.io/api/common/v1"
|
|
"go.temporal.io/server/common/config"
|
|
)
|
|
|
|
const (
|
|
// DecisionDeny means auth decision is deny
|
|
DecisionDeny Decision = iota + 1
|
|
// DecisionAllow means auth decision is allow
|
|
DecisionAllow
|
|
)
|
|
|
|
// @@@SNIPSTART temporal-common-authorization-authorizer-calltarget
|
|
// CallTarget is contains information for Authorizer to make a decision.
|
|
// It can be extended to include resources like WorkflowType and TaskQueue
|
|
type CallTarget struct {
|
|
// APIName must be the full API function name.
|
|
// Example: "/temporal.api.workflowservice.v1.WorkflowService/StartWorkflowExecution".
|
|
APIName string
|
|
// If a Namespace is not being targeted this be set to an empty string.
|
|
Namespace string
|
|
// The nexus endpoint name being targeted (if any).
|
|
NexusEndpointName string
|
|
// Request contains a deserialized copy of the API request object
|
|
Request any
|
|
}
|
|
|
|
// @@@SNIPEND
|
|
|
|
type (
|
|
// Result is result from authority.
|
|
Result struct {
|
|
Decision Decision
|
|
// Reason may contain a message explaining the value of the Decision field.
|
|
Reason string
|
|
// Principal is the server-computed identity of the caller. Can be nil when not computed.
|
|
Principal *commonpb.Principal
|
|
}
|
|
|
|
// Decision is enum type for auth decision
|
|
Decision int
|
|
)
|
|
|
|
// @@@SNIPSTART temporal-common-authorization-authorizer-interface
|
|
// Authorizer is an interface for implementing authorization logic
|
|
type Authorizer interface {
|
|
Authorize(ctx context.Context, caller *Claims, target *CallTarget) (Result, error)
|
|
}
|
|
|
|
// @@@SNIPEND
|
|
|
|
type hasNamespace interface {
|
|
GetNamespace() string
|
|
}
|
|
|
|
func GetAuthorizerFromConfig(config *config.Authorization) (Authorizer, error) {
|
|
|
|
switch strings.ToLower(config.Authorizer) {
|
|
case "":
|
|
return NewNoopAuthorizer(), nil
|
|
case "default":
|
|
return NewDefaultAuthorizer(), nil
|
|
}
|
|
return nil, fmt.Errorf("unknown authorizer: %s", config.Authorizer)
|
|
}
|
|
|
|
func IsNoopAuthorizer(authorizer Authorizer) bool {
|
|
_, ok := authorizer.(*noopAuthorizer)
|
|
return ok
|
|
}
|