mirror of
https://github.com/DeBrosOfficial/orama.git
synced 2026-08-07 15:09:27 +00:00
a66cd1ab3c
- fix(gateway): server-side storage unpin for serverless jobs (bugboard #151). The layer-1 storage gate now accepts the runtime key's exchanged (storage- scoped) JWT on DELETE /v1/storage/unpin — wallet JWT OR api-key-exchanged — so a userless cron/avatar-GC/free-up-space can reclaim its own namespace's pins. A bare API key still fails; unpin stays namespace-ownership-checked and reclaim-only. Upload/get/pin keep the strict wallet-JWT requirement. - fix(storage): unpin is now idempotent (bugboard #140) — a CID already absent from the cluster pinset returns 200 {already_unpinned:true} instead of a 500 wrapping the cluster 404 (matched to the definitive "not part of the pinset" phrase; unrelated 404/"not found" still error). - fix(serverless): stop trusting the client X-Wallet header for invoke identity (bugboard #152) — it let an unauthenticated caller on the public invoke paths impersonate any wallet and defeat in-function admin gates. Identity now comes only from a verified JWT subject or the API-key-derived namespace. - feat(serverless): gateway-enforced `internal` function flag (bugboard #152) — migration 035 is_internal; function.yaml `internal:`; an internal function is invokable only by a system trigger or an admin caller (HTTP, stateless-WS, persistent-WS upgrade, and WASM->WASM paths all gated). Default false, so no existing function changes behavior.
23 lines
1.2 KiB
SQL
23 lines
1.2 KiB
SQL
-- =============================================================================
|
|
-- 035_functions_internal.sql
|
|
--
|
|
-- Gateway-enforced `internal` function flag (bugboard #152).
|
|
--
|
|
-- A scoped app-runtime API key could invoke ANY function by name via
|
|
-- POST /v1/invoke/<ns>/<fn>, including internal/admin/cron functions (e.g. a
|
|
-- `migrate` function whose reset drops all tables). `public: false` is NOT an
|
|
-- invoke gate — a private function only requires SOME caller identity, which
|
|
-- every app-runtime key trivially has.
|
|
--
|
|
-- This column marks a function as internal: it may then be invoked ONLY by a
|
|
-- system trigger (cron/pubsub/db/timer/job/internal — already bypassing the
|
|
-- caller check) OR by an admin caller. A normal (non-admin) app-runtime key
|
|
-- invoking an internal function by name is rejected `unauthorized`.
|
|
--
|
|
-- Default FALSE → backward compatible: every existing function stays invokable
|
|
-- exactly as before. Enforcement only engages when a function opts in via
|
|
-- `internal: true` in its function.yaml.
|
|
-- =============================================================================
|
|
|
|
ALTER TABLE functions ADD COLUMN is_internal BOOLEAN NOT NULL DEFAULT FALSE;
|