Repository navigation
Add identity RPC bindings and runtime caller verification - #8121
Draft
irvinebroque wants to merge 41 commits into
Draft
irvinebroque wants to merge 41 commits into
irvinebroque wants to merge 41 commits into
Conversation
Expose ctx.oidc.getToken() on ExecutionContext and DurableObjectState. Forward bounded audience and subject options through the current trusted I/O channel; standalone workerd rejects issuance without a host signer. Share strict UTF-8 and JWT StringOrURI validation with embedding hosts. Compatibility: keep the API behind the experimental workers_oidc flag with no enable date, so existing Workers retain their API surface. Validate native audience parsing, API option handling, execution-context isolation, Durable Object subjects, flag gating, and generated types.
The string wrappers copied customer input before enforcing audience and subject limits. Keep GC-safe references until type and string length checks succeed, then copy only bounded input into native memory. Exercise oversized ASCII and Unicode values, exact UTF-8 limits, and objects that must be rejected without coercion. Keep malformed UTF-8 checks at the native host boundary and lone-surrogate API coverage. Compatibility: preserve the experimental workers_oidc API, accepted string values, and TypeScript declarations.
Add an explicit per-Worker broker channel with bounded requests, responses and cancellation. Local Durable Objects share the development getter and reject explicit cloud subject modes. Compatibility: retain the experimental workers_oidc flag with no automatic enable date. The broker requires explicit host configuration and adds no JavaScript API surface. Validation: OIDC unit and runtime tests; local callback default, all-compat-flags and all-autogates variants on macOS; Linux callback repeated five times.
Verify that a 2048-byte audience survives JSON expansion and the protected native callback without truncation. The default, all-compat-flags and all-autogates variants pass.
Map broker status codes and two fixed hints to corrective messages. Keep arbitrary response bodies and headers out of Worker exceptions. Cover each category through Worker and Durable Object getters. Use current header and declaration conventions required by clang-tidy. The API surface and compatibility gates are unchanged; these messages apply only when the local OIDC callback is explicitly configured. Validated all workerd test variants and production clang-tidy targets.
Replace the unreleased workers_oidc singleton with assignment-backed env bindings. This intentionally changes the experimental API before release; the workers_oidc flag remains opt-in. Resolve execution evidence at each call and forward only the fixed assignment, optional audience, and fresh boolean to the host.
Allocate workers_oidc after current compatibility flags and regenerate type snapshots through //types. The native capability forwarding and identity type tests pass on this revision.
Extend the existing workers_oidc-gated wrapper without new native APIs. Preserve protected parent authority and transport customer selection only through fetchForCustomer; strip caller-supplied internal selectors from ordinary fetch. Regenerate public types and exercise forwarded capabilities.
irvinebroque
changed the title
Expose ctx.identity.caller() with invocation-local memoization, original-request body handling and private verifier RPC. Preserve Access and sender JSRPC APIs. Compatibility: gate the namespace with enable_workload_identity_context, enabled on 2026-10-31. Validate native receiver, Access and sender tests plus receiver union type checks.
irvinebroque
changed the title
Keep the real signer integration in workers-oidc and the runtime receiver, public type, and generic RPC tests. The removed fixture implemented its own signer API and could not detect signer regressions.
Let runtime-generated types follow the compatibility flag instead of\nforcing identity properties into disabled contexts.
Expose required readonly originVersionId only on JWT callers and retain credential authority through forwarding. Align signed-request facts and fixtures with signatureAgent. Regenerate snapshots and cover discriminated-union and immutability checks. Compatibility: accept the additive JWT result field under the existing experimental workload-identity API gate. This uses unchanged private verifier result transport. Coordinate matching verifier validation and types rollout; inventory supported issuers before requiring version_id in production.
Keep one unsupported actor check and the distinct Worker callers that prove request isolation. Two actor calls that both reject cannot establish isolation.
Use one Fetcher helper for caller classification in all tracing paths. Refer to the reserved-channel count instead of repeating its value. The refactor preserves the existing supported and unsupported paths.
Construct HTTP entrypoints inside the invocation identity scope so constructors and fetch handlers share the memoized caller result. Preserve actor construction before the retry claim and handler invocation. Omit known-empty GET/HEAD streams from verifier copies so RPC Request reconstruction succeeds while the original body remains readable. Add regression coverage for native and signed constructor lookups and Content-Length: 0 GET/HEAD requests. Validation: formatting and diff checks pass, and the regressions reproduce against the prior binary. Build and post-fix runtime tests were skipped.
Preserve upstream compatibility ordinals 202 and 203; move the unshipped opt-in identity flag to 204. Recompile earlier draft pipelines before switching runtime cohorts. Supply unsupported native provenance for hibernation and lazily resolve the test-fixture handler inside the identity scope.
Add opaque subject, pinned issuer and scope provenance for application checks before activation. This is additive to the draft identity binding; no native API or compatibility behavior changes. Regenerate snapshots with the official generator and matching runtime using cached build inputs because local Xcode discovery prevents the Bazel recipe.
Extend the existing argument-free ctx.identity.caller() result with checked delegated facts and frozen account/scopes data. Preserve safe DOMException response data through the asynchronous verifier bridge. Reject unsupported private result schemas without returning identity. Compatibility: retain the opt-in workload identity context API and add an explicit enable_delegated_identity capability flag for matched receiver compilers. Existing native caller precedence stays intact. Native API and generated public-type tests pass with the documented local Command Line Tools override. Hosted qualification remains open.
Use const references for checked delegated field names, as required by the clang-tidy range-copy check. No public API or compatibility flag changes.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #8121 +/- ##
==========================================
- Coverage 68.84% 68.83% -0.02%
==========================================
Files 737 743 +6
Lines 193921 194997 +1076
Branches 30088 30250 +162
==========================================
+ Hits 133513 134226 +713
- Misses 42756 43028 +272
- Partials 17652 17743 +91 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add protected identity RPC bindings, argument-free
ctx.identity.caller()and checked immutable workload/signed/delegated results. Keep native service-binding precedence and safe structured error transport. Configure no customer verifier or replay binding.Public declarations retain no-argument configured client metadata/assertions, optional singleton WAG AS selection, structural
IdentityConnectionErrorfields and the solesignatureAgentURL. The companion configuration now uses flatcallerIdentitywithaccountTokens; the runtime handler API is unchanged.Runtime head
40cc7a73dae239b870aa80b9e631d92d1bb3eb8fis unchanged by the configuration naming pass. Previousjust generate-typesandbazel test //types:test/types/oidcresults remain recorded at this head. Current local SDK integration passes all 34 tests using the recorded companion executable built fromafef2a9e2ac452cad7661e6db3f4358d2103630b; executable C++ sources match. This does not qualify the native production host channel or released runtime.Companions: runtime #8121, SDK #16455, cf #465.
Experimental draft. Local testing is the acceptance basis; production/hosted provenance, interoperability/security, cross-colo replay, capacity and rollout qualification remain separate. Production enablement remains off.