ms2k/remora
SHA256
Watch
0
Code Releases Activity

Implement authorization-fenced web workflows

Browse source
This commit is contained in:
ms2k 2026-07-18 01:49:00 +09:00
commit 267665bb35
1 changed files with 3853 additions and 156 deletions
Download patch file Download diff file Expand all files Collapse all files

23
crates/remora-api/src/public.rs
View file

@ -9,9 +9,9 @@ use remora_admission::{AdmissionDecision, AdmissionService};
use remora_attempt::{AttemptService, CommittedResultRecord, ProgressSnapshot};
use remora_contracts::{
ApiErrorCodeDto, ApiErrorDto, CredentialMaterialDto, DateTimeDto, JobSubmissionDto,
NullableDto, SourceCredentialCreateDto, SourceCredentialDto, SourceCredentialKindDto,
SourceCredentialPageDto, SourceCredentialRotateDto, SourceCredentialStatusDto,
SourceCredentialVersionDto,
NullableDto, ResultMemberAccessDto, SourceCredentialCreateDto, SourceCredentialDto,
SourceCredentialKindDto, SourceCredentialPageDto, SourceCredentialRotateDto,
SourceCredentialStatusDto, SourceCredentialVersionDto,
};
use remora_credentials::{
CreateCredential, CredentialCaller, CredentialError, CredentialRegistry, RotateTxOutcome,
@ -384,7 +384,10 @@ async fn list_jobs(
Ok(HttpResponse::Ok().json(json!({
"items": items,
"next_cursor": next_cursor,
"event_cursor": event_cursor
"event_cursor": event_cursor,
"management_capabilities": {
"revoke_execution_grants": principal.administrator
}
})))
}
@ -493,14 +496,20 @@ async fn access_result_member(
.targets
.resolve(member.object().store(), member.object().bucket())
.ok_or_else(PublicApiError::unavailable)?;
let issued_at = OffsetDateTime::now_utc();
let access = target
.presign_read(&member.exact_identity(), state.member_access_ttl)
.await
.map_err(|_| PublicApiError::unavailable())?;
Ok(HttpResponse::TemporaryRedirect()
.insert_header((header::LOCATION, access.url))
let duration =
time::Duration::try_from(access.expires_in).map_err(|_| PublicApiError::internal())?;
Ok(HttpResponse::Ok()
.insert_header((header::CACHE_CONTROL, "no-store"))
.finish())
.insert_header((header::PRAGMA, "no-cache"))
.json(ResultMemberAccessDto {
url: access.url,
expires_at: datetime(issued_at + duration)?,
}))
}
async fn cancel_job(