master

GGitHubfix(runner): auth runner start (#7288)

ed3030a9创建于 23 天前历史提交

文件	最后提交记录	最后更新时间
lib	fix(runner): auth runner start (#7288) ## Summary - Require a jobs identity on runner `start` / `abort` / `notifyWhenIdle` when `NANGO_INTERNAL_AUTH_REQUIRED=true`. Jobs mints an EdDSA JWT (`aud: runner`); runners verify with a public key only. - Jobs never puts a minting secret on the runner. At node start it injects the Ed25519 public key, a jobs-audience node JWT, and a snapshot of `REQUIRED`. `/health` stays open. - Default is a no-op. Existing runners keep accepting dispatch (fail-open). Enforcement starts on pods created after jobs has a signing key and `REQUIRED=true`. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	23 天前
package.json	feat(auth): internal service auth (#7167) Optional Bearer auth between internal services (orchestrator and jobs). Off by default; existing deploys are unchanged until operators set secrets and flip `NANGO_INTERNAL_AUTH_REQUIRED`. ## Summary - Orchestrator and jobs HTTP APIs accept `Authorization: Bearer`, except `GET /health`. - Control plane (server, jobs, orchestrator) uses a shared static token (`NANGO_INTERNAL_AUTH_TOKEN`). - Jobs mints HMAC JWTs for runners: task-bound for `putTask`/`heartbeat`, node-bound for register/idle. The signing key stays on jobs; runners never receive `NANGO_INTERNAL_AUTH_TOKEN` or `NANGO_INTERNAL_AUTH_SIGNING_KEY`. Rollout plan [here](https://linear.app/nango/issue/NAN-6634/add-internal-auth-middleware-to-orchestrator-and-jobs#zero-downtime-rollout-2e12b4cc) --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	30 天前
tsconfig.json	feat(auth): internal service auth (#7167) Optional Bearer auth between internal services (orchestrator and jobs). Off by default; existing deploys are unchanged until operators set secrets and flip `NANGO_INTERNAL_AUTH_REQUIRED`. ## Summary - Orchestrator and jobs HTTP APIs accept `Authorization: Bearer`, except `GET /health`. - Control plane (server, jobs, orchestrator) uses a shared static token (`NANGO_INTERNAL_AUTH_TOKEN`). - Jobs mints HMAC JWTs for runners: task-bound for `putTask`/`heartbeat`, node-bound for register/idle. The signing key stays on jobs; runners never receive `NANGO_INTERNAL_AUTH_TOKEN` or `NANGO_INTERNAL_AUTH_SIGNING_KEY`. Rollout plan [here](https://linear.app/nango/issue/NAN-6634/add-internal-auth-middleware-to-orchestrator-and-jobs#zero-downtime-rollout-2e12b4cc) --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	30 天前