nango/packages/runner · na/nango

GGitHubfix(server): Clamp proxy retry to maximum duration (#7264)

文件	最后提交记录	最后更新时间
lib	fix(server): Clamp proxy retry to maximum duration (#7264) <!-- Describe the problem and your solution --> While investigating a spike in server latency at the top of each hour, we discovered long running proxy operations for customer Centralize that was causing requests to stack up at the top of each hour. The root cause seems to be our proxy handler respecting long retries (1 hour+) retrying operations long after the client request will have timed out. There should be a maximum value for retry-after beyond which proxy operations fast fail and return retry information to the caller. <!-- Issue ticket number and link (if applicable) --> [NAN-6759: fix(server): Add maximum retry-after in proxy calls](https://linear.app/nango/issue/NAN-6759/fixserver-add-maximum-retry-after-in-proxy-calls) <!-- Testing instructions (skip if just adding/editing providers) --> To test this I had an agent stand up a mock server temporarily. A quick summary is: 1. Edit `providers.yaml` for a provider like `private-api-bearer` or `unauthenticated` to support retry headers. There might be a provider you could use for this already, but I didn't see it 🤷 : ``` retry: after: - 'retry-after' ``` 2. Standup a mock endpoint that always returns a long retry header based on what you are using from 1 3. Create a new integration and connection for provider from step 1 4. Allow Nango to send traffic to your mock endpoint by setting the following in your `.env`: ``` NANGO_OUTBOUND_URL_POLICY={"blockPrivateIps":false} ``` 5. Proxy a request through Nango connection. It should fail fast with this change rather than hanging for the duration of the retry header you provided from the mock endpoint. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/7264?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>	18 小时前
nodemon.json	fix(proxy): refresh connection between retries (again) (#3587) ## Changes See #3566 that was reverted - Fix missing `responseType` --- To compare easily `git diff 85c998b4fe9998162c59bafacb114c500ff8d772..64f284dd55104516af9b2f2c31cbfa5989170256` ```diff git diff 85c998b4fe9998162c59bafacb114c500ff8d772..64f284dd55104516af9b2f2c31cbfa5989170256 diff --git a/packages/server/lib/controllers/proxy.controller.ts b/packages/server/lib/controllers/proxy.controller.ts index f578aab29..846955177 100644 --- a/packages/server/lib/controllers/proxy.controller.ts +++ b/packages/server/lib/controllers/proxy.controller.ts @@ -153,7 +153,8 @@ class ProxyController { baseUrlOverride, decompress: decompress === 'true' ? true : false, method: method.toUpperCase() as HTTP_METHOD, - retryOn + retryOn, + responseType: 'stream' }, internalConfig }).unwrap(), ```	1 年前
package.json	feat(auth): internal service auth (#7167) Optional Bearer auth between internal services (orchestrator and jobs). Off by default; existing deploys are unchanged until operators set secrets and flip `NANGO_INTERNAL_AUTH_REQUIRED`. ## Summary - Orchestrator and jobs HTTP APIs accept `Authorization: Bearer`, except `GET /health`. - Control plane (server, jobs, orchestrator) uses a shared static token (`NANGO_INTERNAL_AUTH_TOKEN`). - Jobs mints HMAC JWTs for runners: task-bound for `putTask`/`heartbeat`, node-bound for register/idle. The signing key stays on jobs; runners never receive `NANGO_INTERNAL_AUTH_TOKEN` or `NANGO_INTERNAL_AUTH_SIGNING_KEY`. Rollout plan [here](https://linear.app/nango/issue/NAN-6634/add-internal-auth-middleware-to-orchestrator-and-jobs#zero-downtime-rollout-2e12b4cc) --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	13 天前
tsconfig.json	feat(auth): internal service auth (#7167) Optional Bearer auth between internal services (orchestrator and jobs). Off by default; existing deploys are unchanged until operators set secrets and flip `NANGO_INTERNAL_AUTH_REQUIRED`. ## Summary - Orchestrator and jobs HTTP APIs accept `Authorization: Bearer`, except `GET /health`. - Control plane (server, jobs, orchestrator) uses a shared static token (`NANGO_INTERNAL_AUTH_TOKEN`). - Jobs mints HMAC JWTs for runners: task-bound for `putTask`/`heartbeat`, node-bound for register/idle. The signing key stays on jobs; runners never receive `NANGO_INTERNAL_AUTH_TOKEN` or `NANGO_INTERNAL_AUTH_SIGNING_KEY`. Rollout plan [here](https://linear.app/nango/issue/NAN-6634/add-internal-auth-middleware-to-orchestrator-and-jobs#zero-downtime-rollout-2e12b4cc) --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	13 天前