block/core

Fork 0

Commit Graph

Author	SHA1	Message	Date
Alex Dunmow	314a25353d	feat(abi,auth): first-class uuid[] DbValue + trusted identity headers (WZ-016) Two shared wasm-boundary fixes surfaced by the messenger port (WZ-013): 1. uuid[] DbValue variant. bnwasm had no uuid-array bind/scan, so every ANY($1::uuid[]) query broke in the guest ("unsupported argument type []uuid.UUID") and messenger worked around it with a ::text[]::uuid[] cast. Adds a dedicated DbValue.uuid_array_value (abiv1.UuidArray) — distinct from text[] so the host binds a native uuid[] param (queries keep ::uuid[]) and scans a uuid[] column straight into []uuid.UUID. Guest toDbValue marshals []uuid.UUID; naturalValue/assign parse the canonical strings back into []uuid.UUID (nil→NULL, empty stays empty). Pinned by the uuid_array entry in the shared DbValueFixtures contract (round-trip + driver-value tests green). 2. Trusted identity headers (auth/trustedheaders.go). Context does not cross the ABI, so guests cannot see the host's verified principal. The SECURE contract: the host runs its RBAC guard against the signature-verified JWT, strips any client-supplied copy of the X-Bn-Verified-* headers, and sets them itself from auth.Get{Public,}UserFromContext; the guest reconstructs context via auth.TrustedHeaderMiddleware and trusts ONLY those headers. Guests MUST NOT decode a client cookie/Bearer token for identity — that is a privilege-escalation bug (a verified public user forging an admin JWT the guest would honour on a RolePublic method). Documented in docs/wasm-abi.md, replacing the ambiguous "auth context reaches the guest via HttpRequest headers" line that invited the insecure decode. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 00:43:13 +08:00
Alex Dunmow	704b046727	feat(abi): wasm plugin ABI protobuf schema v1 (WO-WZ-001) Defines the host<->guest wire contract for the .so -> wazero migration as a repo-local buf module (abi/proto/v1, generated Go in abi/v1): - manifest.proto: PluginManifest mirroring every static field of plugin.PluginRegistration (abi_version, deps, block/template registrations, admin pages, settings schema, theme presets, fonts, master pages, AI actions, RBAC method roles, CSS manifest, icon packs, directory extensions, job types, RAG fetcher types, settings panel, hook flags, core service bindings) - invoke.proto: bn_invoke envelope, Hook catalog (RENDER_BLOCK, RENDER_TEMPLATE, HANDLE_HTTP, JOB, LOAD, UNLOAD, RAG_FETCH, MEDIA_HOOK, DESCRIBE), AbiError, and job/lifecycle/rag/media/describe payloads - render.proto: RenderBlock/RenderTemplate payloads + RenderContext enumerating every ctx value from blocks/context.go (incl. BlockContext 1:1) - http.proto: buffered HttpRequest/HttpResponse for HANDLE_HTTP - db.proto: guest sql-driver messages (DbValue oneof over pgx-mappable types, query/exec/tx with host-side tx handles, SQLSTATE-carrying DbError) - capability.proto: HostCall envelope + one request/response pair per CoreServices interface method (content, settings+update, gating, crypto, menus, datasources, users, subscriptions, media.deposit, email.send, ai.text_call, ai.tools.register, bridge, jobs.submit, embeddings, rag, reviews, badges.refresh) The abi/ buf module is deliberately separate from the repo-root config: proto/ is the shared block/proto submodule (service API contracts); the ABI is SDK-internal and versions in lockstep with the guest shim. New `make abi` target runs buf lint + generate. docs/wasm-abi.md documents the ptr+len calling convention (bn_alloc, bn_invoke, packed u64), hook catalog, error semantics, abi_version evolution rules, and the full registration/ CoreServices coverage tables. Verified: `cd abi && buf lint` exit 0; `go build ./...` exit 0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 12:47:00 +08:00

Author

SHA1

Message

Date

Alex Dunmow

314a25353d

feat(abi,auth): first-class uuid[] DbValue + trusted identity headers (WZ-016)

Two shared wasm-boundary fixes surfaced by the messenger port (WZ-013):

1. uuid[] DbValue variant. bnwasm had no uuid-array bind/scan, so every
   ANY($1::uuid[]) query broke in the guest ("unsupported argument type
   []uuid.UUID") and messenger worked around it with a ::text[]::uuid[] cast.
   Adds a dedicated DbValue.uuid_array_value (abiv1.UuidArray) — distinct from
   text[] so the host binds a native uuid[] param (queries keep ::uuid[]) and
   scans a uuid[] column straight into []uuid.UUID. Guest toDbValue marshals
   []uuid.UUID; naturalValue/assign parse the canonical strings back into
   []uuid.UUID (nil→NULL, empty stays empty). Pinned by the uuid_array entry in
   the shared DbValueFixtures contract (round-trip + driver-value tests green).

2. Trusted identity headers (auth/trustedheaders.go). Context does not cross
   the ABI, so guests cannot see the host's verified principal. The SECURE
   contract: the host runs its RBAC guard against the signature-verified JWT,
   strips any client-supplied copy of the X-Bn-Verified-* headers, and sets
   them itself from auth.Get{Public,}UserFromContext; the guest reconstructs
   context via auth.TrustedHeaderMiddleware and trusts ONLY those headers.
   Guests MUST NOT decode a client cookie/Bearer token for identity — that is a
   privilege-escalation bug (a verified public user forging an admin JWT the
   guest would honour on a RolePublic method). Documented in docs/wasm-abi.md,
   replacing the ambiguous "auth context reaches the guest via HttpRequest
   headers" line that invited the insecure decode.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-04 00:43:13 +08:00

Alex Dunmow

704b046727

feat(abi): wasm plugin ABI protobuf schema v1 (WO-WZ-001)

Defines the host<->guest wire contract for the .so -> wazero migration as a
repo-local buf module (abi/proto/v1, generated Go in abi/v1):

- manifest.proto: PluginManifest mirroring every static field of
  plugin.PluginRegistration (abi_version, deps, block/template registrations,
  admin pages, settings schema, theme presets, fonts, master pages, AI
  actions, RBAC method roles, CSS manifest, icon packs, directory
  extensions, job types, RAG fetcher types, settings panel, hook flags,
  core service bindings)
- invoke.proto: bn_invoke envelope, Hook catalog (RENDER_BLOCK,
  RENDER_TEMPLATE, HANDLE_HTTP, JOB, LOAD, UNLOAD, RAG_FETCH, MEDIA_HOOK,
  DESCRIBE), AbiError, and job/lifecycle/rag/media/describe payloads
- render.proto: RenderBlock/RenderTemplate payloads + RenderContext
  enumerating every ctx value from blocks/context.go (incl. BlockContext 1:1)
- http.proto: buffered HttpRequest/HttpResponse for HANDLE_HTTP
- db.proto: guest sql-driver messages (DbValue oneof over pgx-mappable
  types, query/exec/tx with host-side tx handles, SQLSTATE-carrying DbError)
- capability.proto: HostCall envelope + one request/response pair per
  CoreServices interface method (content, settings+update, gating, crypto,
  menus, datasources, users, subscriptions, media.deposit, email.send,
  ai.text_call, ai.tools.register, bridge, jobs.submit, embeddings, rag,
  reviews, badges.refresh)

The abi/ buf module is deliberately separate from the repo-root config:
proto/ is the shared block/proto submodule (service API contracts); the ABI
is SDK-internal and versions in lockstep with the guest shim. New `make abi`
target runs buf lint + generate. docs/wasm-abi.md documents the ptr+len
calling convention (bn_alloc, bn_invoke, packed u64), hook catalog, error
semantics, abi_version evolution rules, and the full registration/
CoreServices coverage tables.

Verified: `cd abi && buf lint` exit 0; `go build ./...` exit 0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-03 12:47:00 +08:00

2 Commits