Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

feat: add backend resource fetch api

Browse Source
This commit is contained in:
Hare
2026-07-08 20:18:38 +09:00
parent 1a2097b10d
commit 57e96d3be8
16 changed files with 859 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/workspace-server/src/companion.rs
+1
View File
@@ -455,6 +455,7 @@ fn companion_config_bundle() -> ConfigBundle {
}],
declarations: Vec::new(),
profile_source_archive: Some(companion_profile_archive()),
profile_source_archive_handle: None,
}
.with_computed_digest()
}
crates/workspace-server/src/hosts.rs
+87 -15
View File
@@ -1,4 +1,5 @@
use crate::Error;
use crate::resource_broker::BackendResourceBroker;
use chrono::Utc;
use reqwest::StatusCode;
use reqwest::blocking::{Client as BlockingHttpClient, RequestBuilder};
@@ -1032,6 +1033,7 @@ pub struct EmbeddedWorkerRuntime {
host_id: String,
runtime: worker_runtime::Runtime,
execution_enabled: bool,
resource_broker: BackendResourceBroker,
}
fn embedded_runtime_options() -> EmbeddedRuntimeOptions {
@@ -1082,6 +1084,11 @@ impl EmbeddedWorkerRuntime {
Ok(embedded)
}
pub fn with_resource_broker(mut self, resource_broker: BackendResourceBroker) -> Self {
self.resource_broker = resource_broker;
self
}
pub fn from_runtime(workspace_id: impl AsRef<str>, runtime: worker_runtime::Runtime) -> Self {
let runtime_id = runtime
.runtime_id()
@@ -1093,6 +1100,7 @@ impl EmbeddedWorkerRuntime {
host_id: host_id_for_embedded_workspace(workspace_id.as_ref()),
runtime,
execution_enabled: false,
resource_broker: BackendResourceBroker::default(),
}
}
@@ -1339,7 +1347,14 @@ impl WorkspaceWorkerRuntime for EmbeddedWorkerRuntime {
.profile
.clone()
.unwrap_or_else(|| embedded_profile_selector(&request.intent));
let config_bundle = match default_embedded_config_bundle(&profile).and_then(|bundle| {
let runtime_id = EmbeddedRuntimeId::new(self.runtime_id.clone());
let config_bundle = match default_embedded_config_bundle(
&profile,
&self.host_id,
runtime_id.as_ref(),
&self.resource_broker,
)
.and_then(|bundle| {
self.runtime
.store_config_bundle(bundle)
.map_err(|err| err.to_string())
@@ -1717,6 +1732,7 @@ pub struct RemoteWorkerRuntime {
cached_capabilities: RuntimeCapabilitySummary,
cached_status: String,
host_id: String,
resource_broker: BackendResourceBroker,
http: BlockingHttpClient,
}
@@ -1740,10 +1756,16 @@ impl RemoteWorkerRuntime {
bearer_token: config.bearer_token,
cached_capabilities: config.cached_capabilities,
cached_status: config.cached_status,
resource_broker: BackendResourceBroker::default(),
http,
})
}
pub fn with_resource_broker(mut self, resource_broker: BackendResourceBroker) -> Self {
self.resource_broker = resource_broker;
self
}
fn endpoint(&self, path: &str) -> String {
format!("{}{}", self.base_url, path)
}
@@ -2025,7 +2047,13 @@ impl WorkspaceWorkerRuntime for RemoteWorkerRuntime {
.profile
.clone()
.unwrap_or_else(|| embedded_profile_selector(&request.intent));
let sync = match default_embedded_config_bundle(&profile) {
let runtime_id = EmbeddedRuntimeId::new(self.runtime_id.clone());
let sync = match default_embedded_config_bundle(
&profile,
&self.host_id,
runtime_id.as_ref(),
&self.resource_broker,
) {
Ok(bundle) => self.sync_config_bundle(bundle),
Err(error) => ConfigBundleSyncResult {
state: WorkerOperationState::Rejected,
@@ -2365,19 +2393,31 @@ fn embedded_worker_execution_status_label(
}
}
fn default_embedded_config_bundle(profile: &ProfileSelector) -> Result<ConfigBundle, String> {
fn default_embedded_config_bundle(
profile: &ProfileSelector,
workspace_id: &str,
runtime_id: Option<&EmbeddedRuntimeId>,
resource_broker: &BackendResourceBroker,
) -> Result<ConfigBundle, String> {
let id = format!(
"workspace-runtime-{}",
embedded_profile_label(profile)
.unwrap_or_else(|| "default".to_string())
.replace([':', '/', ' '], "-")
);
let archive = default_profile_source_archive(profile)?;
let handle = resource_broker.issue_profile_source_archive_handle(
workspace_id.to_string(),
runtime_id,
None,
archive,
);
Ok(ConfigBundle {
metadata: ConfigBundleMetadata {
id,
digest: String::new(),
revision: "workspace-runtime-v0".to_string(),
workspace_id: "workspace-server".to_string(),
workspace_id: workspace_id.to_string(),
created_at: "runtime-generated".to_string(),
provenance: ConfigBundleProvenance {
source: "workspace-server".to_string(),
@@ -2389,7 +2429,8 @@ fn default_embedded_config_bundle(profile: &ProfileSelector) -> Result<ConfigBun
label: embedded_profile_label(profile),
}],
declarations: Vec::new(),
profile_source_archive: Some(default_profile_source_archive(profile)?),
profile_source_archive: None,
profile_source_archive_handle: Some(handle),
}
.with_computed_digest())
}
@@ -2967,6 +3008,8 @@ mod tests {
#[test]
fn embedded_builtin_decodal_profiles_resolve_through_archive() {
let root = tempfile::tempdir().unwrap();
let broker = BackendResourceBroker::default();
let runtime_id = EmbeddedRuntimeId::new("runtime-test".to_string()).unwrap();
for selector in [
ProfileSelector::RuntimeDefault,
ProfileSelector::Builtin("builtin:companion".to_string()),
@@ -2975,13 +3018,30 @@ mod tests {
ProfileSelector::Builtin("builtin:coder".to_string()),
ProfileSelector::Builtin("builtin:reviewer".to_string()),
] {
let bundle = default_embedded_config_bundle(&selector).unwrap();
let archive = bundle
.profile_source_archive
.as_ref()
.unwrap()
.verify()
let bundle = default_embedded_config_bundle(
&selector,
"workspace-test",
Some(&runtime_id),
&broker,
)
.unwrap();
let handle = bundle.profile_source_archive_handle.as_ref().unwrap();
assert!(bundle.profile_source_archive.is_none());
let response = broker
.fetch_profile_source_archive(
worker_runtime::resource::BackendResourceFetchRequest {
handle: handle.clone(),
runtime_id: runtime_id.as_str().to_string(),
worker_id: None,
audit_correlation_id: handle.audit_correlation_id.clone(),
},
)
.unwrap();
let archive =
worker_runtime::resource::profile_source_archive_from_response(handle, response)
.unwrap()
.verify()
.unwrap();
let selector_key = match &selector {
ProfileSelector::RuntimeDefault => "default".to_string(),
ProfileSelector::Builtin(name) => name.clone(),
@@ -2996,14 +3056,25 @@ mod tests {
#[test]
fn embedded_archive_rejects_unknown_selectors() {
let broker = BackendResourceBroker::default();
let runtime_id = EmbeddedRuntimeId::new("runtime-test".to_string()).unwrap();
assert!(
default_embedded_config_bundle(&ProfileSelector::Builtin(
"builtin:missing".to_string()
))
default_embedded_config_bundle(
&ProfileSelector::Builtin("builtin:missing".to_string()),
"workspace-test",
Some(&runtime_id),
&broker,
)
.is_err()
);
assert!(
default_embedded_config_bundle(&ProfileSelector::Named("custom".to_string())).is_err()
default_embedded_config_bundle(
&ProfileSelector::Named("custom".to_string()),
"workspace-test",
Some(&runtime_id),
&broker,
)
.is_err()
);
}
@@ -3030,6 +3101,7 @@ mod tests {
reference: "capability:read".to_string(),
}],
profile_source_archive: None,
profile_source_archive_handle: None,
}
.with_computed_digest()
}
crates/workspace-server/src/lib.rs
+1
View File
@@ -11,6 +11,7 @@ pub mod identity;
pub mod observation;
pub mod records;
pub mod repositories;
pub mod resource_broker;
pub mod server;
pub mod store;
crates/workspace-server/src/resource_broker.rs
+231
View File
@@ -0,0 +1,231 @@
use async_trait::async_trait;
use chrono::{Duration, Utc};
use std::collections::HashMap;
use std::sync::{Arc, Mutex};
use uuid::Uuid;
use worker_runtime::identity::{RuntimeId, WorkerId};
use worker_runtime::profile_archive::ProfileSourceArchive;
use worker_runtime::resource::{
BackendResourceClient, BackendResourceError, BackendResourceFetchRequest,
BackendResourceFetchResponse, BackendResourceHandle, BackendResourceKind,
BackendResourceOperation, DEFAULT_PROFILE_SOURCE_ARCHIVE_MAX_BYTES,
PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE, ResourceRedactionPolicy,
};
#[derive(Clone, Default)]
pub struct BackendResourceBroker {
resources: Arc<Mutex<HashMap<String, StoredResource>>>,
}
#[derive(Clone)]
struct StoredResource {
workspace_id: String,
runtime_id: Option<String>,
worker_id: Option<String>,
handle: BackendResourceHandle,
archive: ProfileSourceArchive,
}
impl BackendResourceBroker {
pub fn issue_profile_source_archive_handle(
&self,
workspace_id: impl Into<String>,
runtime_id: Option<&RuntimeId>,
worker_id: Option<&WorkerId>,
archive: ProfileSourceArchive,
) -> BackendResourceHandle {
let workspace_id = workspace_id.into();
let nonce = Uuid::now_v7().to_string();
let audit_correlation_id = format!("resource-fetch-{nonce}");
let expires_at = Utc::now() + Duration::minutes(15);
let handle = BackendResourceHandle {
kind: BackendResourceKind::ProfileSourceArchive,
workspace_id: workspace_id.clone(),
scope_id: Some("workspace-profile-source".to_string()),
runtime_id: runtime_id.map(|id| id.as_str().to_string()),
worker_id: worker_id.map(|id| id.as_str().to_string()),
resource_id: archive.reference.id.clone(),
digest: archive.reference.digest.clone(),
operation: BackendResourceOperation::FetchArchive,
expires_at_unix_seconds: expires_at.timestamp(),
nonce: nonce.clone(),
revision: archive.reference.digest.clone(),
generation: None,
max_bytes: DEFAULT_PROFILE_SOURCE_ARCHIVE_MAX_BYTES,
content_type: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
redaction: ResourceRedactionPolicy::RuntimeInternalOnly,
audit_correlation_id,
profile_source_graph: Some(archive.reference.source_graph.clone()),
};
let stored = StoredResource {
workspace_id,
runtime_id: runtime_id.map(|id| id.as_str().to_string()),
worker_id: worker_id.map(|id| id.as_str().to_string()),
handle: handle.clone(),
archive,
};
if let Ok(mut resources) = self.resources.lock() {
resources.insert(nonce, stored);
}
handle
}
pub fn fetch_profile_source_archive(
&self,
request: BackendResourceFetchRequest,
) -> Result<BackendResourceFetchResponse, BackendResourceError> {
verify_handle_shape(&request.handle)?;
if request.handle.expires_at_unix_seconds < Utc::now().timestamp() {
return Err(BackendResourceError::Expired);
}
let stored = self
.resources
.lock()
.map_err(|_| BackendResourceError::Transport {
message: "resource broker lock poisoned".to_string(),
})?
.get(&request.handle.nonce)
.cloned()
.ok_or(BackendResourceError::MissingResource)?;
if stored.workspace_id != request.handle.workspace_id
|| stored.runtime_id != request.handle.runtime_id
|| stored.worker_id != request.handle.worker_id
|| stored.handle.resource_id != request.handle.resource_id
|| stored.handle.digest != request.handle.digest
|| stored.handle.revision != request.handle.revision
{
return Err(BackendResourceError::Unauthorized {
message: "resource handle metadata does not match broker record".to_string(),
});
}
if let Some(expected_runtime_id) = stored.runtime_id.as_deref() {
if expected_runtime_id != request.runtime_id {
return Err(BackendResourceError::Unauthorized {
message: "runtime id does not match resource handle".to_string(),
});
}
}
if let Some(expected_worker_id) = stored.worker_id.as_deref() {
if Some(expected_worker_id) != request.worker_id.as_deref() {
return Err(BackendResourceError::Unauthorized {
message: "worker id does not match resource handle".to_string(),
});
}
}
let actual_bytes = stored.archive.content.len() as u64;
if actual_bytes > request.handle.max_bytes {
return Err(BackendResourceError::Oversized {
max_bytes: request.handle.max_bytes,
actual_bytes,
});
}
Ok(BackendResourceFetchResponse {
kind: BackendResourceKind::ProfileSourceArchive,
resource_id: stored.archive.reference.id,
digest: stored.archive.reference.digest,
content_type: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
bytes: stored.archive.content,
audit_correlation_id: request.audit_correlation_id,
})
}
}
#[async_trait]
impl BackendResourceClient for BackendResourceBroker {
async fn fetch_resource(
&self,
request: BackendResourceFetchRequest,
) -> Result<BackendResourceFetchResponse, BackendResourceError> {
self.fetch_profile_source_archive(request)
}
}
fn verify_handle_shape(handle: &BackendResourceHandle) -> Result<(), BackendResourceError> {
if handle.kind != BackendResourceKind::ProfileSourceArchive {
return Err(BackendResourceError::UnsupportedKind);
}
if handle.operation != BackendResourceOperation::FetchArchive {
return Err(BackendResourceError::Unauthorized {
message: "resource handle operation is not fetch_archive".to_string(),
});
}
if handle.content_type != PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE {
return Err(BackendResourceError::ContentTypeMismatch {
expected: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
actual: handle.content_type.clone(),
});
}
Ok(())
}
#[cfg(test)]
mod tests {
use super::*;
use std::collections::BTreeMap;
use worker_runtime::identity::RuntimeId;
use worker_runtime::profile_archive::{
ProfileSourceArchive, ProfileSourceArchiveRef, ProfileSourceGraphSummary, sha256_hex,
};
fn archive() -> ProfileSourceArchive {
let content = b"archive-content".to_vec();
let mut entrypoints = BTreeMap::new();
entrypoints.insert("default".to_string(), "profiles/default.dcdl".to_string());
ProfileSourceArchive {
reference: ProfileSourceArchiveRef {
id: "profile-source-archive:test".to_string(),
digest: sha256_hex(&content),
size_bytes: content.len() as u64,
source_graph: ProfileSourceGraphSummary {
entrypoints,
source_count: 1,
import_count: 0,
total_source_bytes: content.len() as u64,
},
},
content,
}
}
#[test]
fn broker_issues_and_verifies_profile_source_archive_handles() {
let broker = BackendResourceBroker::default();
let runtime_id = RuntimeId::new("runtime-test").unwrap();
let handle = broker.issue_profile_source_archive_handle(
"workspace-test",
Some(&runtime_id),
None,
archive(),
);
let response = broker
.fetch_profile_source_archive(BackendResourceFetchRequest {
handle: handle.clone(),
runtime_id: runtime_id.as_str().to_string(),
worker_id: None,
audit_correlation_id: handle.audit_correlation_id.clone(),
})
.expect("fetch succeeds");
assert_eq!(response.digest, handle.digest);
assert_eq!(response.content_type, PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE);
}
#[test]
fn broker_rejects_runtime_mismatch() {
let broker = BackendResourceBroker::default();
let handle = broker.issue_profile_source_archive_handle(
"workspace-test",
Some(&RuntimeId::new("runtime-a").unwrap()),
None,
archive(),
);
let err = broker
.fetch_profile_source_archive(BackendResourceFetchRequest {
handle: handle.clone(),
runtime_id: RuntimeId::new("runtime-b").unwrap().as_str().to_string(),
worker_id: None,
audit_correlation_id: handle.audit_correlation_id.clone(),
})
.unwrap_err();
assert!(matches!(err, BackendResourceError::Unauthorized { .. }));
}
}
crates/workspace-server/src/server.rs
+80 -13
View File
@@ -12,7 +12,8 @@ use chrono::{SecondsFormat, Utc};
use futures::StreamExt;
use serde::{Deserialize, Serialize};
use tokio::net::TcpListener;
use worker_runtime::worker_backend::WorkerRuntimeExecutionBackend;
use worker_runtime::resource::{BackendResourceError, BackendResourceFetchRequest};
use worker_runtime::worker_backend::{ProfileRuntimeWorkerFactory, WorkerRuntimeExecutionBackend};
use worker_runtime::working_directory::{
LocalGitWorktreeMaterializer, WorkingDirectoryDiagnostic, WorkingDirectoryMaterializer,
};
@@ -42,6 +43,7 @@ use crate::repositories::{
ConfiguredRepository, RepositoryListProjection, RepositoryLogRead, RepositoryLookupError,
RepositoryRegistryReader, RepositorySummary,
};
use crate::resource_broker::BackendResourceBroker;
use crate::store::{ControlPlaneStore, WorkspaceRecord};
use crate::{Error, Result};
use worker_runtime::catalog::{
@@ -154,6 +156,7 @@ pub struct WorkspaceApi {
runtime: Arc<RuntimeRegistry>,
companion: Arc<CompanionConsole>,
observation_proxy: BackendObservationProxy,
resource_broker: BackendResourceBroker,
working_directory_materializer: Arc<LocalGitWorktreeMaterializer>,
}
@@ -162,21 +165,46 @@ impl WorkspaceApi {
let materializer = Arc::new(LocalGitWorktreeMaterializer::new(
config.embedded_runtime_store_root.clone(),
));
let execution_backend =
WorkerRuntimeExecutionBackend::from_workspace(config.workspace_root.clone())
.map_err(|err| {
crate::Error::Store(format!(
"failed to initialize embedded Worker backend: {err}"
))
})?
.with_working_directory_materializer((*materializer).clone());
Self::new_with_execution_backend(config, store, Arc::new(execution_backend)).await
let resource_broker = BackendResourceBroker::default();
let execution_backend = WorkerRuntimeExecutionBackend::new(
ProfileRuntimeWorkerFactory::new(config.workspace_root.clone())
.with_resource_client(Arc::new(resource_broker.clone())),
)
.map_err(|err| {
crate::Error::Store(format!(
"failed to initialize embedded Worker backend: {err}"
))
})?
.with_working_directory_materializer((*materializer).clone());
Self::new_with_execution_backend_and_broker(
config,
store,
Arc::new(execution_backend),
resource_broker,
)
.await
}
#[cfg(test)]
async fn new_with_execution_backend(
config: ServerConfig,
store: Arc<dyn ControlPlaneStore>,
execution_backend: Arc<dyn worker_runtime::execution::WorkerExecutionBackend>,
) -> Result<Self> {
Self::new_with_execution_backend_and_broker(
config,
store,
execution_backend,
BackendResourceBroker::default(),
)
.await
}
async fn new_with_execution_backend_and_broker(
config: ServerConfig,
store: Arc<dyn ControlPlaneStore>,
execution_backend: Arc<dyn worker_runtime::execution::WorkerExecutionBackend>,
resource_broker: BackendResourceBroker,
) -> Result<Self> {
store
.upsert_workspace(&WorkspaceRecord {
@@ -193,13 +221,17 @@ impl WorkspaceApi {
config.embedded_runtime_store_root.clone(),
execution_backend,
)
.map(|runtime| runtime.with_resource_broker(resource_broker.clone()))
.map_err(|err| {
crate::Error::Store(format!("invalid embedded Worker backend: {err}"))
})?,
);
for remote_config in config.remote_runtime_sources.iter().cloned() {
runtime
.register(RemoteWorkerRuntime::new(remote_config).map_err(|err| err.into_error())?);
runtime.register(
RemoteWorkerRuntime::new(remote_config)
.map(|host| host.with_resource_broker(resource_broker.clone()))
.map_err(|err| err.into_error())?,
);
}
let runtime = Arc::new(runtime);
let companion = Arc::new(CompanionConsole::new(runtime.clone()));
@@ -214,6 +246,7 @@ impl WorkspaceApi {
runtime,
companion,
observation_proxy,
resource_broker,
working_directory_materializer,
})
}
@@ -328,6 +361,10 @@ pub fn build_router(api: WorkspaceApi) -> Router {
"/api/w/{workspace_id}/settings/runtime-connections/remotes/{runtime_id}/test",
post(scoped_test_remote_runtime_connection),
)
.route(
"/internal/runtime/resources/fetch",
post(post_internal_runtime_resource_fetch),
)
.route("/api/companion/status", get(get_companion_status))
.route(
"/api/w/{workspace_id}/companion/status",
@@ -1445,7 +1482,9 @@ async fn add_remote_runtime_connection(
vec![diagnostic],
)
})?;
let active_runtime = RemoteWorkerRuntime::new(active_config).map_err(|err| err.into_error())?;
let active_runtime = RemoteWorkerRuntime::new(active_config)
.map(|host| host.with_resource_broker(api.resource_broker.clone()))
.map_err(|err| err.into_error())?;
local_config.runtimes.remote.push(remote_config);
write_workspace_backend_config_for_settings(&api, &local_config)?;
api.runtime.register_or_replace(active_runtime);
@@ -1696,6 +1735,33 @@ async fn create_workspace_worker(
}))
}
async fn post_internal_runtime_resource_fetch(
State(api): State<WorkspaceApi>,
Json(request): Json<BackendResourceFetchRequest>,
) -> std::result::Result<
Json<worker_runtime::resource::BackendResourceFetchResponse>,
(StatusCode, Json<BackendResourceError>),
> {
api.resource_broker
.fetch_profile_source_archive(request)
.map(Json)
.map_err(|error| (backend_resource_error_status(&error), Json(error)))
}
fn backend_resource_error_status(error: &BackendResourceError) -> StatusCode {
match error {
BackendResourceError::Expired => StatusCode::GONE,
BackendResourceError::Unauthorized { .. } => StatusCode::UNAUTHORIZED,
BackendResourceError::MissingResource => StatusCode::NOT_FOUND,
BackendResourceError::UnsupportedKind
| BackendResourceError::DigestMismatch { .. }
| BackendResourceError::Oversized { .. }
| BackendResourceError::ContentTypeMismatch { .. }
| BackendResourceError::InvalidResponse { .. } => StatusCode::BAD_REQUEST,
BackendResourceError::Transport { .. } => StatusCode::BAD_GATEWAY,
}
}
async fn get_companion_status(
State(api): State<WorkspaceApi>,
) -> ApiResult<Json<CompanionStatusResponse>> {
@@ -3406,6 +3472,7 @@ mod tests {
}],
declarations: Vec::new(),
profile_source_archive: None,
profile_source_archive_handle: None,
}
.with_computed_digest()
}