fix(workflow): confine project workflow scripts

Author: Waishnav

skills/dynamic-workflows/SKILL.md

@@ -28,7 +28,7 @@ devspace workflow call <runId> <callIndex>
 devspace workflow tui [runId]
 ```
 
-Named scripts: `.devspace/workflows/<name>.js` or `workflows/<name>.js`.
+Project named scripts live under `.devspace/workflows/<name>.js`.
 
 ## Script shape
 

src/workflow-cli.ts

@@ -17,6 +17,7 @@ import { executeWorkflow, mapEngineErrorKind } from "./workflow-engine.js";
 import {
   parseWorkflowArgFlagsResult,
   persistWorkflowScriptResult,
+  readProjectWorkflowScriptFile,
   readWorkflowScriptFileResult,
   resolveNamedWorkflowScript,
   resolveWorkflowScriptFromPathOrNameResult,
@@ -416,7 +417,12 @@ export async function runWorkflowWorker(
           });
           return named.source;
         }
-        return readFile(ref.scriptPath, "utf8");
+        return (
+          await readProjectWorkflowScriptFile({
+            scriptPath: ref.scriptPath,
+            workspaceRoot: claimed.workspaceRoot,
+          })
+        ).source;
       },
     });
 

src/workflow-errors.ts

@@ -13,7 +13,12 @@ import type {
 export class InvalidWorkflowInputError extends TaggedError(
   "InvalidWorkflowInputError",
 )<{
-  code: "ambiguous_source" | "missing_source" | "invalid_name" | "invalid_argument";
+  code:
+    | "ambiguous_source"
+    | "missing_source"
+    | "invalid_name"
+    | "invalid_argument"
+    | "invalid_path";
   message: string;
 }>() {}
 

src/workflow-files.test.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import {
   parseWorkflowArgFlags,
   persistWorkflowScript,
+  readProjectWorkflowScriptFile,
   resolveNamedWorkflowScript,
   resolveWorkflowScriptFromPathOrName,
   WorkflowPathError,
@@ -52,6 +53,33 @@ import { hashSource } from "./workflow-script.js";
   });
   assert.equal(named.origin, "named");
   assert.match(named.source, /named/);
+  assert.equal(
+    (
+      await readProjectWorkflowScriptFile({
+        scriptPath: join(dir, ".devspace", "workflows", "named.js"),
+        workspaceRoot: dir,
+      })
+    ).nameHint,
+    "named",
+  );
+  await assert.rejects(
+    () =>
+      readProjectWorkflowScriptFile({
+        scriptPath: path,
+        workspaceRoot: dir,
+      }),
+    /must be inside/,
+  );
+
+  await mkdir(join(dir, "workflows"), { recursive: true });
+  await writeFile(
+    join(dir, "workflows", "legacy.js"),
+    "export const meta = { name: 'legacy', description: 'd' }\nreturn 3\n",
+  );
+  await assert.rejects(
+    () => resolveNamedWorkflowScript({ name: "legacy", workspaceRoot: dir }),
+    WorkflowPathError,
+  );
 
   await assert.rejects(
     () => resolveNamedWorkflowScript({ name: "missing", workspaceRoot: dir }),

src/workflow-files.ts

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, realpath, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
 import { Result, type Result as BetterResult } from "better-result";
 import { hashSource } from "./workflow-script.js";
@@ -11,6 +11,7 @@ import {
   WorkflowFileReadError,
   WorkflowFileWriteError,
 } from "./workflow-errors.js";
+import { isPathInsideRoot } from "./roots.js";
 
 export class WorkflowPathError extends Error {
   constructor(message: string) {
@@ -97,12 +98,65 @@ export async function readWorkflowScriptFileResult(
   });
 }
 
+export async function readProjectWorkflowScriptFile(input: {
+  scriptPath: string;
+  workspaceRoot: string;
+}): Promise<ResolvedWorkflowScript> {
+  const result = await readProjectWorkflowScriptFileResult(input);
+  if (result.isErr()) throwPathCompatibilityError(result.error);
+  return result.value;
+}
+
+/** Resolve an explicit nested script only inside `<project>/.devspace/workflows`. */
+export async function readProjectWorkflowScriptFileResult(input: {
+  scriptPath: string;
+  workspaceRoot: string;
+}): Promise<BetterResult<ResolvedWorkflowScript, WorkflowFileResolveError>> {
+  const projectWorkflowRoot = resolve(input.workspaceRoot, ".devspace", "workflows");
+  const requestedPath = isAbsolute(input.scriptPath)
+    ? resolve(input.scriptPath)
+    : resolve(projectWorkflowRoot, input.scriptPath);
+
+  if (!isPathInsideRoot(requestedPath, projectWorkflowRoot)) {
+    return Result.err(
+      new InvalidWorkflowInputError({
+        code: "invalid_path",
+        message: `Nested workflow script must be inside ${projectWorkflowRoot}`,
+      }),
+    );
+  }
+
+  let canonicalRoot: string;
+  let canonicalPath: string;
+  try {
+    [canonicalRoot, canonicalPath] = await Promise.all([
+      realpath(projectWorkflowRoot),
+      realpath(requestedPath),
+    ]);
+  } catch (cause) {
+    return Result.err(
+      isFileNotFound(cause)
+        ? new WorkflowFileNotFoundError(requestedPath)
+        : new WorkflowFileReadError(requestedPath, cause),
+    );
+  }
+
+  if (!isPathInsideRoot(canonicalPath, canonicalRoot)) {
+    return Result.err(
+      new InvalidWorkflowInputError({
+        code: "invalid_path",
+        message: `Nested workflow script resolves outside ${projectWorkflowRoot}`,
+      }),
+    );
+  }
+  return readWorkflowScriptFileResult(canonicalPath);
+}
+
 /**
  * Resolve named workflow script.
  * Search order:
  * 1. `<cwd>/.devspace/workflows/<name>.js`
- * 2. `<cwd>/workflows/<name>.js`
- * 3. `<stateDir>/workflows/<name>.js` (if stateDir provided)
+ * 2. `<stateDir>/workflows/<name>.js` (if stateDir provided)
  */
 export async function resolveNamedWorkflowScript(input: {
   name: string;
@@ -130,7 +184,6 @@ export async function resolveNamedWorkflowScriptResult(input: {
   }
   const candidates = [
     join(input.workspaceRoot, ".devspace", "workflows", `${name}.js`),
-    join(input.workspaceRoot, "workflows", `${name}.js`),
   ];
   if (input.stateDir) {
     candidates.push(join(input.stateDir, "workflows", `${name}.js`));