fix: use packages temporal on api

Signed-off-by: Mouad BANI <mouad-mb@outlook.com>

Author: mbani01

backend/config/custom-environment-variables.json

@@ -180,6 +180,12 @@
     "certificate": "CROWD_TEMPORAL_CERTIFICATE",
     "privateKey": "CROWD_TEMPORAL_PRIVATE_KEY"
   },
+  "packagesTemporal": {
+    "serverUrl": "CROWD_TEMPORAL_SERVER_URL",
+    "namespace": "CROWD_PACKAGES_TEMPORAL_NAMESPACE",
+    "certificate": "CROWD_TEMPORAL_CERTIFICATE",
+    "privateKey": "CROWD_TEMPORAL_PRIVATE_KEY"
+  },
   "searchSyncApi": {
     "baseUrl": "CROWD_SEARCH_SYNC_API_URL"
   },

backend/config/default.json

@@ -43,6 +43,7 @@
     "isEnabled": "false"
   },
   "temporal": {},
+  "packagesTemporal": {},
   "searchSyncApi": {},
   "encryption": {},
   "openStatusApi": {},

backend/src/api/public/v1/packages/getPackage.ts

@@ -13,6 +13,7 @@ import {
 import { WorkflowIdConflictPolicy, WorkflowIdReusePolicy } from '@crowd/temporal'
 
 import { getPackagesQx } from '@/db/packagesDb'
+import { getPackagesTemporalClient } from '@/db/packagesTemporal'
 import { ok } from '@/utils/api'
 import { validateOrThrow } from '@/utils/validation'
 
@@ -54,7 +55,8 @@ export async function getPackage(req: Request, res: Response): Promise<void> {
 
   if (pkg.contactsLastRefreshed == null) {
     try {
-      await req.temporal.workflow.execute('ingestSecurityContactsForPurlWorkflow', {
+      const packagesTemporal = await getPackagesTemporalClient()
+      await packagesTemporal.workflow.execute('ingestSecurityContactsForPurlWorkflow', {
         taskQueue: 'packages-worker',
         workflowId: ondemandWorkflowId(purl),
         workflowIdReusePolicy: WorkflowIdReusePolicy.ALLOW_DUPLICATE,

backend/src/conf/index.ts

@@ -86,6 +86,14 @@ export const PACKAGES_DB_CONFIG: IDatabaseConfig | undefined = config.has('packa
   ? config.get<IDatabaseConfig>('packagesDb')
   : undefined
 
+// packages_worker (npm/maven/pypi/osv/security-contacts/...) runs in its own Temporal
+// namespace, separate from the API's default namespace — see CROWD_PACKAGES_TEMPORAL_NAMESPACE.
+export const PACKAGES_TEMPORAL_CONFIG: ITemporalConfig | undefined = config.has(
+  'packagesTemporal.namespace',
+)
+  ? config.get<ITemporalConfig>('packagesTemporal')
+  : undefined
+
 export const SEGMENT_CONFIG: SegmentConfiguration = config.get<SegmentConfiguration>('segment')
 
 export const COMPREHEND_CONFIG: ComprehendConfiguration =

backend/src/db/packagesTemporal.ts

@@ -0,0 +1,47 @@
+import { Client, Connection, getDataConverter } from '@crowd/temporal'
+import { IS_DEV_ENV, SERVICE } from '@crowd/common'
+
+import { PACKAGES_TEMPORAL_CONFIG } from '@/conf'
+
+let _init: Promise<Client> | undefined
+
+// Separate connection from the API's default req.temporal client — packages_worker
+// (npm/maven/pypi/osv/security-contacts/...) polls task queues in its own Temporal
+// namespace (CROWD_PACKAGES_TEMPORAL_NAMESPACE), not the API's default namespace.
+export function getPackagesTemporalClient(): Promise<Client> {
+  if (!_init) {
+    if (!PACKAGES_TEMPORAL_CONFIG?.serverUrl) {
+      throw new Error(
+        'Packages Temporal is not configured — set CROWD_PACKAGES_TEMPORAL_NAMESPACE',
+      )
+    }
+
+    const cfg = PACKAGES_TEMPORAL_CONFIG
+    _init = Connection.connect({
+      address: cfg.serverUrl,
+      tls:
+        cfg.certificate && cfg.privateKey
+          ? {
+              clientCertPair: {
+                crt: Buffer.from(cfg.certificate, 'base64'),
+                key: Buffer.from(cfg.privateKey, 'base64'),
+              },
+            }
+          : undefined,
+    })
+      .then(
+        async (connection) =>
+          new Client({
+            connection,
+            namespace: cfg.namespace,
+            identity: SERVICE,
+            dataConverter: IS_DEV_ENV ? undefined : await getDataConverter(),
+          }),
+      )
+      .catch((err) => {
+        _init = undefined
+        throw err
+      })
+  }
+  return _init
+}

scripts/services/security-contacts-worker.yaml

@@ -7,6 +7,7 @@ x-env-args: &env-args
   SHELL: /bin/sh
   SUPPRESS_NO_CONFIG_WARNING: 'true'
   CROWD_TEMPORAL_TASKQUEUE: packages-worker
+  CROWD_TEMPORAL_NAMESPACE: ${CROWD_PACKAGES_TEMPORAL_NAMESPACE}
 
 services:
   security-contacts-worker: