Sanitize trigger source

Author: myftija

apps/webapp/app/routes/api.v1.tasks.$taskId.trigger.ts

@@ -22,6 +22,15 @@ import {
 import { ServiceValidationError } from "~/v3/services/baseService.server";
 import { OutOfEntitlementError, TriggerTaskService } from "~/v3/services/triggerTask.server";
 
+const ALLOWED_TRIGGER_SOURCES = new Set(["sdk", "cli", "mcp"]);
+
+export function sanitizeTriggerSource(value: string | null | undefined): string | undefined {
+  if (value && ALLOWED_TRIGGER_SOURCES.has(value)) {
+    return value;
+  }
+  return undefined;
+}
+
 const ParamsSchema = z.object({
   taskId: z.string(),
 });
@@ -121,7 +130,7 @@ const { action, loader } = createActionApiRoute(
           realtimeStreamsVersion: determineRealtimeStreamsVersion(
             realtimeStreamsVersion ?? undefined
           ),
-          triggerSource: isFromWorker ? "sdk" : triggerSourceHeader ?? "api",
+          triggerSource: isFromWorker ? "sdk" : sanitizeTriggerSource(triggerSourceHeader) ?? "api",
           triggerAction: "trigger",
         },
         engineVersion ?? undefined

apps/webapp/app/routes/api.v1.tasks.batch.ts

@@ -15,7 +15,7 @@ import {
   BatchTriggerV3Service,
 } from "~/v3/services/batchTriggerV3.server";
 import { OutOfEntitlementError } from "~/v3/services/triggerTask.server";
-import { HeadersSchema } from "./api.v1.tasks.$taskId.trigger";
+import { HeadersSchema, sanitizeTriggerSource } from "./api.v1.tasks.$taskId.trigger";
 import { determineRealtimeStreamsVersion } from "~/services/realtime/v1StreamsGlobal.server";
 import { extractJwtSigningSecretKey } from "~/services/realtime/jwtAuth.server";
 
@@ -114,7 +114,7 @@ const { action, loader } = createActionApiRoute(
         realtimeStreamsVersion: determineRealtimeStreamsVersion(
           realtimeStreamsVersion ?? undefined
         ),
-        triggerSource: isFromWorker ? "sdk" : triggerSourceHeader ?? undefined,
+        triggerSource: isFromWorker ? "sdk" : sanitizeTriggerSource(triggerSourceHeader),
         triggerAction: "trigger",
       });
 

apps/webapp/app/routes/api.v2.tasks.batch.ts

@@ -17,7 +17,7 @@ import {
 import { ServiceValidationError } from "~/v3/services/baseService.server";
 import { BatchProcessingStrategy } from "~/v3/services/batchTriggerV3.server";
 import { OutOfEntitlementError } from "~/v3/services/triggerTask.server";
-import { HeadersSchema } from "./api.v1.tasks.$taskId.trigger";
+import { HeadersSchema, sanitizeTriggerSource } from "./api.v1.tasks.$taskId.trigger";
 import { determineRealtimeStreamsVersion } from "~/services/realtime/v1StreamsGlobal.server";
 import { extractJwtSigningSecretKey } from "~/services/realtime/jwtAuth.server";
 
@@ -128,7 +128,7 @@ const { action, loader } = createActionApiRoute(
         realtimeStreamsVersion: determineRealtimeStreamsVersion(
           realtimeStreamsVersion ?? undefined
         ),
-        triggerSource: isFromWorker ? "sdk" : triggerSourceHeader ?? undefined,
+        triggerSource: isFromWorker ? "sdk" : sanitizeTriggerSource(triggerSourceHeader),
         triggerAction: "trigger",
       });