vercel__workflow/.changeset/world-local-tighten-id-validation.md at codex/atomic-start-docs

mirror of https://github.com/vercel/workflow.git synced 2026-09-14 19:59:43 +08:00

Files

T

Nathan Rajlich 657e8bb962 Forward-port #1920 : tighten world-local ID validation (#2097 )

* fix(world-local): tighten ID validation

Forward-port of code review fixes from #1920 (backport of #1829):

- Reject dots inside entity IDs in `assertSafeEntityId`. Internal IDs
  (ULIDs, step_N, etc.) never contain dots, but `stripTag()` /
  `getObjectCreatedAt()` strip a trailing `.[tag]` suffix from filenames,
  so a request-supplied runId like `wrun_123.foo` would be silently
  mangled during listing/pagination.

- Reject empty `correlationId` on events that include one. The event
  schemas only require `z.string()`, so without this check a
  step_created / hook_created / wait_created request with
  `correlationId: ''` would silently be written under a malformed
  composite key like `${runId}-`.

The streamer regression tests from #1920 are not forward-ported because
main's streamer surface differs (renamed methods, separate test
coverage) from stable's v4 shape.

* simplify changeset

2026-05-22 13:49:41 -07:00

108 B

Raw Permalink Blame History

@workflow/world-local

@workflow/world-local
patch

Reject dots and empty correlationId values in entity ID validation.

108 B Raw Permalink Blame History

108 B

Raw Permalink Blame History