refactor(sandbox): move sandbox state management server-side (ENG-4287)#381
Draft
huv1k wants to merge 5 commits into
Draft
refactor(sandbox): move sandbox state management server-side (ENG-4287)#381huv1k wants to merge 5 commits into
huv1k wants to merge 5 commits into
Conversation
Stop exposing the user's account-level access token to browser JS. The filesystem inspector and dashboard terminal previously embedded the account token into client-side Sandbox.connect/create calls via sandboxManagementAuth. Now only the sandbox-scoped envdAccessToken reaches the client: - Add createEnvdSandbox helper that builds an envd-only Sandbox client from sandbox-scoped credentials (no control-plane call, no account token). - Filesystem inspector builds its client from the envd creds already returned by the sandbox.details query. - Terminal create/connect moves into the openTerminalSandboxAction server action; the client builds an envd-only client from the result. - Delete the now-unused sandbox-management-auth modules.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…4287 Resolved conflicts in the terminal feature, integrating main's terminal refactor (attach-retry, useTerminalInstance, launchTarget, killTerminalPty) with this branch's server-side sandbox state management: - Terminal acquisition still runs through openTerminalSandboxAction + createEnvdSandbox (no account token in the browser), now forwarding main's requestTimeoutMs and preserving TimeoutError so attach-retry works. - Dropped sandboxManagementAuth from DashboardTerminal in favor of teamSlug + userId; kept main's launchTarget/getSandbox/sandboxScoped props. - Merged the unit tests (action/createEnvdSandbox mocks + attach-retry suite).
…287 variant)
Alternative to the next-safe-action server action: terminal create/connect
now runs through a `sandbox.openTerminal` tRPC mutation (protectedTeamProcedure,
alongside killTerminalPty). The vanilla tRPC client is injected into
openTerminalSandbox from the component, the return type is inferred from the
router, and timeouts are signaled via a TRPCError('TIMEOUT') the client maps
back to a TimeoutError so attach-retry still works.
This branch exists to compare the two transports; only the terminal-open path
differs from the server-action branch (the filesystem inspector is unchanged).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves sandbox state management server-side so the user's account-level access token is no longer exposed to browser JS — previously the filesystem inspector and dashboard terminal embedded that token into client-side
Sandbox.connect/createcalls viasandboxManagementAuth.envdAccessTokenalready returned by thesandbox.detailsquery (new sharedcreateEnvdSandboxhelper — no control-plane call, no account token).sandbox.openTerminaltRPC mutation (protectedTeamProcedure, alongsidekillTerminalPty); the client receives only sandbox-scoped credentials. The vanilla tRPC client is injected intoopenTerminalSandbox, the return type is inferred from the router, and connect timeouts are surfaced asTRPCError('TIMEOUT')that the client maps back to aTimeoutErrorso the attach-retry logic still fires.sandbox-management-authmodules are deleted;origin/mainis merged in (integrating its terminal attach-retry refactor).Tests: 289 passing; typecheck/lint clean on changed files. Not yet verified live: the manual browser check (open a running sandbox's filesystem + terminal, confirm file-watch/PTY work, and confirm via DevTools that requests carry only
X-Access-Tokenwith no account token).