lael-labs/executor

.changeset/apikey-validate-cache.md+1−1

@@ -6,4 +6,4 @@ · 5 unmodified lines
6		6
7	Every MCP request and every API-key-authenticated `/api/*` request used to pay a live WorkOS round trip (~100-150ms) to validate the presented key, on every single request. The JWT bearer path beside it already verified locally against a JWKS cached for an hour; API keys had no cache at all.	7	Every MCP request and every API-key-authenticated `/api/*` request used to pay a live WorkOS round trip (~100-150ms) to validate the presented key, on every single request. The JWT bearer path beside it already verified locally against a JWKS cached for an hour; API keys had no cache at all.
8		8
9	Successful validations are now cached in a bounded per-isolate map for 60 seconds, keyed by the SHA-256 digest of the key value (never the raw credential). Invalid keys and upstream failures are never cached, so probing bad keys cannot pollute the map and a freshly created key works immediately. The tradeoff: a revoked key remains usable for up to 60 seconds within an isolate that validated it before revocation — far tighter than the one-hour rotation window the JWT path already accepts.	9	Successful validations are now cached in a bounded per-isolate map for 60 seconds, keyed by the SHA-256 digest of the key value (never the raw credential). The MCP handler used to rebuild its whole auth layer (and with it the cache) on every request; it now builds the layer once per isolate, so the cache holds on both the `/api/*` and `/mcp` planes. Invalid keys and upstream failures are never cached, so probing bad keys cannot pollute the map and a freshly created key works immediately. The tradeoff: a revoked key remains usable for up to 60 seconds within an isolate that validated it before revocation — far tighter than the one-hour rotation window the JWT path already accepts.

apps/cloud/src/mcp/agent-handler.ts+28−4

 import * as OtelTracer from "@effect/opentelemetry/Tracer";
-import { Effect, Predicate } from "effect";
+import { Effect, ManagedRuntime, Predicate } from "effect";
 import {
   McpAuthProvider,
     const auth = yield* McpAuthProvider;
     const outcome = yield* auth.authenticate(request);
     return { auth, outcome };
-  }).pipe(Effect.provide(cloudMcpAuth));
+  });
+// ONE auth layer per isolate. `authenticate` used to end in
+// `Effect.provide(cloudMcpAuth)`, which rebuilt the entire auth stack — the
+// WorkOS client, `ApiKeyService` and with it the api-key validation success
+// cache — on every MCP request, so that cache never survived a request on this
+// plane (the /api/* plane resolves the same service from the app's `boot`
+// layer, built once per isolate). A lazily created ManagedRuntime (the
+// auth/doc-gate.ts pattern) builds `cloudMcpAuth` on the first request and
+// memoizes it for the isolate's lifetime; `runTraced` runs every program on it.
+// Nothing inside the layer is request-scoped: the WorkOS client holds no
+// sockets (just config), the JWKS cache is already module-scope, and
+// `McpOrganizationAuthLive` builds its postgres socket FRESH inside every
+// `authorize` call precisely so the service itself can outlive a request
+// (Cloudflare Workers' I/O isolation — see makeMcpOrganizationAuthServices).
+let mcpAuthRuntime: ManagedRuntime.ManagedRuntime<McpAuthProvider, never> | undefined;
+const getMcpAuthRuntime = () => (mcpAuthRuntime ??= ManagedRuntime.make(cloudMcpAuth));
 // The pre-Agents envelope ran the MCP auth path inside the Effect app, whose
 // HttpMiddleware provided the OTEL tracer — that is where the `mcp.request`
 // forwarded request's traceparent — which also makes `currentPropagationHeaders`
 // (via Effect.currentParentSpan) ferry that same trace into the session DO
 // instead of letting the DO start a fresh root per request.
-const runTraced = <A>(request: Request, program: Effect.Effect<A>): Promise<A> => {
+//
+// Runs on the memoized auth runtime above (rather than a bare
+// `Effect.runPromise`) so `authenticate` resolves the once-built
+// `McpAuthProvider` from it; the telemetry layer is still provided per run, so
+// spans keep exporting exactly as before.
+const runTraced = <A>(
+  request: Request,
+  program: Effect.Effect<A, never, McpAuthProvider>,
+): Promise<A> => {
   const parsed = parseTraceparent(
     request.headers.get("traceparent"),
     request.headers.get("tracestate"),
   );
-  return Effect.runPromise(
+  return getMcpAuthRuntime().runPromise(
     (parsed ? OtelTracer.withSpanContext(program, parsed) : program).pipe(
       Effect.provide(WorkerTelemetryLive),
     ),

e2e/cloud/api-key-validation-cache.test.ts+8−16

 // Two scenarios because the two bearer surfaces wire the cache differently:
 //
 //  - /api/* resolves `ApiKeyService` from the app's boot layer, built once
-//    per isolate — the cache holds. Green.
+//    per isolate.
-//  - /mcp is served outside the app envelope by the agent handler, whose
+//  - /mcp is served outside the app envelope by the agent handler, which
-//    `authenticate` provides the auth layer PER REQUEST
+//    builds `cloudMcpAuth` once per isolate on a memoized ManagedRuntime
-//    (`Effect.provide(cloudMcpAuth)` in apps/cloud/src/mcp/agent-handler.ts).
+//    (apps/cloud/src/mcp/agent-handler.ts). It used to provide that layer
-//    Each request builds a fresh `ApiKeyService` — a fresh cache map — so
+//    per request — a fresh `ApiKeyService`, a fresh cache map, a WorkOS
-//    every MCP request still pays the WorkOS round trip the cache exists to
+//    round trip on every MCP request — so this scenario pins the shared
-//    remove. That scenario is registered as an expected failure until the
+//    wiring, not just the cache.
-//    MCP wiring shares one built auth layer per isolate; the assertions
-//    state the real contract, and the flag must be removed when it lands.
 //
 // Attribution: the emulator redacts secret-named fields (the response's
 // `api_key` object), but the request body's `value` survives, and every key
 scenario(
   "MCP · back-to-back API-key requests validate the key with WorkOS once, and each key validates independently",
-  {
+  {},
-    expectedFailure:
-      "the MCP agent handler provides its auth layer per request (Effect.provide(cloudMcpAuth) " +
-      "in apps/cloud/src/mcp/agent-handler.ts), so every MCP request builds a fresh " +
-      "ApiKeyService and a fresh validation cache — each request still pays a WorkOS round " +
-      "trip. Remove this flag when the MCP path shares one built auth layer per isolate.",
-  },
   Effect.scoped(
     Effect.gen(function* () {
       const { target, keyA, keyB, readValidations } = yield* mintTwoKeys;