update: sandbox imports inside worker

src/typegate/src/runtimes/deno/hooks.ts → src/typegate/src/runtimes/deno/hooks/mod.ts

@@ -1,6 +1,9 @@
-import { getLogger } from "../../log.ts";
-import { PushFailure, PushHandler } from "../../typegate/hooks.ts";
-import { createArtifactMeta } from "../utils/deno.ts";
+// Copyright Metatype OÜ, licensed under the Mozilla Public License Version 2.0.
+// SPDX-License-Identifier: MPL-2.0
+
+import { getLogger } from "../../../log.ts";
+import { PushFailure, PushHandler } from "../../../typegate/hooks.ts";
+import { createArtifactMeta } from "../../utils/deno.ts";
 
 const logger = getLogger("typegate");
 
@@ -13,6 +16,28 @@ export class DenoFailure extends Error {
   }
 }
 
+function sandboxImport(modulePath: string) {
+  return new Promise<void>((resolve, reject) => {
+    const worker = new Worker(new URL("./worker.ts", import.meta.url).href, {
+      type: "module",
+    });
+
+    worker.postMessage({ import: modulePath });
+
+    worker.onmessage = ({ data }: MessageEvent<{ error?: any }>) => {
+      if (data.error) {
+        reject(data.error);
+      } else {
+        resolve();
+      }
+    };
+
+    worker.onerror = (error) => {
+      reject(error);
+    };
+  });
+}
+
 export const cacheModules: PushHandler = async (
   typegraph,
   _secretManager,
@@ -37,7 +62,8 @@ export const cacheModules: PushHandler = async (
 
       try {
         logger.info(`Caching deno imports for ${title} (${entryPoint.path})`);
-        await import(entryModulePath);
+
+        await sandboxImport(entryModulePath);
       } catch (error) {
         console.error(error.stack);
 

src/typegate/src/runtimes/deno/hooks/worker.ts

@@ -0,0 +1,13 @@
+// Copyright Metatype OÜ, licensed under the Mozilla Public License Version 2.0.
+// SPDX-License-Identifier: MPL-2.0
+
+self.onmessage = async ({ data }: MessageEvent<{ import: string }>) => {
+  try {
+    await import(data.import);
+    self.postMessage({ success: true });
+  } catch (error) {
+    self.postMessage({ error });
+  }
+
+  self.close();
+};

src/typegate/src/typegate/mod.ts

@@ -19,7 +19,7 @@ import { type PushHandler, PushResponse } from "../typegate/hooks.ts";
 import { upgradeTypegraph } from "../typegraph/versions.ts";
 import { parseGraphQLTypeGraph } from "../transports/graphql/typegraph.ts";
 import * as PrismaHooks from "../runtimes/prisma/hooks/mod.ts";
-import * as DenoHooks from "../runtimes/deno/hooks.ts";
+import * as DenoHooks from "../runtimes/deno/hooks/mod.ts";
 import {
   type RuntimeResolver,
   SecretManager,
@@ -32,7 +32,7 @@ import { resolveIdentifier } from "../services/middlewares.ts";
 import { handleGraphQL } from "../services/graphql_service.ts";
 import { getLogger } from "../log.ts";
 import { MigrationFailure } from "../runtimes/prisma/hooks/run_migrations.ts";
-import { DenoFailure } from "../runtimes/deno/hooks.ts";
+import { DenoFailure } from "../runtimes/deno/hooks/mod.ts";
 import introspectionJson from "../typegraphs/introspection.json" with { type: "json" };
 import { ArtifactService } from "../services/artifact_service.ts";
 import type { ArtifactStore } from "./artifacts/mod.ts";