Develop - #201
Merged
Merged
Conversation
Introduce @ai-di/temporal-payload-codec so workers and clients compress workflow payloads consistently while preserving inner encoding metadata.
Add @ai-di/graph-workflow-config for computeConfigHash and applyWorkflowConfigOverrides, wired from temporal and backend-services.
Store large OCR JSON in blob storage and pass OcrPayloadRef through activities; add jest setup for activity logger mocks.
Read and write OCR payloads via OcrPayloadRef in poll, extract, enrich, cleanup, confidence, mistral, and post-OCR correction activities.
graphWorkflow resolves config via activity by versionId and configHash; wire gzip payload codec on worker; slim child workflow args and results.
Benchmark sample workflows pass workflowVersionId, configHash, and groupId; materialize dataset returns groupId for synthetic documents.
Temporal client starts graphWorkflow with workflowVersionId, merged configHash, and overrides; benchmark and ground-truth paths aligned.
CLI migrates workflow configs to ocrResponseRef/ocrResultRef keys; seed and template JSON updated for ref-based ctx ports.
Align workflow integration test scripts and starter with versioned graphWorkflow input (workflowVersionId and configHash).
Reject unsafe dot-path segments to prevent prototype pollution when applying workflow config overrides. Add a UNSAFE_PATH_SEGMENTS check and assertSafePathSegments in packages/graph-workflow-config, call it from setNestedValue, and tighten property checks using Object.prototype.hasOwnProperty.call. Add unit tests in apps/backend-services to ensure __proto__ and constructor segments are rejected. Update docs to document the security behavior and note that benchmark APIs further whitelist overrides against exposedParams.
Harden applyWorkflowConfigOverrides against prototype pollution and invalid path segments. Replace JSON.parse-based cloning with deepCloneToNullPrototype to produce null-prototype objects, so nested assignments cannot reach Object.prototype. Add SAFE_PATH_SEGMENT regex and isSafeOverridePathSegment to validate dot-path segments (reject blocklisted names, empty segments, and non-identifier segments), and update assertSafePathSegments to use it. Make setNestedValue create null-prototype objects for intermediate nodes. Update tests to use Object.hasOwn and add a test rejecting non-identifier segments; update docs to reflect the stricter rules.
Introduce DB_POOL_MAX support and sane defaults for Prisma/pg connection pools. Adds getPrismaPoolMax utility (default backend=20, temporal=3), uses it in backend PrismaService and temporal worker client, and surfaces the pool size in startup logs. Update env samples, kustomize configmap, OpenShift overlay templates, and deployment scripts to include DB_POOL_MAX (dev=20, prod example=10). Update docs (HA and env config) to explain sizing and impact on Postgres max_connections, and add unit tests for getPrismaPoolMax.
Read k6 env vars LOAD_TEST_VUS and LOAD_TEST_DURATION in read-benchmark-datasets.js and switch options to use vus/duration when provided, otherwise keep the staged ramp fallback. Add -e LOAD_TEST_VUS and -e LOAD_TEST_DURATION to the k6:datasets npm script so Docker runs receive the vars. Change seeded document statuses: seed-hitl-fixtures uses awaiting_review instead of completed_ocr, and seed-large-dataset uses extracted instead of completed_ocr to match expected test states.
Reduce the default per-pod Postgres connection pool size from 20 to 10 across the codebase and docs to keep total connections under Postgres' default max_connections at HPA max scale. Updated constants and helpers (backend & temporal utils), env samples and OpenShift config/examples, HPA comments and HA docs, the deploy script default, and a unit test expectation. Also adjusted minor import formatting and Prisma comment to reflect the new default. Single-replica load-test behavior can still override DB_POOL_MAX=20 in instance envs if needed.
Document global rate limiting and how to raise THROTTLE_GLOBAL_LIMIT for sustained/multi-VU load tests; add guidance to docs-md/LOAD_TESTING.md, LOAD_TEST_STRESS_RUN_SHEET.md, and tools/load-testing/README.md. Update k6 read-benchmark-datasets.js to accept LOAD_TEST_VUS, LOAD_TEST_SLEEP_SECONDS and switch to vus/duration options (default 1 VU × 60s, 1s sleep) so scripts stay under the backend throttler by default. Add matching OpenShift job env defaults for VUS, DURATION and SLEEP. Minor non-functional reorder of the mupdf dependency in apps/backend-services/package.json.
Add explicit 100MB per-file limit to classifier upload endpoint and handle multer rejections. FilesInterceptor on the classifier upload route now sets limits.fileSize = 100MB and registers a MulterExceptionFilter that maps LIMIT_FILE_SIZE to HTTP 413 (and other Multer errors to 400). Also add a controller-side safeguard that throws PayloadTooLargeException for oversized files, unit tests for the filter and controller behavior, and documentation (CLASSIFIER_DOCUMENT_UPLOAD.md) plus an update to the load-test notes marking the issue fixed.
AI-1392 Security and Vulnerability Round Up - June 2026
Treat failed Azure OCR responses as non-retryable Temporal failures. Add ApplicationFailure import and a throwFailedOcrResponse helper that builds an ApplicationFailure with a descriptive message (including error code/message) and includes the OCR response in details. Replace previous 'failed' return branches with this helper and update tests to expect ApplicationFailure with nonRetryable=true and the response details.
PLG Deployment - Missing permission to create Prometheus service account
Additional Deployment Changes
…they're included in build
alex-struk
requested review from
NoorChasib,
antsand,
dbarkowsky and
kmandryk
as code owners
June 23, 2026 17:16
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Address Missing Packages in Build
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AI-###
Changes
Testing
Checklist
By submitting this pull request, I acknowledge that I have attempted to meet the following: