Skip to content

DX-2596: feat: support qstash-js auto dev server#192

Open
ytkimirti wants to merge 14 commits into
mainfrom
DX-2596-auto-dev-server
Open

DX-2596: feat: support qstash-js auto dev server#192
ytkimirti wants to merge 14 commits into
mainfrom
DX-2596-auto-dev-server

Conversation

@ytkimirti
Copy link
Copy Markdown
Contributor

@ytkimirti ytkimirti commented May 4, 2026

Summary

Wires workflow's defaults into the QStash auto dev server feature (qstash-js#262). When QSTASH_DEV=true is set, serve() auto-builds a dev-mode Receiver so signature verification works against the dev binary's well-known dev signing keys with no real credentials.

  • getReceiver: in dev mode, construct new Receiver({ devMode: true }) instead of returning undefined. Without this, workflow silently skipped verification because the env-var key check failed.
  • DisabledWorkflowContext: pass devMode: false on the dummy Client so the auth dry-run never spawns the dev binary.

Backwards compatibility

No breaking changes. devMode references are confined to internal modules (getReceiver, DisabledWorkflowContext) and never leak into workflow's public .d.ts, so users on older @upstash/qstash see no type errors regardless of whether they pass their own Client. Runtime behavior is unchanged when QSTASH_DEV is unset — the new branch only fires under that env var.

Notes

Temporarily pinned to a @upstash/qstash CI snapshot until qstash-js#262 publishes a stable release.

ytkimirti added 2 commits May 4, 2026 16:49
When QSTASH_DEV is set, construct the default Receiver with devMode: true
so qstash-js fills the well-known dev signing keys. Without this, workflow
silently skips signature verification in dev mode because the env-var
check fails.

Also pass devMode: false on the dummy Client used by DisabledWorkflowContext
so the auth dry-run never spawns the dev binary.
Spawns the QStash dev binary on port 8383 and verifies a full round trip:
workflow's auto-built default Client publishes through the dev server with
no real credentials, and workflow's auto-built default Receiver successfully
verifies the resulting dev-server signature and rejects a tampered body.

Modeled after src/dev-server/index.test.ts in qstash-js#262.
@linear
Copy link
Copy Markdown

linear Bot commented May 4, 2026

@ytkimirti ytkimirti marked this pull request as draft May 4, 2026 22:13
ytkimirti and others added 2 commits May 5, 2026 01:17
Temporary pin until qstash-js#262 publishes a stable release with
the dev-server feature.
@CahidArda CahidArda marked this pull request as ready for review May 12, 2026 14:15
@CahidArda CahidArda force-pushed the DX-2596-auto-dev-server branch from 9d03a9c to 5c9ad58 Compare May 12, 2026 14:26
@CahidArda CahidArda force-pushed the DX-2596-auto-dev-server branch from 9e78f55 to 1b14b20 Compare May 13, 2026 07:48
@CahidArda CahidArda force-pushed the DX-2596-auto-dev-server branch from 1b14b20 to cda9036 Compare May 13, 2026 07:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants