fix(worker): Disallow importing non-Workflow @temporalio packages (#722)

* fix(worker): Disallow importing non-Workflow @temporalio packages
* Move otel.ts to common

Author: lorensr

packages/common/package.json

@@ -14,6 +14,7 @@
   "dependencies": {
     "@temporalio/internal-workflow-common": "file:../internal-workflow-common",
     "@temporalio/proto": "file:../proto",
+    "@opentelemetry/api": "^1.0.3",
     "proto3-json-serializer": "^0.1.6"
   },
   "bugs": {

packages/internal-non-workflow-common/src/otel.ts renamed to packages/common/src/otel.ts

@@ -1,6 +1,6 @@
 import * as otel from '@opentelemetry/api';
-import { defaultPayloadConverter } from '@temporalio/common';
 import { Headers } from '@temporalio/internal-workflow-common';
+import { defaultPayloadConverter } from './converter/payload-converters';
 
 /** Default trace header for opentelemetry interceptors */
 export const TRACE_HEADER = '_tracer-data';

packages/interceptors-opentelemetry/src/client/index.ts

@@ -1,6 +1,6 @@
 import * as otel from '@opentelemetry/api';
 import { Next, WorkflowClientCallsInterceptor, WorkflowStartInput } from '@temporalio/client';
-import { headersWithContext, RUN_ID_ATTR_KEY } from '@temporalio/internal-non-workflow-common/lib/otel';
+import { headersWithContext, RUN_ID_ATTR_KEY } from '@temporalio/common/lib/otel';
 import { instrument } from '../instrumentation';
 import { SpanName, SPAN_DELIMITER } from '../workflow';
 

packages/interceptors-opentelemetry/src/worker/index.ts

@@ -2,7 +2,7 @@ import * as otel from '@opentelemetry/api';
 import { Resource } from '@opentelemetry/resources';
 import { ReadableSpan, SpanExporter } from '@opentelemetry/sdk-trace-base';
 import { Context as ActivityContext } from '@temporalio/activity';
-import { extractContextFromHeaders } from '@temporalio/internal-non-workflow-common/lib/otel';
+import { extractContextFromHeaders } from '@temporalio/common/lib/otel';
 import { ActivityExecuteInput, ActivityInboundCallsInterceptor, InjectedSink, Next } from '@temporalio/worker';
 import { instrument } from '../instrumentation';
 import { OpenTelemetryWorkflowExporter, SerializableSpan, SpanName, SPAN_DELIMITER } from '../workflow';

packages/interceptors-opentelemetry/src/workflow/index.ts

@@ -1,7 +1,7 @@
 import './runtime'; // Patch the Workflow isolate runtime for opentelemetry
 import * as otel from '@opentelemetry/api';
 import * as tracing from '@opentelemetry/sdk-trace-base';
-import { extractContextFromHeaders, headersWithContext } from '@temporalio/internal-non-workflow-common/lib/otel';
+import { extractContextFromHeaders, headersWithContext } from '@temporalio/common/lib/otel';
 import {
   ActivityInput,
   ContinueAsNew,

packages/worker/src/worker.ts

@@ -26,7 +26,7 @@ import {
   NUM_JOBS_ATTR_KEY,
   RUN_ID_ATTR_KEY,
   TASK_TOKEN_ATTR_KEY,
-} from '@temporalio/internal-non-workflow-common/lib/otel';
+} from '@temporalio/common/lib/otel';
 import {
   decompileRetryPolicy,
   optionalTsToDate,

packages/worker/src/workflow/bundler.ts

@@ -11,6 +11,17 @@ import { DefaultLogger, Logger } from '../logger';
 
 export const allowedBuiltinModules = ['assert'];
 export const disallowedBuiltinModules = builtinModules.filter((module) => !allowedBuiltinModules.includes(module));
+export const disallowedModules = [
+  ...disallowedBuiltinModules,
+  '@temporalio/activity',
+  '@temporalio/client',
+  '@temporalio/worker',
+  '@temporalio/internal-non-workflow-common',
+  '@temporalio/interceptors-opentelemetry/lib/client',
+  '@temporalio/interceptors-opentelemetry/lib/worker',
+  '@temporalio/testing',
+  '@temporalio/core-bridge',
+];
 
 export function moduleMatches(userModule: string, modules: string[]): boolean {
   return modules.some((module) => userModule === module || userModule.startsWith(`${module}/`));
@@ -162,7 +173,7 @@ export class WorkflowCodeBundler {
         ? data.request.slice('node:'.length)
         : data.request ?? '';
 
-      if (moduleMatches(module, disallowedBuiltinModules) && !moduleMatches(module, this.ignoreModules)) {
+      if (moduleMatches(module, disallowedModules) && !moduleMatches(module, this.ignoreModules)) {
         this.foundProblematicModules.add(module);
       }
 
@@ -176,7 +187,7 @@ export class WorkflowCodeBundler {
         extensions: ['.ts', '.js'],
         alias: {
           __temporal_custom_payload_converter$: this.payloadConverterPath ?? false,
-          ...Object.fromEntries([...this.ignoreModules, ...disallowedBuiltinModules].map((m) => [m, false])),
+          ...Object.fromEntries([...this.ignoreModules, ...disallowedModules].map((m) => [m, false])),
         },
       },
       externals: captureProblematicModules,