Security

Protect job inputs, outputs, controls, and provider credentials.

Control who can submit work, read its results, and request job operations.

Jobs are private unless their client policy sets public: true or provides authorize. Public means the selected operations are exposed; it does not disable input validation, admission, authorization, or output limits.

/** Registers the export task as a public job exposing trigger, get, list and watch with progress/output fields. */
import { defineJob } from "@relkit/app/jobs";
import exportOrders from "../tasks/export-orders.task.js";

const exportOrdersJob = defineJob({
  name: "exportOrders",
  id: "orders.export-orders",
  task: exportOrders,
  client: {
    public: true,
    operations: ["trigger", "get", "list", "watch"],
    fields: ["status", "progress", "output"],
  },
});

export default exportOrdersJob;

• Authorize the caller before triggering, reading, watching, cancelling, or retrying a run.
• Scope every lookup by tenant or account; opaque run IDs are not authorization.
• Validate persisted input again inside the task before side effects.
• Redact secrets and personal data from logs, progress, stream items, and error details.
• Keep provider tokens in secret configuration and expose only their names in deployment plans.
• Treat client fingerprints, task versions, and schema hashes as compatibility metadata, not credentials.

Use the Inspector only on a protected local or operator network. The local admin endpoint must not be exposed publicly without an authenticated proxy.