feat(canvas): enforce runtime capabilities and build controls

Generated-By: PostHog Code
Task-Id: 6d725c2e-4a6c-47b9-a41f-31b975c3a0b0

Author: k11kirky

packages/core/src/canvas/canvasBuildSchemas.test.ts

@@ -18,6 +18,7 @@ function build(
     sourceVersionId: `sv-${id}`,
     buildStatus,
     diagnostics: [],
+    manifest: null,
     artifactUrl:
       buildStatus === "ready" ? "https://usercontent.example/index.html" : null,
     pinned: false,

packages/core/src/canvas/canvasBuildSchemas.ts

@@ -1,4 +1,5 @@
 import {
+  canvasArtifactManifestSchema,
   canvasBuildStatusSchema,
   canvasDiagnosticSchema,
 } from "@posthog/shared";
@@ -12,13 +13,23 @@ export const canvasBuildRecordSchema = z.object({
   sourceVersionId: z.string(),
   buildStatus: canvasBuildStatusSchema,
   diagnostics: z.array(canvasDiagnosticSchema),
+  manifest: canvasArtifactManifestSchema.nullable().default(null),
   artifactUrl: z.string().url().nullable(),
   pinned: z.boolean(),
   createdAt: z.string(),
   finishedAt: z.string().nullable(),
 });
 export type CanvasBuildRecord = z.infer<typeof canvasBuildRecordSchema>;
 
+export const canvasBuildActionInputSchema = z.object({
+  id: z.string(),
+  buildId: z.string(),
+  action: z.enum(["retry", "pin", "unpin", "cancel"]),
+});
+export type CanvasBuildActionInput = z.infer<
+  typeof canvasBuildActionInputSchema
+>;
+
 export function publishedCanvasBuild(
   lifecycle: CanvasBuildLifecycle,
 ): CanvasBuildRecord | null {

packages/core/src/canvas/canvasDataService.test.ts

@@ -103,4 +103,14 @@ describe("CanvasDataService.loadInsight", () => {
       makeService().loadInsight({ shortId: "nope" }),
     ).rejects.toThrow('Insight "nope" not found');
   });
+
+  it("rejects oversized insight results", async () => {
+    fetchInsightByShortId.mockResolvedValue(
+      insight({ results: Array.from({ length: 1_001 }, () => [1]) }),
+    );
+
+    await expect(
+      makeService().loadInsight({ shortId: "too-large" }),
+    ).rejects.toThrow("result limit");
+  });
 });

packages/core/src/canvas/canvasDataService.ts

@@ -23,6 +23,18 @@ import {
 // Last-resort attribution if we can't resolve the signed-in user (and the
 // canvas didn't pass its own distinctId).
 const FALLBACK_DISTINCT_ID = "freeform-canvas";
+const MAX_CANVAS_RESULT_ROWS = 1_000;
+const MAX_CANVAS_RESULT_BYTES = 2 * 1024 * 1024;
+
+function boundedResult(result: CanvasDataResult): CanvasDataResult {
+  if (
+    result.results.length > MAX_CANVAS_RESULT_ROWS ||
+    JSON.stringify(result).length > MAX_CANVAS_RESULT_BYTES
+  ) {
+    throw new Error("Canvas data result exceeds the result limit");
+  }
+  return result;
+}
 
 /**
  * The host-side data avenue behind a freeform canvas's `ph.query` shim.
@@ -70,15 +82,15 @@ export class CanvasDataService {
       const { columns, results } = await runQuery(this.authService, node, {
         refresh: "blocking",
       });
-      return {
+      return boundedResult({
         columns,
         // HogQL returns rows; normalise a bare scalar row to a 1-cell array.
         // Typed nodes return SERIES OBJECTS — pass them through untouched (wrapping
         // them in arrays is what made every value read as 0).
         results: isTyped
           ? results
           : results.map((r) => (Array.isArray(r) ? r : [r])),
-      };
+      });
     } catch (err) {
       this.log.warn("Canvas query failed", {
         error: err instanceof Error ? err.message : String(err),
@@ -102,12 +114,12 @@ export class CanvasDataService {
       // OBJECTS, which must pass through untouched (wrapping them reads every value
       // as 0).
       const isRows = insight.queryKind === "HogQLQuery";
-      return {
+      return boundedResult({
         columns: insight.columns,
         results: isRows
           ? insight.results.map((r) => (Array.isArray(r) ? r : [r]))
           : insight.results,
-      };
+      });
     } catch (err) {
       this.log.warn("Canvas loadInsight failed", {
         shortId: input.shortId,

packages/core/src/canvas/dashboardsService.ts

@@ -2,8 +2,11 @@ import type { AuthService } from "@posthog/core/auth/auth";
 import { AUTH_SERVICE } from "@posthog/core/auth/auth.module";
 import { inject, injectable } from "inversify";
 import {
+  type CanvasBuildActionInput,
   type CanvasBuildLifecycle,
+  type CanvasBuildRecord,
   canvasBuildLifecycleSchema,
+  canvasBuildRecordSchema,
 } from "./canvasBuildSchemas";
 import type {
   DashboardFileMeta,
@@ -357,6 +360,7 @@ export class DashboardsService {
         source_version_id: string;
         build_status: string;
         diagnostics?: unknown[];
+        manifest: unknown | null;
         artifact_url: string | null;
         pinned: boolean;
         created_at: string;
@@ -371,6 +375,7 @@ export class DashboardsService {
         sourceVersionId: build.source_version_id,
         buildStatus: build.build_status,
         diagnostics: build.diagnostics ?? [],
+        manifest: build.manifest ?? null,
         artifactUrl: build.artifact_url,
         pinned: build.pinned,
         createdAt: build.created_at,
@@ -379,6 +384,34 @@ export class DashboardsService {
     });
   }
 
+  async actOnBuild(input: CanvasBuildActionInput): Promise<CanvasBuildRecord> {
+    const res = await this.fs.fetch(
+      `${encodeURIComponent(input.id)}/canvas/builds/action/`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          action: input.action,
+          build_id: input.buildId,
+        }),
+      },
+    );
+    if (!res.ok)
+      throw new Error(`Failed to update canvas build (${res.status})`);
+    const build = (await res.json()) as Record<string, unknown>;
+    return canvasBuildRecordSchema.parse({
+      id: build.id,
+      sourceVersionId: build.source_version_id,
+      buildStatus: build.build_status,
+      diagnostics: build.diagnostics ?? [],
+      manifest: build.manifest ?? null,
+      artifactUrl: build.artifact_url,
+      pinned: build.pinned,
+      createdAt: build.created_at,
+      finishedAt: build.finished_at,
+    });
+  }
+
   async delete(id: string): Promise<void> {
     const res = await this.fs.fetch(`${encodeURIComponent(id)}/`, {
       method: "DELETE",

packages/core/src/canvas/freeformSchemas.ts

@@ -63,11 +63,11 @@ export const canvasDataQueryInput = z
   .object({
     // A typed query node passed straight to the query runner. Opaque here (the
     // node schemas are large + product-owned); validated by the API on execution.
-    query: z.record(z.string(), z.unknown()).optional(),
+    query: z.record(z.string().max(256), z.unknown()).optional(),
     // Inline HogQL string (the escape hatch). Server wraps it as a HogQLQuery.
-    hogql: z.string().min(1).optional(),
+    hogql: z.string().min(1).max(20_000).optional(),
     // Reserved for bound parameters (Phase 3 named queries). Edit mode ignores it.
-    params: z.record(z.string(), z.unknown()).optional(),
+    params: z.record(z.string().max(128), z.unknown()).optional(),
   })
   .refine((v) => v.query != null || v.hogql != null, {
     message: "ph.query requires a query node or a HogQL string",
@@ -99,7 +99,7 @@ export type CanvasDataResult = z.infer<typeof canvasDataResultSchema>;
 // shape as `ph.query`.
 // ---------------------------------------------------------------------------
 export const canvasLoadInsightInput = z.object({
-  shortId: z.string().min(1),
+  shortId: z.string().min(1).max(128),
   dateRange: z
     .object({ date_from: z.string().nullish(), date_to: z.string().nullish() })
     .optional(),
@@ -111,8 +111,8 @@ export type CanvasLoadInsightInput = z.infer<typeof canvasLoadInsightInput>;
 // the private read token still never enters the iframe. `distinctId` is who the
 // event is attributed to; defaults host-side when omitted.
 export const canvasCaptureInput = z.object({
-  event: z.string().min(1),
-  distinctId: z.string().min(1).optional(),
+  event: z.string().min(1).max(200),
+  distinctId: z.string().min(1).max(200).optional(),
   properties: z.record(z.string(), z.unknown()).optional(),
 });
 export type CanvasCaptureInput = z.infer<typeof canvasCaptureInput>;
@@ -228,8 +228,8 @@ export const canvasToHostMessageSchema = z.discriminatedUnion("type", [
   z.object({
     channel: z.literal(CANVAS_CHANNEL),
     type: z.literal("data-request"),
-    id: z.string(),
-    method: z.string(),
+    id: z.string().min(1).max(128),
+    method: z.enum(["query", "loadInsight", "capture", "run"]),
     payload: z.unknown(),
   }),
   // A runtime/compile error from inside the iframe, surfaced so the host can
@@ -238,8 +238,8 @@ export const canvasToHostMessageSchema = z.discriminatedUnion("type", [
   z.object({
     channel: z.literal(CANVAS_CHANNEL),
     type: z.literal("error"),
-    message: z.string(),
-    stack: z.string().optional(),
+    message: z.string().max(10_000),
+    stack: z.string().max(50_000).optional(),
   }),
   // The canvas rendered successfully (clears any prior error state).
   z.object({

packages/core/src/canvas/services.ts

@@ -1,4 +1,8 @@
-import type { CanvasBuildLifecycle } from "./canvasBuildSchemas";
+import type {
+  CanvasBuildActionInput,
+  CanvasBuildLifecycle,
+  CanvasBuildRecord,
+} from "./canvasBuildSchemas";
 import type { ChannelTaskRecord } from "./channelTaskSchemas";
 import type { DashboardRecord, DashboardSummary } from "./dashboardSchemas";
 import type {
@@ -48,6 +52,7 @@ export interface IDashboardsService {
   setPinned(input: { id: string; pinned: boolean }): Promise<DashboardRecord>;
   // Read a canvas's build lifecycle (pointers + recent builds).
   getBuilds(id: string): Promise<CanvasBuildLifecycle>;
+  actOnBuild(input: CanvasBuildActionInput): Promise<CanvasBuildRecord>;
   rename(input: { id: string; name: string }): Promise<DashboardRecord>;
   // Idempotently create + seed a channel's home canvas, returning it.
   ensureHomeCanvas(channelId: string): Promise<DashboardRecord>;

packages/host-router/src/routers/dashboards.router.ts

@@ -1,4 +1,8 @@
-import { canvasBuildLifecycleSchema } from "@posthog/core/canvas/canvasBuildSchemas";
+import {
+  canvasBuildActionInputSchema,
+  canvasBuildLifecycleSchema,
+  canvasBuildRecordSchema,
+} from "@posthog/core/canvas/canvasBuildSchemas";
 import {
   createDashboardInput,
   dashboardIdInput,
@@ -39,6 +43,14 @@ export const dashboardsRouter = router({
         .get<IDashboardsService>(DASHBOARDS_SERVICE)
         .getBuilds(input.id),
     ),
+  actOnBuild: publicProcedure
+    .input(canvasBuildActionInputSchema)
+    .output(canvasBuildRecordSchema)
+    .mutation(({ ctx, input }) =>
+      ctx.container
+        .get<IDashboardsService>(DASHBOARDS_SERVICE)
+        .actOnBuild(input),
+    ),
   create: publicProcedure
     .input(createDashboardInput)
     .output(dashboardRecordSchema)

packages/shared/src/canvas-build-contract.ts

@@ -203,5 +203,9 @@ export function createCanvasStarterProject(): CanvasSourceProject {
       ]),
     ),
     canvasSdkVersion: "0.1.0",
+    capabilities: {
+      posthog: { insights: [], inlineQueries: false, captureEvents: [] },
+      network: { origins: [] },
+    },
   };
 }

packages/shared/src/canvas-build-fixtures.ts

@@ -33,6 +33,10 @@ function project(
     entryHtml: CANVAS_ENTRY_HTML,
     dependencies,
     canvasSdkVersion: "0.1.0",
+    capabilities: {
+      posthog: { insights: [], inlineQueries: false, captureEvents: [] },
+      network: { origins: [] },
+    },
   };
 }