feat(rpc): verify RPC callers with a per-binding service key (ADR-0030)

[wmadden-electric]

What

A Prisma Compute service is reachable at a public HTTPS URL, so an exposed /rpc/<method> endpoint answers anyone on the internet. This teaches RPC to answer only its wired peers: every RPC binding carries a distinct, framework-minted service key — the client sends it, serve() rejects a caller that doesn't present one (401). No authoring change; on by default once provisioned.

The decision and its rationale are in ADR-0030 (included here). In short: it's a per-binding capability token, not an ADR-0029 name-only secret — the framework mints the value and keeps it in the workspace deploy state, and it rides the binding's own COMPOSER_* env-var rail (like the URL), never process.env in user code.

This PR — slice 1 of 2: RPC-layer enforcement

Mostly packages/0-framework/2-authoring/rpc, plus one small target-serializer fix (below); fully unit-testable via the in-memory transport.

• serve() checks each request against an accepted-key set (COMPOSER_RPC_ACCEPTED_KEYS, a reserved var read address-free) before body parse / method lookup / dispatch. Unset/empty = pass-through (the migration state); a non-empty set requires Authorization: Bearer <key> and 401s anything else. Membership is a length-independent constant-time compare, and process is declared structurally so the module keeps its no-node/bun-coupling property.
• rpc() gains an optional serviceKey connection param alongside url; makeClient attaches Authorization: Bearer <key> when present.
• RPC_ACCEPTED_KEYS_ENV is exported so slice 2's target writes the exact var the reader reads (same writer/reader-share-a-key pattern as the secret channel).
• Target fix (descriptors/compute.ts): the optional serviceKey param surfaced a latent defect — the deploy serializer wrote an env var with an undefined value for any unprovisioned optional connection param, which PDP rejects (value: Required), failing the deploy of any app with an RPC binding. Now it skips an undefined-valued param, exactly as the runtime stash() already does. This is what makes slice 1 genuinely deploy-inert.

Inert until slice 2. With no accepted set configured, existing RPC round-trip behaviour is unchanged, so this is safe to merge on its own.

Branch was updated onto current main to pick up the COMPOSE_ → COMPOSER_ reserved-prefix rename that landed after it was cut.

Not in this PR — slice 2 (deploy provisioning)

Minting one key per RPC edge (an Alchemy ServiceKey resource, value stable in deploy state), the generic per-edge value channel in buildConfig, writing the consumer serviceKey / provider accepted-set env vars, and a live storefront-auth deploy proving the round trip with a wired-peer 200 and an anonymous-curl 401. Specced in .drive/projects/rpc-service-key/.

Tests

@internal/rpc unit + type tests green (bun test: 31 pass; bun run test:types: no errors; tsc --noEmit + biome clean). New cases: member key → dispatch, wrong/missing key → 401 with handler not run, 401-before-400 on bad input, empty set → pass-through, client attaches/omits the bearer header, serviceKey optional.

🤖 Generated with Claude Code

[wmadden]

Why is this a constant? I expected this to be unique to the node receiving it

[wmadden-electric]

Two levels, and it is per-node where it counts.

The variable slice 2 writes is per-node: it goes through the same configKey(address, …) scheme as every other config value, so COMPOSE_<address>_RPC_ACCEPTED_KEYS — unique per service in the shared project namespace.

This constant is only the address-free key serve() reads at runtime. compute()'s run() re-stashes each node's config under address-free keys precisely so the app entry — which no longer knows its address — can read it; that is exactly how load()/config() work today. Exactly one service runs per Compute instance, so the address-free key is unambiguous, and serve() is never handed the address to read the scoped var directly.

So: per-node at the deploy/project level (slice 2), address-free at the process level (here). Happy to rename the constant to signal "runtime-stashed" if that reads clearer.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@prisma/composer@89

npm i https://pkg.pr.new/@prisma/composer-prisma-cloud@89

commit: df486c0