From f226d03863281665eeb45007cffc65201b58b724 Mon Sep 17 00:00:00 2001
From: Aaron Harper <aaron@inngest.com>
Date: Thu, 7 Nov 2024 15:48:48 -0500
Subject: [PATCH] Fix in-band sync URL

---
 .changeset/unlucky-actors-sparkle.md          |  5 ++++
 .../src/components/InngestCommHandler.ts      | 26 ++++++++++++++++---
 packages/inngest/src/types.ts                 |  4 +++
 3 files changed, 32 insertions(+), 3 deletions(-)
 create mode 100644 .changeset/unlucky-actors-sparkle.md

diff --git a/.changeset/unlucky-actors-sparkle.md b/.changeset/unlucky-actors-sparkle.md
new file mode 100644
index 00000000..21f92a51
--- /dev/null
+++ b/.changeset/unlucky-actors-sparkle.md
@@ -0,0 +1,5 @@
+---
+"inngest": patch
+---
+
+Fix in-band sync URL
diff --git a/packages/inngest/src/components/InngestCommHandler.ts b/packages/inngest/src/components/InngestCommHandler.ts
index 4d4c7aa5..0c530496 100644
--- a/packages/inngest/src/components/InngestCommHandler.ts
+++ b/packages/inngest/src/components/InngestCommHandler.ts
@@ -41,6 +41,7 @@ import { hashEventKey, hashSigningKey, stringify } from "../helpers/strings.js";
 import { type MaybePromise } from "../helpers/types.js";
 import {
   functionConfigSchema,
+  inBandSyncRequestBodySchema,
   logLevels,
   type AuthenticatedIntrospection,
   type EventPayload,
@@ -985,7 +986,7 @@ export class InngestCommHandler<
     headers: Promise<Record<string, string>>;
   }): Promise<ActionResponse> {
     try {
-      const url = await actions.url("starting to handle request");
+      let url = await actions.url("starting to handle request");
 
       if (method === "POST") {
         const validationResult = await signatureValidation;
@@ -1220,8 +1221,27 @@ export class InngestCommHandler<
             };
           }
 
+          const res = inBandSyncRequestBodySchema.safeParse(body);
+          if (!res.success) {
+            return {
+              status: 400,
+              body: stringify({
+                code: "invalid_request",
+                message: res.error.message,
+              }),
+              headers: {
+                "Content-Type": "application/json",
+              },
+              version: undefined,
+            };
+          }
+
+          // We can trust the URL here because it's coming from
+          // signature-verified request.
+          url = this.reqUrl(new URL(res.data.url));
+
           // This should be an in-band sync
-          const body = await this.inBandRegisterBody({
+          const respBody = await this.inBandRegisterBody({
             actions,
             deployId,
             signatureValidation,
@@ -1230,7 +1250,7 @@ export class InngestCommHandler<
 
           return {
             status: 200,
-            body: stringify(body),
+            body: stringify(respBody),
             headers: {
               "Content-Type": "application/json",
               [headerKeys.InngestSyncKind]: syncKind.InBand,
diff --git a/packages/inngest/src/types.ts b/packages/inngest/src/types.ts
index 719e95d3..bf2828ab 100644
--- a/packages/inngest/src/types.ts
+++ b/packages/inngest/src/types.ts
@@ -1397,3 +1397,7 @@ export const ok = <T>(data: T): Result<T, never> => {
 export const err = <E>(error?: E): Result<never, E> => {
   return { ok: false, error };
 };
+
+export const inBandSyncRequestBodySchema = z.strictObject({
+  url: z.string(),
+});