ACTIAS

Globals

json, uuid, log, getfile, crypto, Jwt and script.

json

json.stringify(value)   -- string
json.parse(text)        -- value; raises on bad input

Wrap parse with pcall when the input is untrusted.

uuid

uuid.v4()   -- "3f2b…"

In workflow run code, generated ids are journaled so replay reproduces them.

log

log.debug(value, ...)
log.info(value, ...)
log.warn(value, ...)
log.error(value, ...)

Several arguments are joined with spaces; a table is rendered as JSON. Lines appear in the console's live log for the script, and in actias dev sessions.

require and dofile

local helpers = require("lib/helpers")   -- a module in the bundle
dofile("setup.lua")                      -- run a bundled file for its effects

Both resolve against the published bundle, never the filesystem.

getfile

local page = getfile("web/index.html")

Reads a file from the published bundle and returns its bytes, or nil when the path is not in the bundle. Return it as a response body directly:

return {
    status_code = 200,
    headers = { ["content-type"] = "text/html" },
    body = getfile("web/index.html"),
}

Include the files in script.json's includes so they ship.

crypto

crypto.sha256(data)      -- also sha224, sha384, sha512, sha512_224, sha512_256

local argon = crypto.Argon2.new("Argon2id")
local hash = argon:hash(password)
argon:verify(hash, password)   -- boolean

local key = crypto.RsaPrivateKey.new(2048)
key:to_pem()                         -- also to_pem("PKCS1") or ("PKCS8")
crypto.RsaPrivateKey.from_pem(pem)
local sealed = key:public_key():encrypt({ 104, 105 })   -- a byte array
key:decrypt(sealed)

Jwt

local signing = secret "jwt-signing-key"      -- top level

on "fetch" (function(request)
    local signer = Jwt.new("HS256", signing)
    local token = signer:encode({ sub = "ada", exp = os.time() + 3600 })
    local claims = signer:decode(token)       -- nil when invalid or expired
    return { body = token }
end)

Algorithms: HS256, HS384, HS512. The key is a shared secret, so the public-key families are refused. decode requires an exp claim and checks it; a token without one decodes to nil.

script

script.identifier   -- the script's public identifier
script.project_id   -- the project it belongs to

Gotchas

  • crypto and Jwt are absent from a workflow environment, step bodies included. Call an object from a step when a run needs them.
  • json.parse raises on bad input. Wrap it in pcall whenever the text came from outside.
  • getfile returns nil for a path that is not in the bundle. Add the file to script.json's includes or it does not ship.

Related

  • secret: what Jwt.new usually signs with.
  • http: returning getfile output as a response body.