cloudflare / cloudflare/workers-sdk

Miniflare local explorer should scope Durable Object and Workflow peers by storageScope

Closed
#15,479 1 comment 0 reactions 0 assignees View on GitHub
feature:local-explorer package:miniflare
Dominant language
TypeScript
Stars
4.5k
Forks
1.5k
Avg merge
3d 8h
Merged PRs (30d)
186

Description

### Problem

When Miniflare Shared Storage is enabled, instances using the same dev registry advertise a `storageScope` derived from `resourcePersistencePath`. KV, D1, and R2 local-explorer aggregation restricts peers to the matching scope via `sharedStorageOnly`.

The Durable Object and Workflow explorer routes instead call `getPeerUrlsIfAggregating(c)` without that restriction. They can therefore discover every active Miniflare peer in the global registry, including peers belonging to projects with different persistence roots. Detail and mutation forwarding use the same unscoped peer set.

### Impact

With project A and project B running against different persistence roots but the same registry, a local-explorer request from B may list or read Durable Objects and Workflows from A, or forward lifecycle mutations to A. This is cross-project access to local development state.

### Expected behavior

Durable Object and Workflow peer discovery and owner lookup should include only registry entries whose `storageScope` matches the requesting instance, consistent with KV, D1, and R2.

### Suggested coverage

Add integration coverage with two Miniflare instances that share a dev registry but use different `resourcePersistencePath` values. Verify that DO and Workflow list, detail, and mutation routes cannot observe or target the other scope. Also retain coverage showing that peers with the same scope aggregate normally.

Found while integrating Shared Storage into cloudflare/cf#144. Related implementation: #15169.

Contributor guide

Open the contributing guide

Research direction

Start with the Durable Object and Workflow local-explorer routes and their getPeerUrlsIfAggregating(c) calls; compare them with the KV, D1, and R2 paths that use sharedStorageOnly. Add integration coverage using two Miniflare instances with different resourcePersistencePath values, verifying list, detail, and mutation isolation while retaining same-scope aggregation coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
devtools, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.