Skip to content

nexus security clarification - add limitation warning to Option 3 encryption pattern #4626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jsundai wants to merge 6 commits into
base: main
Choose a base branch
from
Open

nexus security clarification - add limitation warning to Option 3 encryption pattern #4626

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
dbbcf48
warn about wrapper type incompatibility with typed operations
jsundai May 28, 2026
26d9480
fix typed ops failure description, add error example
jsundai May 28, 2026
c9f8bf6
tighter language, match original issue wording
jsundai May 29, 2026
a70ba96
"<WrapperType>" to type "<ActualInputType>"
jsundai May 29, 2026
6c2f378
drop last line
jsundai Jun 2, 2026
6df98ba
Merge branch 'main' into nexus-security-warn-typed-ops-wrapper-incomp…
Duncanma Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions docs/encyclopedia/nexus/nexus-security.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,19 @@ See the [encryption sample](https://github.com/temporalio/samples-go/blob/main/e
Use wrapper types (for example, `EndpointValue`) so the Data Converter selects an Endpoint-specific encryption key.
This encrypts only Nexus traffic with a dedicated key, without sharing Namespace keys across teams.

:::warning Limited to string-based operation names

When calling `ExecuteOperation` with a non-string operation (for example, an operation definition or reference), the wrapper changes the input type and `ExecuteOperation` fails type-checking:

```
cannot assign argument of type "<WrapperType>" to type "<ActualInputType>"
```

This approach only works when the operation is passed as a string name.
For typed operations, pass the Nexus endpoint info through the workflow context instead of the wrapped input.

:::

See the [draft endpoint-based encryption sample](https://github.com/temporalio/samples-go/compare/main...bergundy:samples-go:nexus-encryption-by-endpoint).

### Choosing an approach
Expand Down