chore(rivetkit): auto-generate inspector token for engine driver

Author: NathanFlurry

rivetkit-typescript/packages/cloudflare-workers/src/actor-driver.ts

@@ -6,10 +6,10 @@ import type {
 } from "rivetkit";
 import { lookupInRegistry } from "rivetkit";
 import type { Client } from "rivetkit/client";
-import type {
-	ActorDriver,
-	AnyActorInstance,
-	ManagerDriver,
+import {
+	type ActorDriver,
+	type AnyActorInstance,
+	type ManagerDriver,
 } from "rivetkit/driver-helpers";
 import { promiseWithResolvers } from "rivetkit/utils";
 import { KEYS } from "./actor-handler-do";
@@ -239,6 +239,7 @@ export class CloudflareActorsActorDriver implements ActorDriver {
 		// Persist data key
 		return Uint8Array.from([1]);
 	}
+
 }
 
 export function createCloudflareActorsActorDriverBuilder(

rivetkit-typescript/packages/rivetkit/src/actor/instance/kv.ts

@@ -1,6 +1,7 @@
 export const KEYS = {
 	PERSIST_DATA: Uint8Array.from([1]),
 	CONN_PREFIX: Uint8Array.from([2]), // Prefix for connection keys
+	INSPECTOR_TOKEN: Uint8Array.from([3]), // Inspector token key
 };
 
 // Helper to create a connection key

rivetkit-typescript/packages/rivetkit/src/actor/instance/mod.ts

@@ -24,7 +24,7 @@ import { serializeActorKey } from "../keys";
 import { processMessage } from "../protocol/old";
 import { CachedSerializer } from "../protocol/serde";
 import { Schedule } from "../schedule";
-import { DeadlineError, deadline } from "../utils";
+import { DeadlineError, deadline, generateSecureToken } from "../utils";
 import { ConnectionManager } from "./connection-manager";
 import { EventManager } from "./event-manager";
 import { KEYS } from "./kv";
@@ -104,6 +104,7 @@ export class ActorInstance<S, CP, CS, V, I, DB extends AnyDatabaseProvider> {
 	#schedule!: Schedule;
 
 	// MARK: - Inspector
+	#inspectorToken?: string;
 	#inspector = new ActorInspector(() => {
 		return {
 			isDbEnabled: async () => {
@@ -218,6 +219,10 @@ export class ActorInstance<S, CP, CS, V, I, DB extends AnyDatabaseProvider> {
 		return this.#inspector;
 	}
 
+	get inspectorToken(): string | undefined {
+		return this.#inspectorToken;
+	}
+
 	get conns(): Map<ConnId, Conn<S, CP, CS, V, I, DB>> {
 		return this.#connectionManager.connections;
 	}
@@ -309,6 +314,9 @@ export class ActorInstance<S, CP, CS, V, I, DB extends AnyDatabaseProvider> {
 		// Read and initialize state
 		await this.#initializeState();
 
+		// Generate or load inspector token
+		await this.#initializeInspectorToken();
+
 		// Initialize variables
 		if (this.#varsEnabled) {
 			await this.#initializeVars();
@@ -831,6 +839,29 @@ export class ActorInstance<S, CP, CS, V, I, DB extends AnyDatabaseProvider> {
 		}
 	}
 
+	async #initializeInspectorToken() {
+		// Try to load existing token
+		const [tokenBuffer] = await this.#actorDriver.kvBatchGet(
+			this.#actorId,
+			[KEYS.INSPECTOR_TOKEN],
+		);
+
+		if (tokenBuffer !== null) {
+			// Token exists, decode it
+			const decoder = new TextDecoder();
+			this.#inspectorToken = decoder.decode(tokenBuffer);
+			this.#rLog.debug({ msg: "loaded existing inspector token" });
+		} else {
+			// Generate new token
+			this.#inspectorToken = generateSecureToken();
+			const tokenBytes = new TextEncoder().encode(this.#inspectorToken);
+			await this.#actorDriver.kvBatchPut(this.#actorId, [
+				[KEYS.INSPECTOR_TOKEN, tokenBytes],
+			]);
+			this.#rLog.debug({ msg: "generated new inspector token" });
+		}
+	}
+
 	async #initializeVars() {
 		let vars: V | undefined;
 		if ("createVars" in this.#config) {

rivetkit-typescript/packages/rivetkit/src/inspector/utils.ts

@@ -77,6 +77,7 @@ export function getInspectorUrl(runConfig: RunnerConfigInput | undefined) {
 
 export const isInspectorEnabled = (
 	runConfig: RunConfig,
+	// TODO(kacper): Remove context in favor of using the gateway, so only context is the actor
 	context: "actor" | "manager",
 ) => {
 	if (typeof runConfig.inspector?.enabled === "boolean") {

rivetkit-typescript/packages/rivetkit/src/manager/driver.ts

@@ -44,11 +44,13 @@ export interface ManagerDriver {
 		router: Hono,
 	) => void;
 
+	// TODO(kacper): Remove this in favor of standard manager API
 	/**
 	 * @internal
 	 */
 	readonly inspector?: ManagerInspector;
 
+	// TODO(kacper): Remove this in favor of ActorDriver.getinspectorToken
 	/**
 	 * Get or create the inspector access token.
 	 * @experimental

rivetkit-typescript/packages/rivetkit/src/manager/router.ts

@@ -218,6 +218,7 @@ function addManagerRoutes(
 	managerDriver: ManagerDriver,
 	router: OpenAPIHono,
 ) {
+	// TODO(kacper): Remove this in favor of standard manager API
 	// Inspector
 	if (isInspectorEnabled(runConfig, "manager")) {
 		if (!managerDriver.inspector) {