Add option to disable unauthed PUT requests

[amh4r]

Summary

Add an opt-out for unauthed PUT requests. This is via an env var or serve option.

Note that unauthed PUT requests are not a critical security issue. They merely tell the SDK to sync itself, but the SDK does not return sensitive info to the caller. Instead, the SDK sends an outgoing request to the Inngest API.

Checklist

• Added unit/integration tests
• Added changesets if applicable

---

Note

Adds an opt-out for unauthenticated PUT (sync) requests via a new enableUnauthedSync serve option and INNGEST_ENABLE_UNAUTHED_SYNC env var. When disabled in cloud mode, every PUT must carry a valid signature. Also refactors all 401 responses to share a single unauthorizedResponse constant and adds method to all signature-failure log entries.

^{Written by Mendral for commit ffabd56.}

[changeset-bot]

🦋 Changeset detected

Latest commit: cebcd6c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
inngest	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[mendral-app]

Needs attention — 1 issue in 1 file

The new unauthorizedResponse constant silently changes the in-band PUT signature-failure body from { code: "sig_verification_failed" } to { message: "Unauthorized" }. Any caller (Inngest backend, third-party integration) that pattern-matches on code will break. Everything else — parseAsBoolean handling, cloud-mode guard, as const safety — is correct.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.

<assessment>
The new `unauthorizedResponse` constant silently changes the in-band PUT signature-failure body from `{ code: "sig_verification_failed" }` to `{ message: "Unauthorized" }`. Any caller (Inngest backend, third-party integration) that pattern-matches on `code` will break. Everything else — `parseAsBoolean` handling, cloud-mode guard, `as const` safety — is correct.
</assessment>

<file name="packages/inngest/src/components/InngestCommHandler.ts">
<issue location="packages/inngest/src/components/InngestCommHandler.ts:2059">
The in-band PUT signature failure previously returned `{ code: "sig_verification_failed" }` but now returns `{ message: "Unauthorized" }` via the shared constant. Any caller that distinguishes this error by `code` will silently break.
</issue>
</file>

_{Tag @mendral-app with feedback or questions. View session}

[mendral-app]

LGTM

Previous comment about the in-band { code: "sig_verification_failed" } shape was addressed — the PR author confirmed the shape change is intentional (accepted). No new issues found. CI failures are pre-existing: middleware-validation: Test is a known Jest/ESM incompatibility (insight); Test examples (framework-nextjs-app-router) failed due to a transient npm ECONNRESET network error, not this PR.

_{Tag @mendral-app with feedback or questions. View session}