Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/aligent/magento-async-events
A framework for reliably handling asynchronous events with Magento.
Async Events | Magento 2.3.x | >= Magento 2.4.0 <= Magento 2.4.3 | >= Magento 2.4.4 |
---|---|---|---|
2.x | :white_check_mark: | :white_check_mark: | :x: |
3.x | :x: | :x: | :white_check_mark: |
composer require aligent/async-events
Create a new async_events.xml
under a module's etc/
directory.
<?xml version="1.0"?>
<config
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="urn:magento:module:Aligent_AsyncEvents:etc/async_events.xsd"
>
<async_event name="sales.order.created">
<service class="Magento\Sales\Api\OrderRepositoryInterface" method="get"/>
</async_event>
</config>
curl --location --request POST 'https://m2.dev.aligent.consulting:44356/rest/V1/async_event' \
--header 'Authorization: Bearer TOKEN' \
--header 'Content-Type: application/json' \
--data-raw '{
"asyncEvent": {
"event_name": "sales.order.created",
"recipient_url": "https://example.com/order_created",
"verification_token": "fD03@NpYbXYg",
"metadata": "http"
}
}'
Requires the EventBridge Notifier
curl --location --request POST 'https://m2.dev.aligent.consulting:44356/rest/V1/async_event' \
--header 'Authorization: Bearer TOKEN' \
--header 'Content-Type: application/json' \
--data-raw '{
"asyncEvent": {
"event_name": "sales.order.created",
"recipient_url": "arn:aws:events:ap-southeast-2:005158166381:rule/Test.EventBridge.Rule",
"verification_token": "aIW0G9n3*9wN",
"metadata": "event_bridge"
}
}'
public function execute(Observer $observer): void
{
/** @var Order $object */
$object = $observer->getEvent()->getData('order');
// arguments are the inputs required by the service class in the asynchronous
// event definition in async_events.xml
// e.g: Magento\Sales\Api\OrderRepositoryInterface::get
$arguments = ['id' => $object->getId()];
$data = ['sales.order.created', $this->json->serialize($arguments)];
$this->publisher->publish(
QueueMetadataInterface::EVENT_QUEUE,
$data
);
}
Ensure the following consumers are running
bin/magento queue:consumer:start event.trigger.consumer
bin/magento queue:consumer:start event.retry.consumer
Refer to the Wiki
All events are logged at the individual subscription level with a UUID.
All information from the first delivery attempt to the latest attempt is presented as a trace table. The event payload is also available to view for investigation purposes.
Events are automatically retried with exponential back off. The default retry limit is 5. The maximum backoff is 60 seconds.
The exponential backoff is calculated as min(60, pow($deathCount, 2));
Attempt | Backoff |
---|---|
1 | 1 second |
2 | 4 seconds |
3 | 9 seconds |
4 | 16 seconds |
5 | 25 seconds |
To change the default retry limit visit Admin > Stores > Settings > Configuration > Advanced > System > Async Events and update Maximum Deaths
.
An event can be replayed independent of its status. This is useful to debug or replay an event when all retries are exhausted.
Replays start a new chain of delivery attempts and will respect the same retry mechanism if they fail again.
All events are indexed in Elasticsearch by default. This allows you to search through events including the event payload!
The module supports Lucene Query Syntax to query event data like attributes.
The following attributes are available across all asynchronous events.
log_id
uuid
event_name
success
created
The following attributes differ between asynchronous event types.
data
Assuming you have the following events configured
customer.created
customer.updated
customer.deleted
sales.order.created
sales.invoice.created
shipment.created
shipment.updated
shipment.deleted
You can query all customer events by using a wildcard like event_name: customer.*
which matches the following events
customer.created
customer.updated
customer.deleted
You can query all created events like *.created
which matches the following events
customer.created
sales.order.created
sales.invoice.created
shipment.created
You can further narrow down using the other available attributes such as status or uuid.
The following query returns all customer events which have failed. customer.* AND success: false
You can combine complex lucene queries to fetch event history and then export them via the admin grid as a csv if you wish.
Searching an event payload depends on what event you are searching on.
For the following example event payload, four properties are indexed as attributes. Therefore, you can query on
data.customer_email
, data.customer_firstname
, data.customer_lastname
and data.increment_id
.
Properties inside array at any level are not searchable.
{
"data": {
"customer_email": "roni_cost@example.com",
"customer_firstname": "Veronica",
"customer_lastname": "Costello",
"increment_id": "CK00000001",
"payment_additional_info": [
{
"key": "method_title",
"value": "Check / Money order"
}
]
}
}
Search all events where the customer email is roni_cost@example.com
data.data.customer_email: roni_cost@example.com
Search all events with the order increment id starting with CK
and status success
data.data.increment_id: CK* AND success: true
To turn off asynchronous event indexing visit Admin > Stores > Settings > Configuration > Advanced > System >
Async Events and disable Enable Asynchronous Events Indexing
.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.