mirror of https://github.com/nestriness/nestri.git synced 2026-09-19 17:25:19 +03:00

Files

Wanjohi 2c4e9d9b0b fix(auth): refuse to send a sign-in code rather than log one

The rule was "throw when the environment says production, otherwise log
the code and carry on". The deployment sets no such marker, so the
branch that ran was the developer one: every recipient and every usable
sign-in code printed to a retained log, the screen reporting success,
and nobody receiving anything.

That is what a fail-open default costs. The deployment that forgets its
mail settings is exactly the deployment with no marker saying it is a
real one, so it takes the lenient branch precisely when it should not.

Turned around: printing a live code is asked for by name and anything
else is an error, so absence of configuration is a refusal instead of an
assumption. Two settings out of three is also an error now, because it
means somebody is halfway through wiring a provider up and a quiet
fallback would hide the missing half.

Stages anyone else can reach are checked at deploy time, so a missing
setting stops the deploy with the name of the variable it wanted rather
than surfacing later as a person waiting for mail that never comes.

2026-09-05 09:27:49 +03:00

src

fix(auth): refuse to send a sign-in code rather than log one

2026-09-05 09:27:49 +03:00

test

fix(auth): refuse to send a sign-in code rather than log one

2026-09-05 09:27:49 +03:00

package.json

feat: Sync to OSS repo

2026-08-06 22:13:51 +03:00

README.md

chore: Update Readme

2026-08-06 22:32:33 +03:00

tsconfig.json

feat: Sync to OSS repo

2026-08-06 22:13:51 +03:00

README.md

apps/auth

The authentication worker for Nestri — a Cloudflare Worker built on @nestri/auth (OpenAuth-style issuer).

What it does

Hosts the OpenID Connect / OAuth issuer and the login UI:

Steam OAuth — the primary login flow. After Steam redirects back, the worker fetches the player's profile, creates (or finds) the User + LinkedAccount rows in Postgres, auto-creates a personal team on first login, and issues a JWT user subject containing { userID, linkedAccountID }.
SSH login — authenticates a device via its SSH fingerprint (keyed by SSH_AUTH_KEY), resolving the identity through Steam.resolveSshIdentity in @nestri/core.

Key details

Signing keys are generated at runtime and persisted in the AuthStorage KV namespace.
JWT subjects are defined in @nestri/core/auth/subjects.
The API worker calls this worker via a service binding (AUTH), verified through AUTH_ISSUER_URL.

Structure

src/index.ts      # Worker entrypoint: issuer config + success callbacks (steam, ssh)
test/             # Worker tests

Running

Deployed through Alchemy (apps/auth worker in alchemy.run.ts at the repo root) with bindings AuthStorage (KV), HYPERDRIVE (Postgres), STEAM_API_KEY, SSH_AUTH_KEY.