mirror of https://github.com/nestriness/nestri.git synced 2026-09-19 17:25:19 +03:00

Files

Wanjohi 96b0cf8111 feat(auth): sign in with an email address

Wires the pin-code provider, which existed and was never reachable, and makes
it the only branch that can create an account. Steam now resolves an existing
connection instead of minting a user from a persona, and refuses when there is
no account behind it — which is an answer the interface renders rather than an
implicit signup.

Delivery is a small provider-neutral POST rather than a vendor SDK: configure
an endpoint, a key and a from address. With none of them set it logs the code
outside production so a local sign-in works, and throws in production, because
a screen that says "check your email" when nothing was sent leaves someone
waiting instead of telling anybody.

A person who has only ever signed in by email has no connected account, and
the token says so with an empty value — the same one a server-to-server caller
has always carried.

2026-09-05 00:02:16 +03:00

src

feat(auth): sign in with an email address

2026-09-05 00:02:16 +03:00

test

feat(auth): sign in with an email address

2026-09-05 00:02:16 +03:00

package.json

feat: Sync to OSS repo

2026-08-06 22:13:51 +03:00

README.md

chore: Update Readme

2026-08-06 22:32:33 +03:00

tsconfig.json

feat: Sync to OSS repo

2026-08-06 22:13:51 +03:00

README.md

apps/auth

The authentication worker for Nestri — a Cloudflare Worker built on @nestri/auth (OpenAuth-style issuer).

What it does

Hosts the OpenID Connect / OAuth issuer and the login UI:

Steam OAuth — the primary login flow. After Steam redirects back, the worker fetches the player's profile, creates (or finds) the User + LinkedAccount rows in Postgres, auto-creates a personal team on first login, and issues a JWT user subject containing { userID, linkedAccountID }.
SSH login — authenticates a device via its SSH fingerprint (keyed by SSH_AUTH_KEY), resolving the identity through Steam.resolveSshIdentity in @nestri/core.

Key details

Signing keys are generated at runtime and persisted in the AuthStorage KV namespace.
JWT subjects are defined in @nestri/core/auth/subjects.
The API worker calls this worker via a service binding (AUTH), verified through AUTH_ISSUER_URL.

Structure

src/index.ts      # Worker entrypoint: issuer config + success callbacks (steam, ssh)
test/             # Worker tests

Running

Deployed through Alchemy (apps/auth worker in alchemy.run.ts at the repo root) with bindings AuthStorage (KV), HYPERDRIVE (Postgres), STEAM_API_KEY, SSH_AUTH_KEY.