netris-nestri/apps/auth/README.md

apps/auth

The authentication worker for Nestri — a Cloudflare Worker built on @nestri/auth (OpenAuth-style issuer).

What it does

Hosts the OpenID Connect / OAuth issuer and the login UI:

• Steam OAuth — the primary login flow. After Steam redirects back, the worker fetches the player's profile, creates (or finds) the User + LinkedAccount rows in Postgres, auto-creates a personal team on first login, and issues a JWT user subject containing { userID, linkedAccountID }.
• SSH login — authenticates a device via its SSH fingerprint (keyed by SSH_AUTH_KEY), resolving the identity through Steam.resolveSshIdentity in @nestri/core.

Key details

• Signing keys are generated at runtime and persisted in the AuthStorage KV namespace.
• JWT subjects are defined in @nestri/core/auth/subjects.
• The API worker calls this worker via a service binding (AUTH), verified through AUTH_ISSUER_URL.

Structure

src/index.ts      # Worker entrypoint: issuer config + success callbacks (steam, ssh)
test/             # Worker tests

Running

Deployed through Alchemy (apps/auth worker in alchemy.run.ts at the repo root) with bindings AuthStorage (KV), HYPERDRIVE (Postgres), STEAM_API_KEY, SSH_AUTH_KEY.