mirror of
https://github.com/nestriness/nestri.git
synced 2026-11-10 01:12:27 +02:00
Wanjohi
7c200ff092
The send budget was keyed by every submitted form field, so adding a field with a new value each time made a fresh budget, and one mailbox could be sent codes without limit. A claim is now built only from the claim fields (email, phone by default); anything else is dropped before it is counted and before it reaches sendCode. A budget per mailbox does nothing against a caller holding a list of addresses: each send goes to a different stranger, and the deployment's whole sending allowance goes with them. Add a second budget per requesting address, 10 codes per 24 hours by default. The window is a day rather than an hour because a caller that paces itself stays under any hourly figure a person would also fit under. The address lookup the device flow used is moved into util so both read the caller the same way.
packages/auth (@nestri/auth)
Framework-agnostic OpenAuth implementation for Nestri — the OAuth/OIDC issuer, client, subjects, and the login UI. A vendored/forked build of OpenAuth.
What it does
Everything needed to run your own authentication provider:
issuer.ts— the authorization server: routes for/authorize,/callback,/token,/userinfo,.well-known/*, plus the login UI (React renderer).client.ts—createClientto verify JWTs against the issuer ("who is this token?").subject.ts— typed JWT subjects (zodschemas for the token payload).provider/*— drop-in OAuth/OIDC providers (steam, discord, github, google, apple, microsoft, slack, spotify, twitch, x, yahoo, facebook, linkedin, cognito, keycloak, jumpcloud, oauth2, oidc, password, ssh, code, arctic).storage/*— persistence adapters for keys/sessions/codes:memory,cloudflare(KV),aws,dynamo.ui/*— the login page components (forms, password, code, theme, CSS).jwt.ts,keys.ts,pkce.ts,random.ts— signing, keypair management, PKCE, randomness.
Usage
Consumed by the apps/auth worker, e.g.:
import { issuer } from '@nestri/auth/index';
import { CloudflareStorage } from '@nestri/auth/storage/cloudflare';
import { SteamProvider } from '@nestri/auth/provider/steam';
The API uses createClient (from @openauth/openauth/client) or the bundled client.ts to verify
tokens against the issuer URL.
Scripts
bun test # run tests
bun run build # build (see script/build.ts)
Note
@openauthjs is the upstream project; this package's exports are meant to be API-compatible with a
pinned preference toward tree-shaking-friendly imports. Prefer importing subpaths over the barrel
(@nestri/auth/index).