mirror of
https://github.com/nestriness/nestri.git
synced 2026-11-03 22:22:39 +02:00
Wanjohi
eee3727d0c
The installer no longer needs a token copied from the dashboard. Run bare, the host agent shows a link, a code and a QR; approving it in a browser registers the machine. **Issuer** - New device client `installer`. Its access token lasts 15 minutes and it gets no refresh token: a refresh lifetime of 0 now means none is stored or returned. - `clientTTL(clientID)` sets lifetimes per client and wins over what a sign-in asks for. Desktop is unchanged. - `/device/authorize` allows 10 requests per address per 10 minutes. Past that it answers 429 `slow_down` with `Retry-After`. - The confirm page for the installer reads "Add a computer as a Nestri host?". The wording is fixed per client id. **API** - An `installer` token is accepted only on `POST /machine/install-token`. Everything else answers 403 `insufficient_permissions`. - Install tokens: at most 5 per person per hour, and at most 3 unspent at once (429 `too_many_requests`). - A team may own at most 10 machines. This is checked at mint and at redeem under a row lock (429 `quota_exceeded`). A refused redeem leaves the token unspent. Organisation hosts are not counted. **install.sh** - The token is optional. With none, `NESTRI_INSTALL_TOKEN` is left unset and onboarding signs in. - **Do not release this file until `DEFAULT_VERSION` points at a host agent that can sign in.** Older agents need a token. Tests: packages/core 256, apps/api 193, packages/auth 74, apps/auth 28, all passing.
packages/auth (@nestri/auth)
Framework-agnostic OpenAuth implementation for Nestri — the OAuth/OIDC issuer, client, subjects, and the login UI. A vendored/forked build of OpenAuth.
What it does
Everything needed to run your own authentication provider:
issuer.ts— the authorization server: routes for/authorize,/callback,/token,/userinfo,.well-known/*, plus the login UI (React renderer).client.ts—createClientto verify JWTs against the issuer ("who is this token?").subject.ts— typed JWT subjects (zodschemas for the token payload).provider/*— drop-in OAuth/OIDC providers (steam, discord, github, google, apple, microsoft, slack, spotify, twitch, x, yahoo, facebook, linkedin, cognito, keycloak, jumpcloud, oauth2, oidc, password, ssh, code, arctic).storage/*— persistence adapters for keys/sessions/codes:memory,cloudflare(KV),aws,dynamo.ui/*— the login page components (forms, password, code, theme, CSS).jwt.ts,keys.ts,pkce.ts,random.ts— signing, keypair management, PKCE, randomness.
Usage
Consumed by the apps/auth worker, e.g.:
import { issuer } from '@nestri/auth/index';
import { CloudflareStorage } from '@nestri/auth/storage/cloudflare';
import { SteamProvider } from '@nestri/auth/provider/steam';
The API uses createClient (from @openauth/openauth/client) or the bundled client.ts to verify
tokens against the issuer URL.
Scripts
bun test # run tests
bun run build # build (see script/build.ts)
Note
@openauthjs is the upstream project; this package's exports are meant to be API-compatible with a
pinned preference toward tree-shaking-friendly imports. Prefer importing subpaths over the barrel
(@nestri/auth/index).