mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 17:25:19 +03:00
9258c8dfef
Six defects found by running the thing rather than reading it. The previous change was verified by bundling, by tests, and by the container images — none of which start a Worker, so every one of these was invisible. **`bun dev` did not start.** It ran one multi-config process, which does not connect a service binding between the workers it loads; the API reported `AUTH [not connected]` and could not verify a token. It is two processes now, which is what the dev registry connects, and the second is backgrounded with the first killed on exit so stopping the pair stops both. **Neither server could bind.** Wrangler resolves `localhost` and takes `::1` first; a host with no IPv6 address on its loopback dies with a bind error from inside the runtime that names neither the app nor the port. `dev.ip` is pinned to `127.0.0.1`, and `inspector_port` is now distinct per app — it is not derived from the port above, so the second server to start died on an address already in use. **The API worker failed to evaluate.** A specifier ending in `.sql` is claimed by the bundler as a module of its own, so the schema file was emitted verbatim beside the bundle and the runtime threw on an export it could not find. The route was reaching past the domain module into the schema to spell a status; it now asks the domain module, which is the rule everywhere else here and happens to also avoid the hazard. **Signing in failed on the second request that touched the database.** A pool is cached per connection string, and on a Worker an I/O object created while handling one request may not be touched while handling another. The first request always succeeded, which is why it went unnoticed — a sign-in is several. The cache is now kept only where a process outlives its requests, which is the case it was added for. **The images named a base that podman will not resolve.** A short name needs a registry; the database service alongside them already spelled one. **Compose pinned container names.** The name is not scoped to the project, so a second checkout got the same three, and `down` in one stopped the other's containers. This is not hypothetical — it stopped a running development database while this was being tested. Verified by signing in end to end against both dev servers: a code requested over HTTP, read from the issuer's log, redeemed, exchanged for tokens, and presented to the API, which resolved it to the account the sign-in had just created.
apps/auth
The authentication service for Nestri, built on
@nestri/auth (OpenAuth-style issuer). One
handler, run either as a Cloudflare Worker or as an ordinary HTTP server.
What it does
Hosts the OAuth issuer and the sign-in UI:
- Email code — the only provider, on purpose. Verifying an email address is the one thing that
brings an account into existence, so an account is exactly as recoverable as its email. The
successcallback finds or creates theUserrow, ensures a personal team exists, and issues a JWTusersubject containing{ userID, linkedAccountID }. - Device authorization grant (RFC 8628) — for programs with no browser. A client starts a grant,
a person approves it in a browser, and the client collects tokens by polling. Connecting a Steam
account is not a sign-in and lives in
apps/apiinstead, against a user who already exists.
Key details
- All issuer state is in Postgres. There is no key-value binding. Signing keys, authorization
codes, refresh tokens and device grants each have a table, because each is either a record whose
loss ends every session (the keys) or one with a transition that must happen exactly once while
two callers are touching it — a code is redeemed once, a refresh token is spent once, a grant is
approved once. A store that reads and writes whole records cannot promise that. What is left in
the generic
auth_kvtable is the rate-limit counters, which are allowed to be approximate. - Authorization codes, refresh tokens and device codes are stored as hashes. Each is a bearer credential, so what is kept is enough to recognise one and not enough to present it.
- JWT subjects are defined in
@nestri/core/auth/subjects. - The API verifies tokens against this issuer through
AUTH_ISSUER_URL, which must be this service's public URL: a token carries the address it was minted through and the check is literal.
Structure
src/index.ts # The handler: issuer config, stores, success callback
src/server.ts # The same handler behind a listening socket
src/email.ts # Verification code delivery
wrangler.jsonc # Worker configuration, one environment per stage
Dockerfile # The container, built from the repository root
test/
Running
bun run dev # under the Workers runtime, on :1337
bun run serve # as a plain process, on $PORT (default 1337)
Its only stateful dependency is Postgres — as a HYPERDRIVE binding on Workers, or as
DATABASE_URL anywhere else — alongside the mail settings. Full list and deployment steps:
docs/deploy.md.