mirror of https://github.com/nestriness/nestri.git synced 2026-09-19 17:25:19 +03:00

Files

Wanjohi affe1e3c73 refactor(auth): serve one provider, and make it the email one

Signing in with a gaming account or with an SSH key could both bring a
user into existence. That makes an account only as recoverable as the
thing that created it, and gives one person as many accounts as they
have gaming logins — neither of which is what an account is supposed to
be now that verifying an address is what creates one.

Both are unwired rather than deleted. The provider implementations stay
where they are, because connecting a gaming account is still something
this product does; it just does it from the API, against a user who
already exists, which is a connection hanging off an identity rather
than an identity of its own.

The worker test followed: it exercised the two flows that are gone, and
now covers the one that is left plus an assertion that the other two are
not routed, so they cannot come back quietly.

2026-09-05 09:27:38 +03:00

src

refactor(auth): serve one provider, and make it the email one

2026-09-05 09:27:38 +03:00

test

refactor(auth): serve one provider, and make it the email one

2026-09-05 09:27:38 +03:00

package.json

feat: Sync to OSS repo

2026-08-06 22:13:51 +03:00

README.md

chore: Update Readme

2026-08-06 22:32:33 +03:00

tsconfig.json

feat: Sync to OSS repo

2026-08-06 22:13:51 +03:00

README.md

apps/auth

The authentication worker for Nestri — a Cloudflare Worker built on @nestri/auth (OpenAuth-style issuer).

What it does

Hosts the OpenID Connect / OAuth issuer and the login UI:

Steam OAuth — the primary login flow. After Steam redirects back, the worker fetches the player's profile, creates (or finds) the User + LinkedAccount rows in Postgres, auto-creates a personal team on first login, and issues a JWT user subject containing { userID, linkedAccountID }.
SSH login — authenticates a device via its SSH fingerprint (keyed by SSH_AUTH_KEY), resolving the identity through Steam.resolveSshIdentity in @nestri/core.

Key details

Signing keys are generated at runtime and persisted in the AuthStorage KV namespace.
JWT subjects are defined in @nestri/core/auth/subjects.
The API worker calls this worker via a service binding (AUTH), verified through AUTH_ISSUER_URL.

Structure

src/index.ts      # Worker entrypoint: issuer config + success callbacks (steam, ssh)
test/             # Worker tests

Running

Deployed through Alchemy (apps/auth worker in alchemy.run.ts at the repo root) with bindings AuthStorage (KV), HYPERDRIVE (Postgres), STEAM_API_KEY, SSH_AUTH_KEY.