mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 17:25:19 +03:00
33 lines
1.3 KiB
Markdown
33 lines
1.3 KiB
Markdown
# apps/auth
|
|
|
|
The authentication worker for Nestri — a Cloudflare Worker built on
|
|
[`@nestri/auth`](../../packages/auth/README.md) (OpenAuth-style issuer).
|
|
|
|
## What it does
|
|
|
|
Hosts the OpenID Connect / OAuth issuer and the login UI:
|
|
|
|
- **Steam OAuth** — the primary login flow. After Steam redirects back, the worker fetches the
|
|
player's profile, creates (or finds) the `User` + `LinkedAccount` rows in Postgres, auto-creates a
|
|
personal team on first login, and issues a JWT `user` subject containing `{ userID, linkedAccountID }`.
|
|
- **SSH login** — authenticates a device via its SSH fingerprint (keyed by `SSH_AUTH_KEY`),
|
|
resolving the identity through `Steam.resolveSshIdentity` in `@nestri/core`.
|
|
|
|
## Key details
|
|
|
|
- Signing keys are generated at runtime and persisted in the `AuthStorage` KV namespace.
|
|
- JWT subjects are defined in `@nestri/core/auth/subjects`.
|
|
- The API worker calls this worker via a service binding (`AUTH`), verified through `AUTH_ISSUER_URL`.
|
|
|
|
## Structure
|
|
|
|
```text
|
|
src/index.ts # Worker entrypoint: issuer config + success callbacks (steam, ssh)
|
|
test/ # Worker tests
|
|
```
|
|
|
|
## Running
|
|
|
|
Deployed through Alchemy (`apps/auth` worker in `alchemy.run.ts` at the repo root) with bindings
|
|
`AuthStorage` (KV), `HYPERDRIVE` (Postgres), `STEAM_API_KEY`, `SSH_AUTH_KEY`.
|