Repository navigation
The service has no deployable Worker: compose the modules, add wrangler config and a deploy pipeline #41
Description
Found while wiring the first consumer. Yoginini needs to sign people in (Yoginini/ios#8, yoginini-backend#3), so I went looking for the deployed service. auth.factory0.ventures does not resolve, and the reason is not a DNS record.
Context. This repository is five library crates: auth-core, auth-oidc, auth-passkeys, auth-meta, auth-client. There is no #[event(fetch)] anywhere in it, no wrangler.toml, and .github/workflows holds only ci.yml. Thirteen of the twenty two issues are merged and the login methods work in tests, but nothing composes them into a Worker, so there is no artifact to deploy and no environment to deploy it to.
Every consuming venture is blocked behind this, not behind any of the remaining login-method issues.
Proposed approach. The same shape as any other harness venture, because that is what this is:
- A
crates/auth-worker(or a rootsrc/) that callsHarness::builder, mountsauth-coreplus the login-method modules that are merged today, and exposes#[event(fetch)]and#[event(scheduled)]throughfactory0-runtime-cloudflare.Factory-Zero/venture-backend-templatealready has the layout; follow it rather than inventing one. wrangler.tomlwith staging and production environments, a D1 binding per environment, the rate limit binding, andauth.factory0.venturesas the production route.- Migrations collected with
fz migrations collectand committed. deploy.yml:mainto staging, av*tag to production behind the approval gate, matching the template.smoke.shhitting/__health,/.well-known/openid-configurationand/.well-known/jwks.jsonagainst a deployed URL. The well-known routes need harness#46, which is merged.- A first client registered so a consumer can actually complete a flow end to end.
Owner-only steps (needs-human). wrangler d1 create for both databases, HARNESS_SECRET and the signing key material per environment, the auth.factory0.ventures route on the Kontinuum Cloudflare account, and the first production tag.
Acceptance criteria
-
wrangler devserves the discovery document and JWKS locally - Staging deploys from
mainandsmoke.shpasses against it -
auth.factory0.venturesserves/.well-known/openid-configurationover TLS - One registered client completes authorization code plus PKCE against staging
- The README's status badge stops saying SPIKES
Out of scope. The login methods still open (#16 through #21). Whatever is merged when this ships is what ships; the rest mount later without redeploying the consumers.
Estimate. Medium
References. #1, #25 (git pins to crates.io), harness#46, Yoginini/ios#8, Yoginini/yoginini-backend#3
Activity
feat(auth-worker): the deployable auth Worker (#41) (#46)
ParallelEntrepreneur commentedon Sep 8, 2026
The deployable Worker landed in #46 (merged, CI green incl. the workspace wasm build + conformance kit):
crates/auth-workercomposes auth-core + oidc + passkeys + magic-link + password + meta into one harness venture with#[event(fetch)]/scheduledovercratefield-runtime-cloudflare;wrangler.toml(staging +auth.factory0.venturesproduction),.github/workflows/deploy.yml(main→staging, v*→prod behind the approval gate, applying D1 migrations + smoke), andsmoke.sh(/__health + discovery + JWKS).Remaining — owner-only (needs-human):
wrangler d1 create factory0-auth-staging/-production, paste the ids into wrangler.toml.HARNESS_SECRET(+HARNESS_SECRET_PREVIOUSon rotation),RESEND_API_KEY; andCLOUDFLARE_API_TOKEN/CLOUDFLARE_ACCOUNT_IDrepo secrets +AUTH_STAGING_URLvar for the workflow.fz migrations collectand commitmigrations/(needs the fz CLI).auth.factory0.venturescustom domain on the Kontinuum account.v*tag.Then the four live acceptance boxes (wrangler dev discovery/JWKS, staging smoke, TLS discovery, a client completing code+PKCE) can be checked, and the Cratefield control plane can switch to the proper relay path (option B), retiring the console's direct-Google deviation.