This repository was archived by the owner on Oct 5, 2026. It is now read-only.
Repository navigation
feat(auth-worker): the deployable auth Worker (#41) - #46
Merged
Merged
Conversation
The repository was six library crates with no artifact to deploy, so auth.factory0.ventures did not exist and every consumer (the Cratefield control plane, Yoginini) was blocked on it. This composes them into one harness venture and adds the deploy pipeline. - `crates/auth-worker` (`factory0-auth-worker`): `Harness::builder` mounts auth-core + oidc + passkeys + magic-link + password + meta over `cratefield-runtime-cloudflare`, with `#[event(fetch)]` and `#[event(scheduled)]`. Mailer is Resend from `RESEND_API_KEY` (a capture-only no-op until the key is set); magic-link's templates are registered. Builds to wasm32; clippy/fmt clean. - `wrangler.toml`: staging (from `main`) + production (`auth.factory0.ventures`, custom domain), a `DB` D1 binding per environment, `migrations_dir`, `worker-build` release build. - `.github/workflows/deploy.yml`: `main` -> staging, a `v*` tag -> production behind the `production` environment approval gate, each applying D1 migrations and running the smoke test. - `smoke.sh`: asserts `/__health`, `/.well-known/openid-configuration` and `/.well-known/jwks.json` all answer 200. Which login methods ship is which modules are mounted here; the rest mount later without redeploying consumers. **Remaining (needs-human / owner-only, per #41):** `wrangler d1 create` for each environment (paste the ids into wrangler.toml), set `HARNESS_SECRET` + `RESEND_API_KEY` secrets, add the auth.factory0.ventures custom domain on the Kontinuum account, run `fz migrations collect` to populate `migrations/`, and cut the first `v*` tag. Then `wrangler dev` / staging serve the discovery document + JWKS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QScfNS82MGFi3Yn63Vj2rR
ParallelEntrepreneur
added a commit
that referenced
this pull request
Sep 8, 2026
…template id (#47) `fz migrations collect`/`doctor` must link the venture's own harness to see its modules — the standalone cratefield-cli binary cannot. This adds that `fz`, uses it to collect the migrations, and fixes a template-id bug it surfaced that would have crashed the deployed Worker. - `crates/auth-fz` (`factory0-auth-fz`): a native `fz` bin that composes the same modules as the Worker over an `AllPorts` runtime (fz reads module metadata, not live bindings) and calls `cratefield_cli::main_for`. Kept OUT of the workspace (`exclude`) so the CLI's native-only deps (clap, rusqlite) never reach the `wasm build (workspace)` job. - `migrations/`: `fz migrations collect` output — 6 auth-core migrations (the login methods declare no tables) + `.harness-lock.json`. wrangler applies these to D1. - **Fix (auth-magic-link):** `TEMPLATE_MAGIC_LINK` was `auth-magic-link.sign-in` (a dot); the harness keys template ids as `<module>/<template>` and checks the module part, so composing magic-link into a venture failed `Harness::build` with "template names module `auth-magic-link.sign-in` which is not registered" — which would have panicked the deployed auth Worker (#46) on its first request. Now `auth-magic-link/sign-in`. No module before this composed magic-link with its templates, so nothing caught it. Verified: `fz migrations collect` succeeds and writes the lock; the Worker still builds to wasm32; magic-link's 28 tests pass; clippy/fmt clean. Claude-Session: https://claude.ai/code/session_01QScfNS82MGFi3Yn63Vj2rR Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the "no deployable Worker" gap (#41). The repo was six library crates with no artifact to deploy, so
auth.factory0.venturesdidn't exist and every consumer was blocked — the Cratefield control-plane login (option B), Yoginini, etc. This composes them into one harness venture and adds the deploy pipeline.What
crates/auth-worker(factory0-auth-worker) —Harness::buildermounts auth-core + oidc + passkeys + magic-link + password + meta overcratefield-runtime-cloudflare, exposing#[event(fetch)]/#[event(scheduled)]. Mailer is Resend fromRESEND_API_KEY(a capture-only no-op until set); magic-link's templates are registered. All required ports (Db/Clock/IdGen/Mailer) are provided; RateLimiter/Captcha are optional and left unset.wrangler.toml— staging (frommain) + production (auth.factory0.ventures, custom domain), aDBD1 binding per environment,migrations_dir,worker-buildrelease build..github/workflows/deploy.yml—main→ staging, av*tag → production behind theproductionenvironment approval gate, each applying D1 migrations and running the smoke test.smoke.sh— asserts/__health,/.well-known/openid-configuration,/.well-known/jwks.jsonall answer 200.Verification
Builds to wasm32 (the deploy target) and native;
cargo clippy --all-targets -- -D warningsandcargo fmt --all --checkclean. The passkeys/wasm concern is already handled upstream (webauthn-rs-proto, ADR 0100).Remaining — owner-only (needs-human, per #41)
wrangler d1 createfor each env (paste ids intowrangler.toml), setHARNESS_SECRET+RESEND_API_KEYsecrets, add theauth.factory0.venturescustom domain on the Kontinuum account, runfz migrations collectto populatemigrations/, and cut the firstv*tag. Thenwrangler dev/ staging serve the discovery document + JWKS, and the Cratefield control plane can switch to the proper relay path (option B) — retiring the console's direct-Google deviation.🤖 Generated with Claude Code
https://claude.ai/code/session_01QScfNS82MGFi3Yn63Vj2rR