feat(auth)!: ready-made interactive auth layer with real enforcement#81
Merged
Conversation
✅ Deploy Preview for devfra ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
antfubot
force-pushed
the
feat/anonymous-auth-recipe-and-server
branch
2 times, most recently
from
638323b to
d413ef4
Compare
Implements the auth-side upstream proposals surfaced by the Vite DevTools 0.6 migration (devframes/devframe issues): a single pre-trust rule, a packaged OTP auth handler, and an authenticated `startHttpAndWs`. BREAKING CHANGE (wire-level, `@internal` methods): the two pre-auth handshake methods are renamed to carry the `anonymous:` prefix so the pre-trust gate has one rule to apply, not a hand-maintained allowlist: - `devframe:anonymous:auth` -> `anonymous:devframe:auth` - `devframe:auth:exchange` -> `anonymous:devframe:auth:exchange` - `devframe/constants` exports `ANONYMOUS_RPC_PREFIX` / `isAnonymousRpcMethod`, the single source of truth for what's callable before trust. - `devframe/recipes/interactive-auth`'s `createInteractiveAuth(ctx, options)` packages the OTP protocol devframe's primitives already implement (`exchangeTempAuthCode`, `verifyAuthToken`, `revokeAuthToken`, `getTempAuthCode`, `buildOtpAuthUrl`) into a `DevframeAuthHandler` — handshake RPC functions, the resolver gate, a connect-time trust hook that reads a bearer off the WS upgrade URL, and the code/link banner. The auth storage stays internal to the handler. - `startHttpAndWs` accepts that handler (or a lower-level `authorize` / `onPeerConnect` pair) directly via `auth`, and now actually enforces it: an untrusted call to a non-`anonymous:` method throws `DF0036`. `StartedServer.connectionMeta()` returns the `__connection.json` shape a host would otherwise hand-roll. - A trusted-only `devframe:auth:revoke` server method lets a client give up its own session token. - Docs: rewrite the Security guide's auth-methods table for the new names and the ready-made handler, add the `DF0036` error page, and add an Interactive Auth helper page. Also clarifies the terminals hub-aggregation model (`ctx.terminals` as the single source of truth for sessions, the plugin as the PTY-capable renderer that mirrors into it) in the terminals plugin docs, closing out the last of the five proposals. Generated with the help of an agent.
antfubot
force-pushed
the
feat/anonymous-auth-recipe-and-server
branch
from
d413ef4 to
6594ff5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the auth-side upstream proposals from the Vite DevTools 0.6 migration writeup (proposals #5, #1, #2, #4, and the terminals doc clarification #6), landed together per the stated dependency order (#5 → #1 → #2; #4/#6 independent).
#5 —
anonymous:as the single source of truth for pre-auth RPC methods (breaking, wire-level,@internal)devframe/constantsexportsANONYMOUS_RPC_PREFIX('anonymous:') andisAnonymousRpcMethod(name).devframe:anonymous:auth→anonymous:devframe:authdevframe:auth:exchange→anonymous:devframe:auth:exchangedevframe:auth:revoked(server→client) is untouched — it's an event, never gated.#1 —
devframe/recipes/interactive-authcreateInteractiveAuth(ctx, options)packages the OTP protocol devframe's primitives already implement (exchangeTempAuthCode,verifyAuthToken,revokeAuthToken,getTempAuthCode,buildOtpAuthUrl) into aDevframeAuthLayer:rpcFunctions— the handshake pair plus the new self-revoke method (feat!: migrate to h3 v2 #4).authorize(methodName, session)— the resolver gate:anonymous:methods always pass, everything else needssession.meta.isTrusted.onConnect(peer, session)— connect-time trust: reads a bearer off the WS upgrade URL's?devframe_auth_token=and trusts the session before the client's own handshake call arrives.printBanner()— prints the code + magic-link URL once per code. Devframe stays headless; nothing prints until the host calls this.The recipe closes over the auth storage internally — no
devframe/node/hub-internalsreach from the host.#2 —
startHttpAndWsowns the authenticated serverauth?: boolean | DevframeAuthLayer— passing a layer registers itsrpcFunctions, wiresauthorizeas the resolver gate, and wiresonConnecton every new peer.authorize?/onPeerConnect?— lower-level escape hatches for a custom policy without a full layer.session.meta.isTrustedwas written but never read) — a rejected call throws the newDF0035.StartedServer.connectionMeta()returns the__connection.jsonshape ({ backend, websocket, jsonSerializableMethods }) a host would otherwise hand-roll.auth: booleanpreserves today's behavior exactly (verified — existing dedicated-port /auth:falsetests pass unchanged).#4 — Client self-revoke +
forgetAuthToken()devframe:auth:revoke(self-revoke), registered by the interactive-auth layer.DevframeRpcClient.revokeSelf()— calls it, forgets the persisted token, and broadcasts to sibling tabs over the existingdevframe-authchannel so they forget too.forgetAuthToken()export for integrations managing their own auth UI.#6 — Terminals hub-aggregation model
Documents (in
docs/plugins/terminals.md, cross-linked fromdocs/guide/hub.md) thatctx.terminalsis the single source of truth for terminal sessions, and the terminals plugin is the PTY-capable renderer that mirrors into it — a session started viactx.terminals.startChildProcessdirectly and one started from the plugin UI land in the same list.Testing
packages/devframe/src/recipes/__tests__/interactive-auth.test.ts, including a full round-trip over a real WS connection (untrusted connect → rejected call → handshake → code exchange → trusted → reconnect with the returned bearer, no new code) and a self-revoke round-trip.pnpm lint && pnpm test && pnpm typecheck && pnpm buildall pass. The only pre-existing failures (8tsnapisnapshot mismatches fromimport("pkg").Xvs a rolldown-namespace alias formatting difference, unrelated to this change) reproduce identically on unmodifiedmainwith a freshpnpm install.Generated with the help of an agent.