History

fix runtime release anonymous issuer seeding

Seed ANONYMOUS_AUTH_ISSUER to the managed site port when building runtime artifacts so fresh installs use a reachable JWKS issuer instead of a transient build-time port.

Rhys Sullivan committed 8 months ago

Commit 6fd8bd31 parent 8144a6e1 file · +2 −1Browse files

Unified · Split

executor/scripts/release/build-release.ts+2−1
@@ -22,6 +22,7 @@ const targets: ReleaseTarget[] = [ · 21 unmodified lines
22];22];
23 23
24const convexBackendRepo = "get-convex/convex-backend";24const convexBackendRepo = "get-convex/convex-backend";
25const defaultManagedSitePort = 5411;
25 26
26function hostPlatformArch(): { platform: "linux" | "darwin"; arch: "x64" | "arm64" } {27function hostPlatformArch(): { platform: "linux" | "darwin"; arch: "x64" | "arm64" } {
27 if (process.platform !== "linux" && process.platform !== "darwin") {28 if (process.platform !== "linux" && process.platform !== "darwin") {
@@ -264,7 +265,7 @@ async function seedManagedRuntimeState( · 236 unmodified lines
264 265
265 const envEntries: Array<{ name: string; value: string }> = [266 const envEntries: Array<{ name: string; value: string }> = [
266 { name: "WORKOS_CLIENT_ID", value: "disabled" },267 { name: "WORKOS_CLIENT_ID", value: "disabled" },
267 { name: "ANONYMOUS_AUTH_ISSUER", value: `http://${config.hostInterface}:${config.siteProxyPort}` },268 { name: "ANONYMOUS_AUTH_ISSUER", value: `http://${config.hostInterface}:${defaultManagedSitePort}` },
268 { name: "ANONYMOUS_AUTH_PRIVATE_KEY_PEM", value: anonymousAuth.privateKeyPem },269 { name: "ANONYMOUS_AUTH_PRIVATE_KEY_PEM", value: anonymousAuth.privateKeyPem },
269 { name: "ANONYMOUS_AUTH_PUBLIC_KEY_PEM", value: anonymousAuth.publicKeyPem },270 { name: "ANONYMOUS_AUTH_PUBLIC_KEY_PEM", value: anonymousAuth.publicKeyPem },
270 { name: "MCP_API_KEY_SECRET", value: anonymousAuth.apiKeySecret },271 { name: "MCP_API_KEY_SECRET", value: anonymousAuth.apiKeySecret },