cloud/local/examples: thread per-user ScopeStack through HTTP + MCP

- cloud: resolves userId from the authenticated session and builds a [userOrgScope, orgScope] stack via createScopedExecutor(userId, orgId, orgName). userId threaded through execution-stack, mcp-session, and MCP dispatch init. - cloud env refactor: deletes the lazy Proxy apps/cloud/src/env.ts in favor of cloudflare:workers env imported at call sites; adds env-augment.d.ts to type secrets not present in generated wrangler types. - cloud/server.ts: env-guarded OTEL wiring (skips instrument() when AXIOM_TOKEN absent); captures rawFetch before instrument() mutates it so dev requests still land on the Hono app. - cloud/services/db.ts: prefers DATABASE_URL over the hyperdrive proxy so local dev works without the tunnel. - vite.config.ts: devCrashGuard plugin that prints uncaught Worker errors with a stable exit. - hosts/mcp: optional debug flag surfaces verbose session logging, wired up from cloud mcp-session. - local/examples/marketing: migrated to scopes: [scope].

Rhys Sullivan committed 6 months ago

Commit d4e311e1 parent 427699c25 files · +320 −174Browse files

Showing the changes to apps/cloud/src/auth (2 of 25 files). Show all

Unified · Split

2 files

apps/cloud/src/auth/handlers.ts +2 −2
apps/cloud/src/auth/workos.ts +4 −4

apps/cloud/src/auth/handlers.ts+2−2

 import { SessionContext } from "./middleware";
 import { UserStoreService } from "./context";
 import { authorizeOrganization } from "./authorize-organization";
+import { env } from "cloudflare:workers";
 import { WorkOSError } from "./errors";
 import { WorkOSAuth } from "./workos";
-import { server } from "../env";
 const COOKIE_OPTIONS = {
   path: "/",
           // Use the explicit public site URL — in dev, the request's Host
           // header points at the internal proxy target, not the public URL
           // WorkOS needs to redirect back to.
-          const origin = server.VITE_PUBLIC_SITE_URL;
+          const origin = env.VITE_PUBLIC_SITE_URL ?? "";
           const url = workos.getAuthorizationUrl(`${origin}${AUTH_PATHS.callback}`);
           return HttpServerResponse.redirect(url, { status: 302 });
         }),

apps/cloud/src/auth/workos.ts+4−4

 // WorkOS AuthKit — Effect-native sealed session management
 // ---------------------------------------------------------------------------
+import { env } from "cloudflare:workers";
 import { Context, Effect, Layer } from "effect";
 import { WorkOS } from "@workos-inc/node/worker";
 import { WorkOSError, tryPromiseService, withServiceLogging } from "./errors";
-import { server } from "../env";
 const COOKIE_NAME = "wos-session";
 // ---------------------------------------------------------------------------
 const make = Effect.gen(function* () {
-  const apiKey = server.WORKOS_API_KEY;
+  const apiKey = env.WORKOS_API_KEY;
-  const clientId = server.WORKOS_CLIENT_ID;
+  const clientId = env.WORKOS_CLIENT_ID;
-  const cookiePassword = server.WORKOS_COOKIE_PASSWORD;
+  const cookiePassword = env.WORKOS_COOKIE_PASSWORD;
   if (!cookiePassword || cookiePassword.length < 32) {
     return yield* Effect.die(new Error("WORKOS_COOKIE_PASSWORD must be at least 32 characters"));