cloud/local/examples: thread per-user ScopeStack through HTTP + MCP

- cloud: resolves userId from the authenticated session and builds a [userOrgScope, orgScope] stack via createScopedExecutor(userId, orgId, orgName). userId threaded through execution-stack, mcp-session, and MCP dispatch init. - cloud env refactor: deletes the lazy Proxy apps/cloud/src/env.ts in favor of cloudflare:workers env imported at call sites; adds env-augment.d.ts to type secrets not present in generated wrangler types. - cloud/server.ts: env-guarded OTEL wiring (skips instrument() when AXIOM_TOKEN absent); captures rawFetch before instrument() mutates it so dev requests still land on the Hono app. - cloud/services/db.ts: prefers DATABASE_URL over the hyperdrive proxy so local dev works without the tunnel. - vite.config.ts: devCrashGuard plugin that prints uncaught Worker errors with a stable exit. - hosts/mcp: optional debug flag surfaces verbose session logging, wired up from cloud mcp-session. - local/examples/marketing: migrated to scopes: [scope].

Rhys Sullivan committed 6 months ago

Commit d4e311e1 parent 427699c25 files · +320 −174Browse files

Showing the changes to apps/cloud/src/services (6 of 25 files). Show all

Unified · Split

6 files

apps/cloud/src/services/__test-harness__/api-harness.ts +1 −1
apps/cloud/src/services/autumn.ts +2 −3
apps/cloud/src/services/db.ts +1 −5
apps/cloud/src/services/execution-stack.ts +10 −4
apps/cloud/src/services/executor.ts +31 −14
apps/cloud/src/services/telemetry.ts +5 −6

apps/cloud/src/services/__test-harness__/api-harness.ts+1−1

@@ -181,7 +181,7 @@ const createTestScopedExecutor = (scopeId: string, scopeName: string) => · 180 unmodified lines
181	name: scopeName,	181	name: scopeName,
182	createdAt: new Date(),	182	createdAt: new Date(),
183	});	183	});
184	return yield* createExecutor({ scope, adapter, blobs, plugins });	184	return yield* createExecutor({ scopes: [scope], adapter, blobs, plugins });
185	});	185	});
186		186
187	// ---------------------------------------------------------------------------	187	// ---------------------------------------------------------------------------

apps/cloud/src/services/autumn.ts+2−3

 // Autumn billing service — wraps the autumn-js SDK with Effect
 // ---------------------------------------------------------------------------
+import { env } from "cloudflare:workers";
 import * as Sentry from "@sentry/cloudflare";
 import { Autumn } from "autumn-js";
 import { Context, Data, Effect, Layer } from "effect";
-import { server } from "../env";
 // ---------------------------------------------------------------------------
 // Errors
 // ---------------------------------------------------------------------------
 // ---------------------------------------------------------------------------
 const make = Effect.sync(() => {
-  const secretKey = server.AUTUMN_SECRET_KEY;
+  const secretKey = env.AUTUMN_SECRET_KEY;
   if (!secretKey) {
     const notConfigured = Effect.die(

apps/cloud/src/services/db.ts+1−5

 import postgres, { type Sql } from "postgres";
 import * as cloudSchema from "./schema";
 import * as executorSchema from "./executor-schema";
-import { server } from "../env";
 // Exported so every drizzle() call in the cloud app shares one schema
 // object. Historically `mcp-session.ts` built its own and forgot to spread
   // In local dev prefer an explicit DATABASE_URL (direct connection to
   // the PGlite socket server) so we bypass Miniflare's Hyperdrive proxy.
   // In production fall back to the Hyperdrive binding.
-  if (server.DATABASE_URL) {
+  return env.DATABASE_URL || env.HYPERDRIVE?.connectionString || "";
-    return server.DATABASE_URL;
-  }
-  return env.HYPERDRIVE?.connectionString ?? server.DATABASE_URL;
 };
 const makeSql = (): Sql =>

apps/cloud/src/services/execution-stack.ts+10−4

 import { AutumnService } from "./autumn";
 import { createScopedExecutor } from "./executor";
-export const makeExecutionStack = (organizationId: string, organizationName: string) =>
+export const makeExecutionStack = (
+  userId: string,
+  organizationId: string,
+  organizationName: string,
+) =>
   Effect.gen(function* () {
-    const executor = yield* createScopedExecutor(organizationId, organizationName).pipe(
+    const executor = yield* createScopedExecutor(
-      Effect.withSpan("McpSessionDO.createScopedExecutor"),
+      userId,
-    );
+      organizationId,
+      organizationName,
+    ).pipe(Effect.withSpan("McpSessionDO.createScopedExecutor"));
     const codeExecutor = makeDynamicWorkerExecutor({ loader: env.LOADER });
     const autumn = yield* AutumnService;
     const engine = withExecutionUsageTracking(

apps/cloud/src/services/executor.ts+31−14

 import { graphqlPlugin } from "@executor/plugin-graphql";
 import { workosVaultPlugin } from "@executor/plugin-workos-vault";
+import { env } from "cloudflare:workers";
 import { DbService } from "./db";
-import { server } from "../env";
 // ---------------------------------------------------------------------------
 // Plugin list — one place, used for both the runtime and the CLI config
     graphqlPlugin(),
     workosVaultPlugin({
       credentials: {
-        apiKey: server.WORKOS_API_KEY,
+        apiKey: env.WORKOS_API_KEY,
-        clientId: server.WORKOS_CLIENT_ID,
+        clientId: env.WORKOS_CLIENT_ID,
       },
     }),
   ] as const;
 // ---------------------------------------------------------------------------
-// Create a fresh executor for a scope (stateless, per-request).
+// Create a fresh executor for a (user, org) pair (stateless, per-request).
 //
-// Today "scope" is the WorkOS organization — orgs are the only scope
+// Scope stack is `[userOrgScope, orgScope]` — innermost first. The
-// level the cloud app exposes. When workspace / user scopes land, this
+// user-within-org scope id (`user-org:${userId}:${orgId}`) intentionally
-// function grows to accept a `ScopeStack` instead of a single scope id,
+// includes the org id so the same WorkOS user in a different org gets a
-// and nothing downstream (executor, plugins, storage) has to change.
+// distinct scope row; future workspace scopes can slot in between without
+// conflicting with a hypothetical global user scope.
+//
+// OAuth tokens land at `ctx.scopes[0]` (the user-org scope) by default, so
+// a member's access/refresh tokens can't leak to other members via
+// `secrets.list`, while source rows and org-wide credentials live on the
+// outer scope.
 // ---------------------------------------------------------------------------
 export const createScopedExecutor = (
-  scopeId: string,
+  userId: string,
-  scopeName: string,
+  organizationId: string,
+  organizationName: string,
 ) =>
   Effect.gen(function* () {
     const { db } = yield* DbService;
     const adapter = makePostgresAdapter({ db, schema });
     const blobs = makePostgresBlobStore({ db });
-    const scope = new Scope({
+    const orgScope = new Scope({
-      id: ScopeId.make(scopeId),
+      id: ScopeId.make(organizationId),
-      name: scopeName,
+      name: organizationName,
+      createdAt: new Date(),
+    });
+    const userOrgScope = new Scope({
+      id: ScopeId.make(`user-org:${userId}:${organizationId}`),
+      name: `Personal · ${organizationName}`,
       createdAt: new Date(),
     });
     // the opaque `InternalError({ traceId })` happens at the HTTP edge
     // via `withCapture` (see `api/protected-layers.ts`). That's
     // where `ErrorCaptureLive` (Sentry) gets wired in.
-    return yield* createExecutor({ scope, adapter, blobs, plugins });
+    return yield* createExecutor({
+      scopes: [userOrgScope, orgScope],
+      adapter,
+      blobs,
+      plugins,
+    });
   });

apps/cloud/src/services/telemetry.ts+5−6

   ATTR_SERVICE_NAME,
   ATTR_SERVICE_VERSION,
 } from "@opentelemetry/semantic-conventions";
+import { env } from "cloudflare:workers";
 import { Effect, Layer } from "effect";
-import { server } from "../env";
 const SERVICE_NAME = "executor-cloud";
 const SERVICE_VERSION = "1.0.0";
 let installed = false;
 const ensureGlobalTracerProvider = (): boolean => {
   if (installed) return true;
-  if (!server.AXIOM_TOKEN) return false;
+  if (!env.AXIOM_TOKEN) return false;
   const provider = new WebTracerProvider({
     resource: resourceFromAttributes({
       [ATTR_SERVICE_NAME]: SERVICE_NAME,
     spanProcessors: [
       new SimpleSpanProcessor(
         new OTLPTraceExporter({
-          url: server.AXIOM_TRACES_URL,
+          url: env.AXIOM_TRACES_URL ?? "https://api.axiom.co/v1/traces",
           headers: {
-            Authorization: `Bearer ${server.AXIOM_TOKEN}`,
+            Authorization: `Bearer ${env.AXIOM_TOKEN}`,
-            "X-Axiom-Dataset": server.AXIOM_DATASET,
+            "X-Axiom-Dataset": env.AXIOM_DATASET ?? "executor-cloud",
           },
         }),
       ),