- cloud: resolves userId from the authenticated session and builds a [userOrgScope, orgScope] stack via createScopedExecutor(userId, orgId, orgName). userId threaded through execution-stack, mcp-session, and MCP dispatch init. - cloud env refactor: deletes the lazy Proxy apps/cloud/src/env.ts in favor of cloudflare:workers env imported at call sites; adds env-augment.d.ts to type secrets not present in generated wrangler types. - cloud/server.ts: env-guarded OTEL wiring (skips instrument() when AXIOM_TOKEN absent); captures rawFetch before instrument() mutates it so dev requests still land on the Hono app. - cloud/services/db.ts: prefers DATABASE_URL over the hyperdrive proxy so local dev works without the tunnel. - vite.config.ts: devCrashGuard plugin that prints uncaught Worker errors with a stable exit. - hosts/mcp: optional debug flag surfaces verbose session logging, wired up from cloud mcp-session. - local/examples/marketing: migrated to scopes: [scope].
Showing the changes to apps/cloud/src/auth (2 of 25 files). Show all
Unified · Split
| @@ -6,9 +6,9 @@ import { AUTH_PATHS, CloudAuthApi, CloudAuthPublicApi } from "./api"; · 5 unmodified lines | ||
| 6 | 6 | import { SessionContext } from "./middleware"; |
| 7 | 7 | import { UserStoreService } from "./context"; |
| 8 | 8 | import { authorizeOrganization } from "./authorize-organization"; |
| 9 | +import { env } from "cloudflare:workers"; | |
| 9 | 10 | import { WorkOSError } from "./errors"; |
| 10 | 11 | import { WorkOSAuth } from "./workos"; |
| 11 | −import { server } from "../env"; | |
| 12 | 12 | |
| 13 | 13 | const COOKIE_OPTIONS = { |
| 14 | 14 | path: "/", |
| @@ -40,7 +40,7 @@ export const CloudAuthPublicHandlers = HttpApiBuilder.group( · 25 unmodified lines | ||
| 40 | 40 | // Use the explicit public site URL — in dev, the request's Host |
| 41 | 41 | // header points at the internal proxy target, not the public URL |
| 42 | 42 | // WorkOS needs to redirect back to. |
| 43 | − const origin = server.VITE_PUBLIC_SITE_URL; | |
| 43 | + const origin = env.VITE_PUBLIC_SITE_URL ?? ""; | |
| 44 | 44 | const url = workos.getAuthorizationUrl(`${origin}${AUTH_PATHS.callback}`); |
| 45 | 45 | return HttpServerResponse.redirect(url, { status: 302 }); |
| 46 | 46 | }), |
| @@ -2,10 +2,10 @@ · 1 unmodified line | ||
| 2 | 2 | // WorkOS AuthKit — Effect-native sealed session management |
| 3 | 3 | // --------------------------------------------------------------------------- |
| 4 | 4 | |
| 5 | +import { env } from "cloudflare:workers"; | |
| 5 | 6 | import { Context, Effect, Layer } from "effect"; |
| 6 | 7 | import { WorkOS } from "@workos-inc/node/worker"; |
| 7 | 8 | import { WorkOSError, tryPromiseService, withServiceLogging } from "./errors"; |
| 8 | −import { server } from "../env"; | |
| 9 | 9 | |
| 10 | 10 | const COOKIE_NAME = "wos-session"; |
| 11 | 11 | |
| @@ -14,9 +14,9 @@ const COOKIE_NAME = "wos-session"; · 2 unmodified lines | ||
| 14 | 14 | // --------------------------------------------------------------------------- |
| 15 | 15 | |
| 16 | 16 | const make = Effect.gen(function* () { |
| 17 | − const apiKey = server.WORKOS_API_KEY; | |
| 18 | − const clientId = server.WORKOS_CLIENT_ID; | |
| 19 | − const cookiePassword = server.WORKOS_COOKIE_PASSWORD; | |
| 17 | + const apiKey = env.WORKOS_API_KEY; | |
| 18 | + const clientId = env.WORKOS_CLIENT_ID; | |
| 19 | + const cookiePassword = env.WORKOS_COOKIE_PASSWORD; | |
| 20 | 20 | |
| 21 | 21 | if (!cookiePassword || cookiePassword.length < 32) { |
| 22 | 22 | return yield* Effect.die(new Error("WORKOS_COOKIE_PASSWORD must be at least 32 characters")); |