Unified · Split
| @@ -3,38 +3,10 @@ const trim = (value: string | undefined): string | undefined => { · 2 unmodified lines | ||
| 3 | 3 | return candidate && candidate.length > 0 ? candidate : undefined; |
| 4 | 4 | }; |
| 5 | 5 | |
| 6 | −const isTruthy = (value: string | undefined): boolean => { | |
| 7 | − const normalized = trim(value)?.toLowerCase(); | |
| 8 | − return normalized === "1" || normalized === "true" || normalized === "yes"; | |
| 9 | −}; | |
| 10 | − | |
| 11 | −export const isLocalControlPlaneUpstream = (): boolean => { | |
| 12 | − const upstream = trim(process.env.CONTROL_PLANE_UPSTREAM_URL) ?? "http://127.0.0.1:8788"; | |
| 13 | − | |
| 14 | − try { | |
| 15 | − const url = new URL(upstream); | |
| 16 | − return ( | |
| 17 | − url.hostname === "127.0.0.1" | |
| 18 | − || url.hostname === "localhost" | |
| 19 | − || url.hostname === "0.0.0.0" | |
| 20 | − || url.hostname === "::1" | |
| 21 | − || url.hostname === "[::1]" | |
| 22 | − ); | |
| 23 | − } catch { | |
| 24 | − return false; | |
| 25 | − } | |
| 26 | −}; | |
| 27 | − | |
| 28 | 6 | export const isWorkosEnabled = (): boolean => { |
| 29 | − if (isTruthy(process.env.WORKOS_FORCE_ENABLED)) { | |
| 30 | − return Boolean(trim(process.env.WORKOS_CLIENT_ID) && trim(process.env.WORKOS_API_KEY)); | |
| 31 | − } | |
| 32 | − | |
| 33 | − if (isLocalControlPlaneUpstream()) { | |
| 34 | − return false; | |
| 35 | − } | |
| 36 | − | |
| 37 | − return Boolean(trim(process.env.WORKOS_CLIENT_ID) && trim(process.env.WORKOS_API_KEY)); | |
| 7 | + return Boolean( | |
| 8 | + trim(process.env.WORKOS_CLIENT_ID) && trim(process.env.WORKOS_API_KEY), | |
| 9 | + ); | |
| 38 | 10 | }; |
| 39 | 11 | |
| 40 | 12 | export const externalOriginFromRequest = (request: Request): string => { |
| @@ -39,13 +39,10 @@ CONVEX_SITE_URL=https://your-deployment.convex.site · 38 unmodified lines | ||
| 39 | 39 | # Reuses CLOUDFLARE_SANDBOX_RUN_URL and CLOUDFLARE_SANDBOX_AUTH_TOKEN from the runtime config. |
| 40 | 40 | |
| 41 | 41 | # ── WorkOS (optional — enables auth, omit for anonymous mode) ── |
| 42 | −# WorkOS auth is auto-disabled when CONTROL_PLANE_UPSTREAM_URL points to local PM | |
| 43 | −# (localhost/127.0.0.1/0.0.0.0/::1) unless you force it on with WORKOS_FORCE_ENABLED=1. | |
| 44 | 42 | # WORKOS_CLIENT_ID=client_... |
| 45 | 43 | # WORKOS_API_KEY=sk_test_... |
| 46 | 44 | # WORKOS_COOKIE_PASSWORD=<32+ char random string, e.g. openssl rand -base64 32> |
| 47 | 45 | # WORKOS_WEBHOOK_SECRET=... |
| 48 | −# WORKOS_FORCE_ENABLED=1 | |
| 49 | 46 | # WorkOS Vault script helpers (optional): |
| 50 | 47 | # WORKOS_VAULT_OBJECT_ID=secret_... |
| 51 | 48 | # WORKOS_VAULT_CONTEXT_JSON={"workspace_id":"local"} |