Skip to content

Commit 859bbc0

Browse files
nathanclevengerclaude
nathanclevenger
and
claude
committed
chore: sync beads — close oauth.do-0zp, oauth.do-0p8x, oauth.do-tzss
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent ea25980 commit 859bbc0

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

‎.beads/issues.jsonl‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33
{"id":"oauth.do-070","title":"Break up server.ts monolith into separate modules","description":"core/src/server.ts is 1,781 lines containing all OAuth server logic. Extract authorization endpoint, token endpoint, callback handler, client registration, and helpers into separate Hono route group modules for testability and maintainability.","status":"closed","priority":2,"issue_type":"task","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-01T15:41:56.498979-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-08T07:28:11.883883-06:00","closed_at":"2026-02-08T07:28:11.883883-06:00","close_reason":"Implemented: token race fix, server.ts breakup, integration tests"}
44
{"id":"oauth.do-085","title":"Acceptance Criteria","description":"- Tests for JWT verification with valid/invalid/expired tokens","status":"closed","priority":2,"issue_type":"task","created_at":"2026-02-01T15:38:15.746932-06:00","updated_at":"2026-02-01T15:40:05.642525-06:00","closed_at":"2026-02-01T15:40:05.642525-06:00","close_reason":"Closed"}
55
{"id":"oauth.do-0od","title":"Acceptance Criteria","description":"- README example correctly demonstrates the API","status":"closed","priority":2,"issue_type":"task","created_at":"2026-02-01T15:38:15.75418-06:00","updated_at":"2026-02-01T15:40:03.970279-06:00","closed_at":"2026-02-01T15:40:03.970279-06:00","close_reason":"Closed"}
6-
{"id":"oauth.do-0p8x","title":"Remove dead WorkOS /users/me fallback code","description":"In workers/auth/index.ts lines 367-390, sk_* API keys are verified by calling WorkOS /users/me with the user's key as Bearer token. But /users/me requires a session access token, not an API key — this fallback always fails silently. Also, env.WORKOS_API_KEY is checked but never used in the fetch call. Remove the dead fallback or replace with correct WorkOS API key validation.","status":"open","priority":1,"issue_type":"bug","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-23T05:22:00.959207-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-23T05:22:00.959207-06:00"}
6+
{"id":"oauth.do-0p8x","title":"Remove dead WorkOS /users/me fallback code","description":"In workers/auth/index.ts lines 367-390, sk_* API keys are verified by calling WorkOS /users/me with the user's key as Bearer token. But /users/me requires a session access token, not an API key — this fallback always fails silently. Also, env.WORKOS_API_KEY is checked but never used in the fetch call. Remove the dead fallback or replace with correct WorkOS API key validation.","status":"closed","priority":1,"issue_type":"bug","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-23T05:22:00.959207-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-23T06:10:01.55116-06:00","closed_at":"2026-02-23T06:10:01.55116-06:00","close_reason":"Fixed: Removed dead verifyApiKey function and isWorkOSUserResponse type guard in auth-verifier delegation refactor."}
77
{"id":"oauth.do-0zhd","title":"Consolidate AuthUser and VerifyResult to canonical types","description":"AuthUser is defined independently in 4 locations (src/types.ts, workers/auth/index.ts, workers/auth/src/types.ts, and id.org.ai). VerifyResult is a proper discriminated union in src/rpc.ts but a loose { valid: boolean } in auth-verifier. Fix: (1) all modules should import AuthUser from oauth.do/rpc canonical source, (2) auth-verifier VerifyResult should use the discriminated union type, (3) remove all local duplicate definitions.","status":"open","priority":1,"issue_type":"task","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-23T05:21:57.210867-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-23T05:21:57.210867-06:00"}
8-
{"id":"oauth.do-0zp","title":"Fix session token delegation to use RPC instead of HTTP /verify","description":"auth-verifier delegates ses_/oai_/hly_sk_ tokens via env.OAUTH.fetch('/verify') (workers/auth/index.ts line 440), but id.org.ai has no /verify POST endpoint. After Phase 5 when id.org.ai takes the 'oauth' name, this delegation will fail for all session and API key tokens. Fix: either (a) add /verify POST to id.org.ai, or (b) change OAUTH binding to use AuthService entrypoint and call verifyToken() via RPC (preferred). The wrangler.jsonc OAUTH binding also needs an entrypoint specified.","status":"open","priority":1,"issue_type":"bug","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-23T05:21:46.41376-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-23T05:21:46.41376-06:00"}
8+
{"id":"oauth.do-0zp","title":"Fix session token delegation to use RPC instead of HTTP /verify","description":"auth-verifier delegates ses_/oai_/hly_sk_ tokens via env.OAUTH.fetch('/verify') (workers/auth/index.ts line 440), but id.org.ai has no /verify POST endpoint. After Phase 5 when id.org.ai takes the 'oauth' name, this delegation will fail for all session and API key tokens. Fix: either (a) add /verify POST to id.org.ai, or (b) change OAUTH binding to use AuthService entrypoint and call verifyToken() via RPC (preferred). The wrangler.jsonc OAUTH binding also needs an entrypoint specified.","status":"closed","priority":1,"issue_type":"bug","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-23T05:21:46.41376-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-23T06:10:01.465022-06:00","closed_at":"2026-02-23T06:10:01.465022-06:00","close_reason":"Fixed: OAUTH binding now points to auth#AuthService (id.org.ai) via RPC instead of HTTP fetch to oauth.do. E2E verified: provision → ses_ token → auth-verifier → id.org.ai → success."}
99
{"id":"oauth.do-107","title":"TDD Subtasks","description":"- [ ] RED: Write test that request from unknown origin gets no CORS headers","status":"closed","priority":2,"issue_type":"task","created_at":"2026-02-01T15:38:15.743027-06:00","updated_at":"2026-02-01T15:40:06.470921-06:00","closed_at":"2026-02-01T15:40:06.470921-06:00","close_reason":"Closed"}
1010
{"id":"oauth.do-11s","title":"Acceptance Criteria","description":"- At least 2 working example projects","status":"closed","priority":2,"issue_type":"task","created_at":"2026-02-01T15:38:15.754731-06:00","updated_at":"2026-02-01T15:40:03.859781-06:00","closed_at":"2026-02-01T15:40:03.859781-06:00","close_reason":"Closed"}
1111
{"id":"oauth.do-15c","title":"Add auth worker tests","description":"workers/auth/index.ts (17KB) has ZERO tests. It handles JWT verification, API key verification, cookie sessions, and caching.\n\nTDD Subtasks:\n- RED: Test valid JWT returns valid=true with correct user\n- RED: Test expired JWT returns valid=false\n- RED: Test API key (sk_) verification\n- RED: Test admin token verification\n- RED: Test authenticate() with Authorization header\n- RED: Test authenticate() with cookie\n- RED: Test cache hit returns cached=true\n- GREEN: Verify all pass against existing implementation","status":"closed","priority":1,"issue_type":"task","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-01T15:52:39.796637-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-01T16:46:20.859925-06:00","closed_at":"2026-02-01T16:46:20.859925-06:00","close_reason":"Completed in wave 9"}
@@ -162,7 +162,7 @@
162162
{"id":"oauth.do-t4zw","title":"Refactor JWKS caching to use map pattern","description":"auth-verifier uses 3 separate module-level variable pairs for JWKS caching. id.org.ai uses a single Map\u003cstring, { verifier, expiry }\u003e. The map-based approach is cleaner and scales better. Refactor auth-verifier to use map-based pattern.","status":"open","priority":3,"issue_type":"task","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-23T05:22:56.041428-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-23T05:22:56.041428-06:00"}
163163
{"id":"oauth.do-t7o","title":"Add tests for storage-do.ts","description":"core/src/storage-do.ts has ZERO test coverage. Data integrity critical: all CRUD operations for users, clients, tokens, auth codes in SQLite. Use a mock SqlStorage to test all operations and verify SQL parameterization.","status":"closed","priority":2,"issue_type":"task","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-01T15:42:09.829961-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-01T16:08:14.250908-06:00","closed_at":"2026-02-01T16:08:14.250908-06:00","close_reason":"Added comprehensive storage-do.test.ts with 40+ tests"}
164164
{"id":"oauth.do-trq","title":"TDD Subtasks","description":"- [ ] RED: Write test that POST /register without auth returns 401","status":"closed","priority":2,"issue_type":"task","created_at":"2026-02-01T15:38:15.741856-06:00","updated_at":"2026-02-01T15:40:06.70802-06:00","closed_at":"2026-02-01T15:40:06.70802-06:00","close_reason":"Closed"}
165-
{"id":"oauth.do-tzss","title":"Add session token delegation tests (ses_, oai_, hly_sk_)","description":"The verifyToken() function delegates ses_, oai_, hly_sk_ tokens to delegateToOAuth() via env.OAUTH.fetch(). No unit test covers the happy path. The OAUTH binding is absent in integration tests by design, so only the error path is tested. Add unit tests with mocked env.OAUTH that returns a valid VerifyResult for each token prefix.","status":"open","priority":2,"issue_type":"task","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-23T05:22:08.775297-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-23T05:22:08.775297-06:00"}
165+
{"id":"oauth.do-tzss","title":"Add session token delegation tests (ses_, oai_, hly_sk_)","description":"The verifyToken() function delegates ses_, oai_, hly_sk_ tokens to delegateToOAuth() via env.OAUTH.fetch(). No unit test covers the happy path. The OAUTH binding is absent in integration tests by design, so only the error path is tested. Add unit tests with mocked env.OAUTH that returns a valid VerifyResult for each token prefix.","status":"closed","priority":2,"issue_type":"task","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-23T05:22:08.775297-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-23T06:10:01.636568-06:00","closed_at":"2026-02-23T06:10:01.636568-06:00","close_reason":"Added 3 new tests: ses_ token delegation, missing OAUTH binding error, RPC failure handling. 26/26 tests pass."}
166166
{"id":"oauth.do-ufh","title":"TDD Subtasks","description":"- [ ] RED: Test valid access token returns `active: true` with metadata","status":"closed","priority":2,"issue_type":"task","created_at":"2026-02-01T15:38:15.748986-06:00","updated_at":"2026-02-01T15:40:05.181002-06:00","closed_at":"2026-02-01T15:40:05.181002-06:00","close_reason":"Closed"}
167167
{"id":"oauth.do-ukv","title":"Add worker integration tests with @cloudflare/vitest-pool-workers","description":"workers/oauth/ and workers/auth/ have ZERO tests. Add @cloudflare/vitest-pool-workers for miniflare-based testing. Test the full OAuth flow through the worker: discovery -\u003e register -\u003e authorize -\u003e callback -\u003e token -\u003e introspect -\u003e revoke. Test CORS headers and error responses.","status":"closed","priority":2,"issue_type":"task","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-01T15:42:09.967466-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-08T07:28:11.922835-06:00","closed_at":"2026-02-08T07:28:11.922835-06:00","close_reason":"Implemented: token race fix, server.ts breakup, integration tests"}
168168
{"id":"oauth.do-v5b","title":"Add Device Authorization Grant to @dotdo/oauth server","description":"Server only supports authorization_code and refresh_token. Device Authorization Grant (RFC 8628) needed for MCP where AI clients authenticate. TDD: RED - POST /device/code returns valid response; RED - polling returns authorization_pending; RED - successful auth returns tokens; RED - expired code returns error; GREEN - implement.","status":"closed","priority":1,"issue_type":"feature","owner":"4130910+nathanclevenger@users.noreply.github.com","created_at":"2026-02-01T15:39:18.440009-06:00","created_by":"Nathan Clevenger","updated_at":"2026-02-01T16:08:24.133208-06:00","closed_at":"2026-02-01T16:08:24.133208-06:00","close_reason":"Duplicate of oauth.do-vpy"}

0 commit comments

Comments
 (0)