Repository navigation
Support Workers identity bindings and caller runtime types - #465
irvinebroque wants to merge 41 commits into
Conversation
Pin the SDK packages to 40ff3ab so configuration, development sessions, and deployment share the reviewed audience validation. Keep the dependency integrity lock and supply-chain policy enabled.
Pin the reviewed Workers SDK prerelease for fixed audiences, fresh grants and signed fetch. Preserve development auth-profile forwarding and update config tests and release notes.
commit: |
|
LGTM |
|
| mean | stddev | min | max | |
|---|---|---|---|---|
| PR | 279.7 ms | 4.0 ms | 272.8 ms | 288.0 ms |
| base | 278.3 ms | 4.2 ms | 271.8 ms | 286.7 ms |
Δ (PR vs base): ↑ +1.5 ms (+0.5%)
Measured with hyperfine on ubuntu-latest (3 warmup runs, 20 timed runs). CI numbers carry ±a few ms of runner jitter; treat small deltas as noise.
|
LGTM! |
Remove identity-specific local auth profile forwarding. Consume matching SDK packages with explicit unsupported local methods and deployed Preview support. Preserve identity configuration and upload validation.
irvinebroque
changed the title
|
LGTM! |
![ask-bonk[bot]](https://avatars.githubusercontent.com/in/2454580?s=60&v=4){kind=small}
|
🤖 I've done a thorough review of your PR. Pins the Workers SDK previews and adds identity binding configuration/type tests.
|
|
No new concerns since the last review |
|
No new concerns since the last review |
|
No new concerns since the last review |
irvinebroque
changed the title
|
No new concerns since the last review |
|
Review: 1 findings. 🤖 I've done a thorough review of your PR. Pins Workers SDK previews and adds identity binding/type coverage.
|
Keep the actual runtime type generator and upload metadata coverage. Generic type-generation tests already cover the removed mocked and import-only cases. Direct signer bindings need no workers_oidc flag.
|
LGTM |
| expect( | ||
| requests.some( | ||
| (r) => | ||
| r.includes("auth.example.com") || r.includes("api.example.com") | ||
| ) | ||
| ).toBe(false); |
There was a problem hiding this comment.
This assertion only excludes the configured authorization/resource hosts. Identity provisioning calls use the Cloudflare API host, so a regression that provisions identities despite --no-provision would still pass. Include the known OIDC provisioning paths in the recorded-request check.
| expect( | |
| requests.some( | |
| (r) => | |
| r.includes("auth.example.com") || r.includes("api.example.com") | |
| ) | |
| ).toBe(false); | |
| expect( | |
| requests.some( | |
| (r) => | |
| r.includes("auth.example.com") || | |
| r.includes("api.example.com") || | |
| /\/oidc\/(identities|assignments|development_sessions)/.test(r) | |
| ) | |
| ).toBe(false); |
|
Review: 1 findings. 🤖 I've done a thorough review of your PR. Pins matching Workers SDK previews and adds managed OAuth Web Bot Auth coverage.
|
| it.each([false, true])( | ||
| "uploads identity binding metadata (signing only: %s)", | ||
| async (signingOnly) => { | ||
| const upload = mockWorkerUpload(); |
There was a problem hiding this comment.
The parameterized test no longer records requests, so both identity variants can make /oidc/identities, /oidc/assignments, or /oidc/development_sessions calls despite --no-provision and still pass. Restore that assertion here, rather than relying on the separate managed-OAuth case.
| const upload = mockWorkerUpload(); | |
| const requests = recordRequests(); | |
| const upload = mockWorkerUpload(); | |
| await seed({ | |
| ".cloudflare/output/v0/config.json": buildOutputRootConfig(), | |
| ".cloudflare/output/v0/workers/default/worker.config.json": | |
| workerConfig({ | |
| env: { | |
| ORDERS: { | |
| type: "identity", | |
| ...(signingOnly | |
| ? { | |
| request_signing: { | |
| allowed_origins: ["https://api.example.com"], | |
| allowed_methods: ["GET"], | |
| }, | |
| } | |
| : { audience: "urn:orders" }), | |
| }, | |
| REPORTS: { | |
| type: "identity", | |
| audience: "recipient", | |
| }, | |
| }, | |
| }), | |
| ".cloudflare/output/v0/workers/default/bundle/index.js": | |
| "export default {fetch() {return new Response('ok')}}", | |
| }); | |
| const { exitCode } = await runCf([ | |
| "deploy", | |
| "--prebuilt", | |
| "--no-provision", | |
| ]); | |
| expect(exitCode).toBe(0); | |
| expect(upload.metadata?.bindings).toEqual( | |
| expect.arrayContaining([ | |
| { | |
| name: "ORDERS", | |
| type: "identity", | |
| ...(signingOnly | |
| ? { | |
| request_signing: { | |
| allowed_origins: ["https://api.example.com"], | |
| allowed_methods: ["GET"], | |
| }, | |
| } | |
| : { audience: "urn:orders" }), | |
| }, | |
| { | |
| name: "REPORTS", | |
| type: "identity", | |
| audience: "recipient", | |
| }, | |
| ]) | |
| ); | |
| expect( | |
| requests.some((request) => | |
| /\/oidc\/(identities|assignments|development_sessions)/.test(request) | |
| ) | |
| ).toBe(false); |
|
Review: 1 findings. 🤖 I've done a thorough review of your PR. Pins matching Workers SDK previews and adds identity binding and managed OAuth coverage.
|
|
No new concerns since the last review |
|
No new concerns since the last review |
|
|
||
| Support experimental Worker identity bindings | ||
|
|
||
| Consume SDK support for fixed token audiences, independent grant/signing limits, and direct JSRPC `getIdentity(label?)` handles with asynchronous metadata and normal forwarding/disposal. Select a handle before fetching; normalize URL, FormData, and URLSearchParams inputs with `new Request(...)`. Local issuance remains unsupported, so use mocks or deployed Previews. AbortSignal transport and cross-RPC cancellation are outside the contract. |
There was a problem hiding this comment.
This release note still tells users that local issuance is unsupported, but the new local-identity-development changeset and README both advertise the matching SDK's fully local issuance flow. That leaves the same release with contradictory guidance and directs users away from a supported workflow.
| Consume SDK support for fixed token audiences, independent grant/signing limits, and direct JSRPC `getIdentity(label?)` handles with asynchronous metadata and normal forwarding/disposal. Select a handle before fetching; normalize URL, FormData, and URLSearchParams inputs with `new Request(...)`. Local issuance remains unsupported, so use mocks or deployed Previews. AbortSignal transport and cross-RPC cancellation are outside the contract. | |
| Consume SDK support for fixed token audiences, independent grant/signing limits, and direct JSRPC `getIdentity(label?)` handles with asynchronous metadata and normal forwarding/disposal. Select a handle before fetching; normalize URL, FormData, and URLSearchParams inputs with `new Request(...)`. Local issuance requires the matching project-installed development server; it uses a `.test` issuer without Cloudflare credentials or network issuance. AbortSignal transport and cross-RPC cancellation are outside the contract. |
|
|
||
| Use automatic DPoP for managed identity OAuth | ||
|
|
||
| Consume the matching SDK schema without public DPoP policy settings. Preserve policy-free OAuth configuration through type generation and deployment, and keep local issuance unsupported. |
There was a problem hiding this comment.
This second release note says local issuance remains unsupported even though this PR's local-identity changeset and README state that configured OAuth participates in fully local issuance. Keep the release notes consistent about the required matching project SDK.
| Consume the matching SDK schema without public DPoP policy settings. Preserve policy-free OAuth configuration through type generation and deployment, and keep local issuance unsupported. | |
| Consume the matching SDK schema without public DPoP policy settings. Preserve policy-free OAuth configuration through type generation and deployment, and support local issuance through a matching project-installed development server. |
|
|
||
| Publish a matching workerd and SDK/runtime-types release containing workerd | ||
| PR #8121 before advertising local receiver support. Source declarations alone | ||
| do not supply runtime behavior. Local sender issuance remains unsupported. |
There was a problem hiding this comment.
The local-sender statement contradicts the new local-identity changeset and README, which document fully local issuance when cf dev delegates to a project installation using the matching SDK prototype. It should describe that prerequisite rather than mark the flow unsupported.
| do not supply runtime behavior. Local sender issuance remains unsupported. | |
| do not supply runtime behavior. Local sender issuance requires a matching project-installed development server. |
|
Review: 1 findings. 🤖 I've done a thorough review of your PR. Pins matching Workers SDK previews and adds identity binding coverage.
|
Support identity configuration, deployment/version upload, type generation, connectors and local development through existing CLI workflows. Keep protocol mechanics in shared SDK utilities.
Customers configure flat
callerIdentity: { profile, accountTokens: { issuer, audience } }, runcf dev, then callctx.identity.caller()and apply application access rules. Optional camelCase overrides and signed-out-onlycompanyIdremain supported; matching-tooling requirements sit in the prototype notice.Head
9e28cd110bfbae95bb3310c2c1d51343489167d8adds stored-secret identity configuration/type and mocked prebuilt-deployment qualification plus matching local setup guidance. Customers keep the existing identity binding and runtime API; secret values and managed tokens remain private.Local
pnpm checkpassed all seven root tasks. The focused types/deploy suites passed 58 tests using an explicit matching-source SDK overlay. A fresh-state actual CLI run provisioned a local synthetic secret, startedcf dev, discovered a local provider and returnedstored-secret-local-okfrom the protected API. The overlay/loader are qualification adapters for unpublished source, not released installation instructions.All ten published SDK dependency pins and the lockfile still reference the earlier
0434f088c03f1388239e642eedc10923713284f7cohort. The new source cohort is SDK4eb4a757483c645139315aa0e93d154b68df26dfand service301b86de4c475518f7506c8288209b1869fd1907. Publish matching artifacts before changing versions and lockfile integrity; the installed published graph does not yet include this extension. Existing dependency policies, patches and the independent Forge pin remain intact.Customer contract · Stored-secret plan · Matched source manifest · Local validation and limits
Companions: runtime #8121, SDK #16455, cf #465.
Experimental draft. Local testing is the acceptance basis; production/hosted provenance, interoperability/security, cross-colo replay, capacity and rollout qualification remain separate. Production enablement remains off.