mirror of
https://github.com/hanzoai/id-worker.git
synced 2026-10-30 18:33:58 +00:00
zeekayandGitHub
5ed75779e8
* corona→corona: academic Corona now only in lp-220-p3q-corona
* chore: restore upstream attribution + NOTICE (OSS compliance)
* auth: migrate front-door worker IAM calls to canonical /v1/iam/*
Every IAM-targeted path the hanzo.id/lux.id/zoo.id/pars.id front-door
worker emits now uses the canonical /v1/iam/* surface (HIP-0111), off the
legacy /api/*, /login/oauth/*, and bare /oauth/* shapes. Proven against
the IAM router: PathRewriteFilter collapses /api/<ep>->/v1/iam/<ep> and
the oauth aliases ->/v1/iam/oauth/<ep>; every target route exists.
Emitted-path changes (worker.js):
- inline login JS: /api/get-app-login->/v1/iam/get-app-login;
social ->/v1/iam/oauth/authorize; password+web3 ->/v1/iam/login
- inline signup JS: get-app-login, social ->/v1/iam/oauth/authorize;
web3 ->/v1/iam/login; /api/signup->/v1/iam/signup
- inline forgot JS: get-app-login; /api/send-verification-code
->/v1/iam/send-verification-code
- platform+MPC IAM callback token exchange: /api/login/oauth/access_token
->/v1/iam/oauth/token
- /oauth/{token,introspect,revoke,userinfo,logout} public facades now hop
to /v1/iam/oauth/{token,introspect,revoke,userinfo,logout} internally
- /callback social handler: /api/login->/v1/iam/login
- provider-aware authorize handler now matches the canonical
/v1/iam/oauth/authorize (and legacy /login/oauth/authorize), targets
IAM /v1/iam/oauth/authorize, keeps the _oauth_ctx cookie + branded page
- /logout: /api/logout->/v1/iam/logout
Kept (worker public contract; IAM canonicalizes inbound): the worker own
/oauth/* facade routes, the OIDC discovery rewrite, and IAM_PATHS legacy
inbound tolerance. Untouched (separate concern, flagged): the github.com
platform OAuth bridge.
Verified per brand (hanzo/lux/zoo/pars) with Playwright network
interception against worker.js under workerd (wrangler dev, local):
login renders -> password POST hits /v1/iam/login -> Google button
-> /v1/iam/oauth/authorize?provider=provider-google; zero /api/* and
zero bare /oauth/authorize across the session. /oauth/token facade probe
returns IAM token-endpoint JSON (invalid_client), proving the
/v1/iam/oauth/token hop is live. 36/36 + 7/7 checks pass.
---------
Co-authored-by: zeekay <[email protected]>
47 lines
1.7 KiB
TOML
47 lines
1.7 KiB
TOML
name = "hanzo-id"
|
|
main = "src/worker.js"
|
|
compatibility_date = "2024-01-01"
|
|
|
|
# All IAM login domains route through this single worker.
|
|
# The worker resolves org-specific branding from the request hostname.
|
|
# DNS must be proxied through Cloudflare (orange cloud) for each domain.
|
|
routes = [
|
|
{ pattern = "hanzo.id/*", zone_name = "hanzo.id" },
|
|
{ pattern = "lux.id/*", zone_name = "lux.id" },
|
|
{ pattern = "pars.id/*", zone_name = "pars.id" },
|
|
{ pattern = "iam.lux.network/*", zone_name = "lux.network" },
|
|
{ pattern = "id.lux.network/*", zone_name = "lux.network" },
|
|
{ pattern = "id.zoo.network/*", zone_name = "zoo.network" },
|
|
]
|
|
|
|
[vars]
|
|
# IAM backend (consumed via `env.IAM_ORIGIN` with fallback to the module-level
|
|
# constant — see worker.js).
|
|
IAM_ORIGIN = "https://iam.hanzo.ai"
|
|
|
|
# Default org slug when the hostname has no tenant catalog entry.
|
|
IAM_DEFAULT_ORG = "hanzo"
|
|
|
|
# Tenant catalog (env-driven, NOT hardcoded in source). Maps request
|
|
# hostnames to `{ orgId, iamUrl?, clientId?, ... }` overrides. Same JSON
|
|
# schema as the Next.js side (`lib/config.ts::TenantConfig`); only `orgId`
|
|
# is consumed by this worker. To rotate tenants, edit this var (or use
|
|
# `wrangler secret put IAM_TENANT_CONFIG_JSON` for non-public catalogs)
|
|
# and redeploy — no source change.
|
|
IAM_TENANT_CONFIG_JSON = """
|
|
{
|
|
"hanzo.id": { "orgId": "hanzo" },
|
|
"lux.id": { "orgId": "lux" },
|
|
"id.lux.network": { "orgId": "lux" },
|
|
"iam.lux.network":{ "orgId": "lux" },
|
|
"zoo.id": { "orgId": "zoo" },
|
|
"id.zoo.network": { "orgId": "zoo" },
|
|
"id.zoo.ngo": { "orgId": "zoo" },
|
|
"pars.id": { "orgId": "pars" },
|
|
"id.pars.network":{ "orgId": "pars" }
|
|
}
|
|
"""
|
|
|
|
# Proxy to the Pages deployment for the marketing site
|
|
MARKETING_ORIGIN = "https://hanzo-id.pages.dev"
|