Repository navigation
Support Workers identity bindings and caller runtime types - #465
irvinebroque wants to merge 28 commits into
Conversation
Pin the SDK packages to 40ff3ab so configuration, development sessions, and deployment share the reviewed audience validation. Keep the dependency integrity lock and supply-chain policy enabled.
Pin the reviewed Workers SDK prerelease for fixed audiences, fresh grants and signed fetch. Preserve development auth-profile forwarding and update config tests and release notes.
commit: |
|
LGTM |
|
| mean | stddev | min | max | |
|---|---|---|---|---|
| PR | 279.7 ms | 4.0 ms | 272.8 ms | 288.0 ms |
| base | 278.3 ms | 4.2 ms | 271.8 ms | 286.7 ms |
Δ (PR vs base): ↑ +1.5 ms (+0.5%)
Measured with hyperfine on ubuntu-latest (3 warmup runs, 20 timed runs). CI numbers carry ±a few ms of runner jitter; treat small deltas as noise.
|
LGTM! |
Remove identity-specific local auth profile forwarding. Consume matching SDK packages with explicit unsupported local methods and deployed Preview support. Preserve identity configuration and upload validation.
irvinebroque
changed the title
|
LGTM! |
![ask-bonk[bot]](https://avatars.githubusercontent.com/in/2454580?s=60&v=4){kind=small}
|
🤖 I've done a thorough review of your PR. Pins the Workers SDK previews and adds identity binding configuration/type tests.
|
|
No new concerns since the last review |
|
No new concerns since the last review |
|
No new concerns since the last review |
irvinebroque
changed the title
|
No new concerns since the last review |
|
Review: 1 findings. 🤖 I've done a thorough review of your PR. Pins Workers SDK previews and adds identity binding/type coverage.
|
Keep the actual runtime type generator and upload metadata coverage. Generic type-generation tests already cover the removed mocked and import-only cases. Direct signer bindings need no workers_oidc flag.
|
No new concerns since the last review |
|
LGTM |
|
LGTM |
Remove a provisioning assertion from a test that disables provisioning. Link the canonical caller contract and retain the cf runtime-types release requirement.
|
Review: 1 findings. Posted 1 inline warning suggestion. |
|
Review: 1 findings. 🤖 I've done a thorough review of your PR. Pins Workers SDK previews and adds identity binding/type documentation and coverage.
|
|
LGTM! |
|
LGTM |
| expect( | ||
| requests.some( | ||
| (r) => | ||
| r.includes("auth.example.com") || r.includes("api.example.com") | ||
| ) | ||
| ).toBe(false); |
There was a problem hiding this comment.
This assertion only excludes the configured authorization/resource hosts. Identity provisioning calls use the Cloudflare API host, so a regression that provisions identities despite --no-provision would still pass. Include the known OIDC provisioning paths in the recorded-request check.
| expect( | |
| requests.some( | |
| (r) => | |
| r.includes("auth.example.com") || r.includes("api.example.com") | |
| ) | |
| ).toBe(false); | |
| expect( | |
| requests.some( | |
| (r) => | |
| r.includes("auth.example.com") || | |
| r.includes("api.example.com") || | |
| /\/oidc\/(identities|assignments|development_sessions)/.test(r) | |
| ) | |
| ).toBe(false); |
|
Review: 1 findings. 🤖 I've done a thorough review of your PR. Pins matching Workers SDK previews and adds managed OAuth Web Bot Auth coverage.
|
| it.each([false, true])( | ||
| "uploads identity binding metadata (signing only: %s)", | ||
| async (signingOnly) => { | ||
| const upload = mockWorkerUpload(); |
There was a problem hiding this comment.
The parameterized test no longer records requests, so both identity variants can make /oidc/identities, /oidc/assignments, or /oidc/development_sessions calls despite --no-provision and still pass. Restore that assertion here, rather than relying on the separate managed-OAuth case.
| const upload = mockWorkerUpload(); | |
| const requests = recordRequests(); | |
| const upload = mockWorkerUpload(); | |
| await seed({ | |
| ".cloudflare/output/v0/config.json": buildOutputRootConfig(), | |
| ".cloudflare/output/v0/workers/default/worker.config.json": | |
| workerConfig({ | |
| env: { | |
| ORDERS: { | |
| type: "identity", | |
| ...(signingOnly | |
| ? { | |
| request_signing: { | |
| allowed_origins: ["https://api.example.com"], | |
| allowed_methods: ["GET"], | |
| }, | |
| } | |
| : { audience: "urn:orders" }), | |
| }, | |
| REPORTS: { | |
| type: "identity", | |
| audience: "recipient", | |
| }, | |
| }, | |
| }), | |
| ".cloudflare/output/v0/workers/default/bundle/index.js": | |
| "export default {fetch() {return new Response('ok')}}", | |
| }); | |
| const { exitCode } = await runCf([ | |
| "deploy", | |
| "--prebuilt", | |
| "--no-provision", | |
| ]); | |
| expect(exitCode).toBe(0); | |
| expect(upload.metadata?.bindings).toEqual( | |
| expect.arrayContaining([ | |
| { | |
| name: "ORDERS", | |
| type: "identity", | |
| ...(signingOnly | |
| ? { | |
| request_signing: { | |
| allowed_origins: ["https://api.example.com"], | |
| allowed_methods: ["GET"], | |
| }, | |
| } | |
| : { audience: "urn:orders" }), | |
| }, | |
| { | |
| name: "REPORTS", | |
| type: "identity", | |
| audience: "recipient", | |
| }, | |
| ]) | |
| ); | |
| expect( | |
| requests.some((request) => | |
| /\/oidc\/(identities|assignments|development_sessions)/.test(request) | |
| ) | |
| ).toBe(false); |
|
Review: 1 findings. 🤖 I've done a thorough review of your PR. Pins matching Workers SDK previews and adds identity binding and managed OAuth coverage.
|
|
No new concerns since the last review |
|
No new concerns since the last review |
|
|
||
| Support experimental Worker identity bindings | ||
|
|
||
| Consume SDK support for fixed token audiences, independent grant/signing limits, and direct JSRPC `getIdentity(label?)` handles with asynchronous metadata and normal forwarding/disposal. Select a handle before fetching; normalize URL, FormData, and URLSearchParams inputs with `new Request(...)`. Local issuance remains unsupported, so use mocks or deployed Previews. AbortSignal transport and cross-RPC cancellation are outside the contract. |
There was a problem hiding this comment.
This release note still tells users that local issuance is unsupported, but the new local-identity-development changeset and README both advertise the matching SDK's fully local issuance flow. That leaves the same release with contradictory guidance and directs users away from a supported workflow.
| Consume SDK support for fixed token audiences, independent grant/signing limits, and direct JSRPC `getIdentity(label?)` handles with asynchronous metadata and normal forwarding/disposal. Select a handle before fetching; normalize URL, FormData, and URLSearchParams inputs with `new Request(...)`. Local issuance remains unsupported, so use mocks or deployed Previews. AbortSignal transport and cross-RPC cancellation are outside the contract. | |
| Consume SDK support for fixed token audiences, independent grant/signing limits, and direct JSRPC `getIdentity(label?)` handles with asynchronous metadata and normal forwarding/disposal. Select a handle before fetching; normalize URL, FormData, and URLSearchParams inputs with `new Request(...)`. Local issuance requires the matching project-installed development server; it uses a `.test` issuer without Cloudflare credentials or network issuance. AbortSignal transport and cross-RPC cancellation are outside the contract. |
|
|
||
| Use automatic DPoP for managed identity OAuth | ||
|
|
||
| Consume the matching SDK schema without public DPoP policy settings. Preserve policy-free OAuth configuration through type generation and deployment, and keep local issuance unsupported. |
There was a problem hiding this comment.
This second release note says local issuance remains unsupported even though this PR's local-identity changeset and README state that configured OAuth participates in fully local issuance. Keep the release notes consistent about the required matching project SDK.
| Consume the matching SDK schema without public DPoP policy settings. Preserve policy-free OAuth configuration through type generation and deployment, and keep local issuance unsupported. | |
| Consume the matching SDK schema without public DPoP policy settings. Preserve policy-free OAuth configuration through type generation and deployment, and support local issuance through a matching project-installed development server. |
|
|
||
| Publish a matching workerd and SDK/runtime-types release containing workerd | ||
| PR #8121 before advertising local receiver support. Source declarations alone | ||
| do not supply runtime behavior. Local sender issuance remains unsupported. |
There was a problem hiding this comment.
The local-sender statement contradicts the new local-identity changeset and README, which document fully local issuance when cf dev delegates to a project installation using the matching SDK prototype. It should describe that prerequisite rather than mark the flow unsupported.
| do not supply runtime behavior. Local sender issuance remains unsupported. | |
| do not supply runtime behavior. Local sender issuance requires a matching project-installed development server. |
|
Review: 1 findings. 🤖 I've done a thorough review of your PR. Pins matching Workers SDK previews and adds identity binding coverage.
|
Preserve identity binding metadata in uploads and obtain identity types through the shared SDK/runtime packages. Managed OAuth supports WAG and client credentials with managed client assertions, plus independent raw assertion authority on the same selected handle. Customers call
getIdentity()and ordinaryidentity.fetch(); configuration fixes the authorization relationship and delivery limits.Use one automatic DPoP behavior: every token request carries a proof and accepts either DPoP or Bearer; the private signer uses the returned type for API authentication. Remove public
dpopandrequire_sender_constraintsettings from examples and consume the SDK schema that rejects them. Preserve policy-free OAuth through type generation, Build Output and upload without acquiring credentials. Optionaloauth.http_message_signatures: "web_bot_auth"works with either grant and token type, without new JavaScript methods. Local development runs the real signer, discovery, verifier and replay store with a separate.testissuer, generated keys andexecution: "local". It requires no cloud account or network issuance. The project-installed Wrangler or Vite server must use the matching SDK prototype; native reception also needs the companion runtime and opt-in flag.Pin all ten SDK preview dependencies to
7891d74, whose continuous prerelease succeeded with the automatic schema, validators and fully local authority. Keep the transitive tarball policy enabled: exact prototype sibling versions consume explicitly pinned direct dependencies through peer extensions. Remove those extensions when returning to published npm packages. Preserve existing container patches. New compiler OAuth capabilities use protected schema version 4; the signer preserves earlier compiled semantics internally.Validation of this revision:
pnpm checkpasses all seven tasks, including generation, builds, type checks, formatting and type-aware lint.No production deployment or credential acquisition by cf. Matched releases, protected roots, deployed egress/provider qualification and coordinated rollout remain production gates. Default-off controls remain in place.
Local signer source: draft MR !3, commit
1a59402. SDK commit7891d7402records generated bundle provenance. Acf devsmoke test with cloud credentials unset verifies a real JWT and signed POST, including the original body and native verified caller. Local scope covers one cooperating Worker graph; persisted identity and replay state share one owner. Independent processes need separate persistence roots. Documentation: existing internal docs MR !128.After an unclean runtime exit, stop every runtime using the state and remove its stale ownership lock. Keep authority material and replay records intact. The SDK regression test proves that startup never automatically steals a stale lock and that explicit recovery retains the same issuer.
Normal SIGINT/SIGTERM shutdown releases persisted ownership after synchronously requesting runtime termination. A subprocess regression check proves that restart retains the issuer. The real cf delegate also passes both signals with verified JWT/WBA requests, original request bodies and an actionable concurrent-owner error. SIGKILL or a crash still requires explicit stale-lock recovery.