Claude/cloudflare deployment plan lumow6 - #33
Merged
Conversation
Introduce named Wrangler environments and a CI-gated deploy workflow so pushes to `cert` deploy the cert Worker and (in the future) pushes to `main` deploy a separate production Worker. - wrangler.jsonc: top-level config is now the local "dev" environment (drops the unused `database_id`, since local dev runs with `--local`). Add `env.cert` (Worker `frc-design-app-cert`, reuses the existing remote D1/KV/R2) and `env.production` (Worker `frc-design-app-production`, with placeholder resource IDs to be filled in once prod resources exist). - onshape-api.ts: hardcode the Onshape API base path and version as constants (identical across environments) instead of repeating them as per-environment vars. Only `ADMIN_TEAM` remains a var. - deploy.yml: new workflow. Runs tsc/lint/test, then deploys the matching environment via cloudflare/wrangler-action. The Vite plugin selects the target env at build time via CLOUDFLARE_ENV; migrations run with `--env`. Production runs in a protected GitHub Environment and is dormant until a `main` branch exists. - ci.yml: drop the redundant push-to-cert trigger (now covered by deploy). - vite.config.ts: only enable the HTTPS dev server when the mkcert files exist, so `vite build` works in CI where they are absent. - package.json: replace `deploy` with `deploy:cert` / `deploy:production`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EdsRyJRctf2K3v73QdtgGo
Onshape access tokens are company-scoped, but the app previously ignored the `sessionCompanyId` the Onshape iframe passes on `/init`, so a user who authorized in one context could end up with a token scoped to the wrong company (or personal) when opening another company's document. - isAuthenticated now fetches session info (which also serves as the auth ping) and compares the token's company (`sessioninfo.company.id`, null = personal "cad") against the request's `sessionCompanyId`. On a mismatch it returns false, so `/init` restarts the sign-in flow. - Every token request now passes `company_id` to the OAuth token endpoint via a `companyTokenEndpoint` helper — for both the authorization-code exchange in doCallback and refreshes in getOnshapeApiForSessionId — so the minted token is company-scoped. - The requested company is captured at sign-in (from the request or the `/init` redirectUrl) into the login session, and persisted onto the stored tokens so refreshes keep the scope. - Type getSessionInfo with a SessionInfo interface exposing `company.id`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EdsRyJRctf2K3v73QdtgGo
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix deployment issues