Re-wire auth to use a provider pattern. Lots of tests remove cloud references#3230
Merged
GiantRobots merged 11 commits intomainfrom Mar 25, 2026
Merged
Re-wire auth to use a provider pattern. Lots of tests remove cloud references#3230GiantRobots merged 11 commits intomainfrom
GiantRobots merged 11 commits intomainfrom
Conversation
…weirdness in control flow.
…ve single points of access
GiantRobots
requested review from
a team,
Alex-Tideman and
rossedfort
as code owners
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![temporal-cicd[bot]](https://avatars.githubusercontent.com/in/357945?s=60&v=4){kind=small}
| settings, | ||
| accessToken, | ||
| }); | ||
|
|
Contributor
There was a problem hiding this comment.
⚠️ Argument of type 'EventAttribute | IFailure | PotentiallyDecodable' is not assignable to parameter of type 'Optional<WorkflowEvent | EventAttribute | PotentiallyDecodable>'.
| accessToken, | ||
| }); | ||
|
|
||
| const decodedAttributes = decodeAttributes( |
Contributor
There was a problem hiding this comment.
⚠️ Argument of type 'EventAttribute | IFailure | PotentiallyDecodable' is not assignable to parameter of type 'Optional<WorkflowEvent | EventAttribute | PotentiallyDecodable>'.
| settings, | ||
| accessToken, | ||
| ); | ||
|
|
Contributor
There was a problem hiding this comment.
⚠️ Object is possibly 'null' or 'undefined'.⚠️ Object is possibly 'null' or 'undefined'.
| accessToken, | ||
| ); | ||
|
|
||
| expect(decodedHeartbeatDetails[0].heartbeatDetails.payloads[0]).toBe(2); |
Contributor
There was a problem hiding this comment.
⚠️ Object is possibly 'null' or 'undefined'.⚠️ Object is possibly 'null' or 'undefined'.
| headers['Authorization-Extras'] = accessTokenExtras; | ||
| const accessToken = await getAccessToken(); | ||
| const idToken = await getIdToken(); | ||
| if (accessToken) { |
Contributor
There was a problem hiding this comment.
⚠️ Element implicitly has an 'any' type because expression of type '"Authorization"' can't be used to index type '{ 'Content-Type': string; 'X-Namespace': string; }'.
| if (accessToken) { | ||
| headers['Authorization'] = `Bearer ${accessToken}`; | ||
| } | ||
| if (idToken) { |
Contributor
There was a problem hiding this comment.
⚠️ Element implicitly has an 'any' type because expression of type '"Authorization-Extras"' can't be used to index type '{ 'Content-Type': string; 'X-Namespace': string; }'.
Contributor
|
| settings, | ||
| $authUser.accessToken, | ||
| ); | ||
| const decodedAttributes = decodePayloadAttributes( |
Contributor
There was a problem hiding this comment.
⚠️ Argument of type 'WorkflowEvent | EventAttribute | IMemo | PotentiallyDecodable' is not assignable to parameter of type 'Optional<WorkflowEvent | EventAttribute | PotentiallyDecodable>'.
…Re-wire with-access-token to use pre/post hooks so code paths can be determined by the caller. Lots of tests
GiantRobots
changed the title
…tions as well as a few others
|
|
||
| const settings: Settings = { | ||
| auth: { | ||
| enabled: false, |
Contributor
There was a problem hiding this comment.
⚠️ Type 'null' is not assignable to type 'string[]'.
andrewzamojc
approved these changes
Mar 24, 2026
Contributor
andrewzamojc
left a comment
andrewzamojc
left a comment
There was a problem hiding this comment.
Code looks good. The new way makes sense and cleans up the calling code nicely. Tons of tests 👍 I can manually test next.
| } | ||
|
|
||
| export async function getAccessToken(): Promise<string> { | ||
| if (!BROWSER || !provider) return ''; |
Contributor
There was a problem hiding this comment.
silent, but seems fine.
| ): Promise<string> { | ||
| const settings = page.data?.settings; | ||
| return getCodecEndpoint(settings); | ||
| } |
Collaborator
Author
There was a problem hiding this comment.
This is approximately how we do it now. I very much dislike how we use a store and push it down by setting it in the page it's VERY VERY side effecty so this is step1 in changing it.
| let response = await executeRequest(context); | ||
|
|
||
| if (isBrowser) { | ||
| response = await runPostResponse(response, { |
rossnelson
approved these changes
Mar 24, 2026
Collaborator
rossnelson
left a comment
rossnelson
left a comment
There was a problem hiding this comment.
LGTM! I tested using the local oidc server and all looks good.
Side Note: I've got a follow-up draft PR (#3248) that adds redirect-to-login when refreshTokens returns false in ossPostResponse — that behavior was missing for requests that bypass handleError (e.g. background workflow count polls).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR updates the auth code in request-from-api to use dependency injection and middleware instead of the current if based approach for injecting different authentication strategies for other providers specifically temporal cloud.
This allows auth to be swapped wholesale without implementation leakage around the project and consolidating request/response wrappers also ensuring a single implementation is being used throughout (there were previously some edge cases where two sets of authnz code would be executed)