Claude
c54cbf2596
Each venture's Worker can now sign people up and in with passkeys (WebAuthn): no passwords, no email, no OAuth app, nothing to configure. The relying party is the venture's own host and the session a __Host- cookie (HttpOnly, Secure, SameSite=Lax, 30 days), stored hashed in the venture's D1 database. ES256 and RS256 keys; challenges are single-use and expire in five minutes; origin, relying party, user presence and the signature counter are checked; auth endpoints refuse cross-origin calls. Items saved while signed in are recorded as that person's, and /api/me/items lists them. time.js gains Time.accounts, user, signUp, signIn, signOut and mine; builds are told to use them for what the paid tier promises and never to put sign-in in front of the free product. test_auth.mjs runs the whole ceremony against a real SQLite and a software authenticator, including replay, phishing origin, another site's passkey, a cloned counter, a tampered signature and a duplicate registration; CI pins node 22 so it runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wyb3QQDESFkosKRXzrXqwr
49 lines
2.6 KiB
YAML
49 lines
2.6 KiB
YAML
name: update
|
|
# Pull a fresh Time engine from the central repo and open a PR with the diff (weekly, or run it by hand).
|
|
# Upstream: TIME_UPSTREAM (default teahubxyz/time) at TIME_CHANNEL (default main; pin a tag like v1 for stability).
|
|
# Workflow files can't be changed by Actions' own token, so if those differ the PR lists them for a human to copy.
|
|
on:
|
|
schedule:
|
|
- cron: "17 9 * * 1"
|
|
workflow_dispatch:
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
jobs:
|
|
update:
|
|
if: github.repository != (vars.TIME_UPSTREAM || 'teahubxyz/time')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 3
|
|
env:
|
|
UPSTREAM: ${{ vars.TIME_UPSTREAM || 'teahubxyz/time' }}
|
|
CHANNEL: ${{ vars.TIME_CHANNEL || 'main' }}
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- run: git clone -q --depth 1 --branch "$CHANNEL" "https://github.com/$UPSTREAM" /tmp/up
|
|
- name: copy engine, open PR if changed
|
|
run: |
|
|
set -e
|
|
for f in .github/time/time.py .github/time/venture.py .github/time/cloudflare.py .github/time/cloudflare/worker.js .github/time/cloudflare/time.js .github/time/cloudflare/test_worker.mjs .github/time/cloudflare/test_auth.mjs .github/time/test_time.py .github/time/seats.json .github/ISSUE_TEMPLATE/early-access.yml .claude/skills/time/SKILL.md; do
|
|
mkdir -p "$(dirname "$f")"; cp "/tmp/up/$f" "$f"
|
|
done
|
|
python3 .github/time/test_time.py > /dev/null
|
|
wf=$(for f in /tmp/up/.github/workflows/*.yml; do b=.github/workflows/$(basename "$f"); cmp -s "$f" "$b" || echo "- \`$b\`"; done)
|
|
if git diff --quiet && [ -z "$(git status --porcelain .github/time)" ]; then
|
|
echo "Time engine is up to date." | tee -a "$GITHUB_STEP_SUMMARY"
|
|
[ -n "$wf" ] && printf 'Workflow files differ upstream, copy by hand:\n%s\n' "$wf" | tee -a "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
sha=$(git -C /tmp/up rev-parse --short HEAD)
|
|
branch="time-update-$sha"
|
|
git switch -c "$branch"
|
|
git add .github/time .github/ISSUE_TEMPLATE .claude/skills/time
|
|
git -c user.name=time -c user.email=time@users.noreply.github.com commit -qam "Update Time to $UPSTREAM@$sha"
|
|
git push -q origin "$branch"
|
|
body="Fresh Time engine from \`$UPSTREAM@$CHANNEL\` ($sha). Offline tests pass."
|
|
[ -n "$wf" ] && body="$body
|
|
|
|
These workflow files differ upstream. Actions can't edit workflows, so copy them by hand from https://github.com/$UPSTREAM/tree/$CHANNEL/.github/workflows:
|
|
$wf"
|
|
gh pr create --title "Update Time ($sha)" --body "$body" --head "$branch"
|