Claude
c54cbf2596
Each venture's Worker can now sign people up and in with passkeys (WebAuthn): no passwords, no email, no OAuth app, nothing to configure. The relying party is the venture's own host and the session a __Host- cookie (HttpOnly, Secure, SameSite=Lax, 30 days), stored hashed in the venture's D1 database. ES256 and RS256 keys; challenges are single-use and expire in five minutes; origin, relying party, user presence and the signature counter are checked; auth endpoints refuse cross-origin calls. Items saved while signed in are recorded as that person's, and /api/me/items lists them. time.js gains Time.accounts, user, signUp, signIn, signOut and mine; builds are told to use them for what the paid tier promises and never to put sign-in in front of the free product. test_auth.mjs runs the whole ceremony against a real SQLite and a software authenticator, including replay, phishing origin, another site's passkey, a cloned counter, a tampered signature and a duplicate registration; CI pins node 22 so it runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Wyb3QQDESFkosKRXzrXqwr
19 lines
462 B
YAML
19 lines
462 B
YAML
name: ci
|
|
# Time's own tests. Also the check that lets Time auto-merge changes to itself.
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
permissions:
|
|
contents: read
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 3
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-node@v4 # node 22+ has node:sqlite, which the passkey test runs on
|
|
with:
|
|
node-version: 22
|
|
- run: python3 .github/time/test_time.py
|