fix(site): use the shared Nyuchi Internal Tools WorkOS app for the docs gate - #50
Merged
Merged
Conversation
The gate assumed a confidential Connect app and required WORKOS_CLIENT_SECRET in the token exchange. The app actually in use — "Nyuchi Internal Tools" (client_01KVTX0V2K1VM3PSC0DJ9VZWTV), shared with other internal tools/MCP surfaces rather than a dedicated "Nyuchi Docs" app — is clientConfidentiality: Public, so it has no secret at all; PKCE is the whole story. Make WORKOS_CLIENT_SECRET optional and only include it in the token request when set. Also bakes the real (non-secret) WORKOS_CLIENT_ID/WORKOS_ISSUER into wrangler.toml [vars] instead of leaving them as a manual secrets TODO — neither is sensitive: the client ID is exposed in the redirect URL anyway, and an OIDC issuer is public by design. https://docs.nyuchi.com/oauth/callback was added to that app's redirect-URI allowlist in the WorkOS dashboard (validated with a dry-run first, alongside its five existing redirects).
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
nyuchi-docs-mcp | 2efb95d | Commit Preview URL Branch Preview URL |
Aug 01 2026, 02:15 AM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
shamwari-docs-ai | 2efb95d | Commit Preview URL Branch Preview URL |
Aug 01 2026, 02:16 AM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
nyuchi-docs | 2efb95d | Commit Preview URL Branch Preview URL |
Aug 01 2026, 02:16 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
client_01KVTX0V2K1VM3PSC0DJ9VZWTV) — already used by other internal tools/MCP surfaces.clientConfidentiality: Public(no client secret at all — PKCE-only).site/src/worker/gate.ts's token exchange assumed a secret was required; madeWORKOS_CLIENT_SECREToptional and only included in the request when set, so the same code path still works if a confidential app is ever swapped in later.WORKOS_CLIENT_ID/WORKOS_ISSUERintowrangler.toml's[vars]rather than leaving them as a manual post-merge secrets step.https://docs.nyuchi.com/oauth/callbackon that app's redirect-URI allowlist in the WorkOS dashboard (validated with a dry-run against the existing 5 redirects first, confirmed with a real run).Still outstanding, not in this PR:
INTERNAL_FETCH_KEYstill needs to be generated and set as a Wrangler secret on bothsiteandnyuchi-docs-mcp-worker(has to match on both) — that's an actual secret, not committed here.Test plan
pnpm -r build— all packages build clean,wrangler deploy --dry-runonsiteshows the realWORKOS_CLIENT_ID/WORKOS_ISSUERbindingspnpm -r test— 35 tests pass unchangeddocs.nyuchi.comonce deployedGenerated by Claude Code