feat: add auth verification for control plane and workers #444
Conversation
|
| Name | Type |
|---|---|
| pgflow | Minor |
| @pgflow/edge-worker | Minor |
| @pgflow/client | Minor |
| @pgflow/core | Minor |
| @pgflow/dsl | Minor |
| @pgflow/example-flows | Minor |
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
View your CI Pipeline Execution ↗ for commit 15c01c6
☁️ Nx Cloud last updated this comment at |
jumski
force-pushed
the
11-28-recommend_no-verify-jwt_for_now
branch
from
aa73e18 to
1c2e372
Compare
jumski
force-pushed
the
11-28-recommend_no-verify-jwt_for_now
branch
from
1c2e372 to
d9495c2
Compare
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
| .addOption( | ||
| new Option('--secret-key [key]', 'Supabase anon/service_role key') | ||
| .hideHelp() | ||
| ) |
There was a problem hiding this comment.
Critical bug: No default value provided for --secret-key option. The old code had DEFAULT_PUBLISHABLE_KEY as default, which was removed. When users run pgflow compile without the --secret-key flag, options.secretKey will be undefined, causing fetchFlowSQL() to send Authorization: Bearer undefined and apikey: undefined headers, breaking local development.
Fix:
const DEFAULT_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24iLCJleHAiOjE5ODM4MTI5OTZ9.CRXP1A7WOeoJeXxjNni43kdQwgnWNReilDMblYTn_I0';
.addOption(
new Option('--secret-key [key]', 'Supabase anon/service_role key')
.default(DEFAULT_ANON_KEY)
.hideHelp()
)| .addOption( | |
| new Option('--secret-key [key]', 'Supabase anon/service_role key') | |
| .hideHelp() | |
| ) | |
| .addOption( | |
| new Option('--secret-key [key]', 'Supabase anon/service_role key') | |
| .default('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24iLCJleHAiOjE5ODM4MTI5OTZ9.CRXP1A7WOeoJeXxjNni43kdQwgnWNReilDMblYTn_I0') | |
| .hideHelp() | |
| ) |
Spotted by Graphite Agent
Is this helpful? React 👍 or 👎 to let us know.
jumski
force-pushed
the
11-28-recommend_no-verify-jwt_for_now
branch
from
d9495c2 to
42ada04
Compare
jumski
force-pushed
the
11-28-recommend_no-verify-jwt_for_now
branch
from
42ada04 to
15c01c6
Compare
🔍 Preview Deployment: Website✅ Deployment successful! 🔗 Preview URL: https://pr-444.pgflow.pages.dev 📝 Details:
_Last updated: _ |
Merge activity
|
# Add authentication verification for Control Plane and Workers This PR adds a comprehensive authentication plan for pgflow's Control Plane and Worker functions, ensuring sensitive operations are properly protected. Key changes include: - Added `PLAN_auth-verification.md` detailing the authentication requirements and implementation approach - Added `PLAN_workers-start-command.md` for a future CLI command to start workers with proper authentication - Updated CLI to use `--secret-key` instead of `--publishable-key` for the compile command - Modified tests to reflect the authentication changes - Updated documentation to clarify authentication requirements The authentication model requires a Supabase service_role/secret key to protect sensitive operations like flow enumeration, compilation, and worker execution. This aligns with Supabase's recommended practices for server-side operations. For local development, the default anon key is used, while production deployments will require setting up a proper secret key as an Edge Function environment variable.
Add authentication verification for Control Plane and Workers
This PR adds a comprehensive authentication plan for pgflow's Control Plane and Worker functions, ensuring sensitive operations are properly protected. Key changes include:
PLAN_auth-verification.mddetailing the authentication requirements and implementation approachPLAN_workers-start-command.mdfor a future CLI command to start workers with proper authentication--secret-keyinstead of--publishable-keyfor the compile commandThe authentication model requires a Supabase service_role/secret key to protect sensitive operations like flow enumeration, compilation, and worker execution. This aligns with Supabase's recommended practices for server-side operations.
For local development, the default anon key is used, while production deployments will require setting up a proper secret key as an Edge Function environment variable.