TooonyChen
d6731f8180
- Wrap the Worker with @cloudflare/workers-oauth-provider: /oauth/token, /oauth/register (dynamic client registration), and /.well-known/* are implemented by the library; tokens/grants/clients live in OAUTH_KV. - New consent page at /oauth/authorize reuses the session cookie; unauthenticated visitors bounce through the SPA login via returnTo. - Grant props store only userId; oauthPropsAuth re-fetches the user from D1 on every MCP request, so deleting a user revokes access instantly. Permissions still flow exclusively through visibleMails(). - OAuth is optional: without the OAUTH_KV binding the provider is skipped entirely and /mcp keeps working with aik_ API keys only. With it, both credentials coexist (Bearer aik_ requests pre-route around the provider). - Docs and wrangler examples updated; KV block commented out by default.
40 lines
1.2 KiB
Plaintext
40 lines
1.2 KiB
Plaintext
name = "auth-inbox"
|
|
main = "src/index.ts"
|
|
compatibility_date = "2024-10-04"
|
|
compatibility_flags = ["nodejs_compat"]
|
|
|
|
[assets]
|
|
directory = "./web/dist"
|
|
binding = "ASSETS"
|
|
|
|
[observability]
|
|
enabled = true
|
|
|
|
[vars]
|
|
UseBark = "true"
|
|
barkUrl = "https://api.day.app"
|
|
barkTokens = "[token1, token2]"
|
|
AI_BASE_URL = "https://generativelanguage.googleapis.com/v1beta/openai"
|
|
AI_API_KEY = "your-api-key"
|
|
AI_API_FORMAT = "openai"
|
|
AI_MODEL = "gemini-2.0-flash"
|
|
# AI_FALLBACK_BASE_URL = "https://api.openai.com"
|
|
# AI_FALLBACK_API_KEY = "your-fallback-api-key"
|
|
# AI_FALLBACK_API_FORMAT = "openai"
|
|
# AI_FALLBACK_MODEL = "gpt-4o-mini"
|
|
|
|
[[d1_databases]]
|
|
binding = "DB"
|
|
database_name = "inbox-d1"
|
|
database_id = "********-****-****-****-************"
|
|
|
|
# Optional: OAuth for claude.ai remote connectors. Omit to disable OAuth (aik_ keys only).
|
|
# Binding name must be OAUTH_KV. Create: npx wrangler kv namespace create OAUTH_KV
|
|
# [[kv_namespaces]]
|
|
# binding = "OAUTH_KV"
|
|
# id = "********************************"
|
|
|
|
# Required secret (not a [vars] entry): set JWT_SECRET as a Cloudflare Secret after deploy.
|
|
# pnpm exec wrangler secret put JWT_SECRET
|
|
# 必需的 secret（不要写进 [vars]）：部署后设置 JWT_SECRET。
|