@drawbridge/drawbridge-agents 0.1.17 → 0.1.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -14,6 +14,13 @@ skill) so it stops living only in tribal memory.
|
|
|
14
14
|
`/auth` forms attach and enforces it **unconditionally** on `/oauth/{signup,signin}/request`
|
|
15
15
|
(fails closed). Deploy order matters: ship app-web **before** api, or the api blocks every
|
|
16
16
|
signin that arrives without a token. See `drawbridge-docs/user-stories/03-auth`.
|
|
17
|
+
- `BASIC_AUTH_USERNAME` + `BASIC_AUTH_PASSWORD` is the shared basic-auth staging-gate pair read
|
|
18
|
+
by **drawbridge-website** (`middleware.js`) and **drawbridge-app-web** (`proxy.js`) — same
|
|
19
|
+
names in both so one credential pair gates both dev deployments. The gate arms only when
|
|
20
|
+
**both** are set (fails open: a missing/misnamed var silently leaves the deployment public —
|
|
21
|
+
unset both in prod, set both in dev). Exempt: app-web `/api/health` (platform health checks)
|
|
22
|
+
and website Builder preview traffic. Not related to OAuth/session auth, which runs after the
|
|
23
|
+
gate unchanged.
|
|
17
24
|
|
|
18
25
|
## Sync owns reactive side effects
|
|
19
26
|
|
package/package.json
CHANGED