@samebase/alchemy-convex 0.20.0 → 0.22.0

package/README.md

@@ -308,13 +308,17 @@ call.
   the `Convex.Deployment` writes to the deployment. Another `redirectUri` is a new client, and a
   destroy deletes the client.
 
-- `Convex.SharedHubClient`: `{ app, deployment, deploymentType, softwareVersion? }` gets a client of
-  the central identity hub through samebase.com, for an app that deploys in its own GitHub Actions
-  run. The workflow needs `permissions: id-token: write` and no Samebase key. Outputs `status`,
-  `issuer`, `clientId`, `clientSecret`, `registrationAccessToken`, `registrationClientUri`,
-  `deployment`, `deploymentType`, and `redirectUri`.
+- `Convex.SharedHubClient`: `{ app, redirectUri, deploymentType, softwareVersion? }` gets a client
+  of the central identity hub through samebase.com, for an app that deploys in its own GitHub
+  Actions run, on any host. The workflow needs `permissions: id-token: write` and no Samebase key.
+  The origin of `redirectUri` must serve `/samebase-verification.json` with the numeric GitHub id of
+  the repository, `{ "repository": "123" }`, which `gh api repos/<owner>/<name> --jq .id` prints.
+  Samebase reads it before it registers the client, so the site must be live first. Outputs
+  `status`, `issuer`, `clientId`, `clientSecret`, `registrationAccessToken`,
+  `registrationClientUri`, `deploymentType`, and `redirectUri`.
   - Each deploy reads the saved client on the hub with its own token. A client that is gone gets a
-    new one, and a client on another deployment too.
+    new one, and a client on another `redirectUri` too.
+  - A refusal logs its reason, such as a host that does not serve the file.
   - No failure stops a deploy or a destroy. A failed renewal keeps the saved values. Without saved
     values, `status` is `off`, and `issuer`, `clientId`, and `clientSecret` are the `no-hub` values
     of a checkout without a hub. A run without a GitHub OIDC token, such as on a laptop, does the
@@ -333,6 +337,11 @@ of the app, before the first push: it registers the deployment of that directory
 npx alchemy-convex hub-client --team my-team --app scout --callback-path /auth/hub/callback
 ```
 
+For a separate API-connection callback, register another client with
+`--callback-path /oauth/hub/callback --env-prefix RESOURCE_HUB`. This writes `RESOURCE_HUB_ISSUER`,
+`RESOURCE_HUB_CLIENT_ID`, and `RESOURCE_HUB_CLIENT_SECRET`, preserving the sign-in client's
+variables. Each callback remains one exact registered URI.
+
 ## Pull request comment
 
 `alchemy-convex stack-comment` keeps one comment on a pull request. The comment has a card for each

package/lib/{HubClient-Dzw8uZNy.js → HubClient-B6hjkbjW.js}

@@ -1910,12 +1910,6 @@ const HubClientProvider = () => Provider.effect(HubClient, Effect.gen(function*
 		delete: ({ olds, output }) => unregister(api, olds.team, output.clientId).pipe(Effect.asVoid)
 	};
 }));
-/** The variables that a deployment reads to sign in through the hub. */
-const HUB_VARIABLES = [
-	"HUB_ISSUER",
-	"HUB_CLIENT_ID",
-	"HUB_CLIENT_SECRET"
-];
 /**
 * `alchemy-convex hub-client`: a stack deploys production and previews, and this covers the
 * development deployment, which no stack deploys. A deployment with all three variables keeps
@@ -1924,12 +1918,18 @@ const HUB_VARIABLES = [
 */
 const registerDevelopmentClient = (options) => Effect.gen(function* () {
 	const { convex } = options;
+	const envPrefix = options.envPrefix ?? "HUB";
+	const variables = [
+		`${envPrefix}_ISSUER`,
+		`${envPrefix}_CLIENT_ID`,
+		`${envPrefix}_CLIENT_SECRET`
+	];
 	const names = convex([
 		"env",
 		"list",
 		"--names-only"
 	]).split("\n");
-	if (HUB_VARIABLES.every((name) => names.includes(name))) return void 0;
+	if (variables.every((name) => names.includes(name))) return void 0;
 	const siteUrl = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.String))(convex([
 		"run",
 		"--inline-query",
@@ -1951,10 +1951,10 @@ const registerDevelopmentClient = (options) => Effect.gen(function* () {
 		"env",
 		"set",
 		"--force"
-	], `HUB_ISSUER='${client.issuer}'\nHUB_CLIENT_ID='${client.clientId}'\nHUB_CLIENT_SECRET='${Redacted.value(client.clientSecret)}'\n`);
+	], `${envPrefix}_ISSUER='${client.issuer}'\n${envPrefix}_CLIENT_ID='${client.clientId}'\n${envPrefix}_CLIENT_SECRET='${Redacted.value(client.clientSecret)}'\n`);
 	return callbackUrl;
 });
 //#endregion
 export { PushTargetMismatch as A, DEPLOY_KEY_ENV as B, DeploymentProvider as C, ConvexAppNotFound as D, CodePushFailed as E, ManagementApi as F, fromValues as H, ManagementApiLive as I, ACCESS_TOKEN_ENV as L, installedCli as M, parseDeployOutput as N, ConvexCliNotFound as O, ConvexApiError as P, Credentials as R, DeploymentIdentityChange as S, ProductionDeploymentNotFound as T, fromConfig as V, ProjectProvider as _, registerDevelopmentClient as a, AmbiguousDeployment as b, RUN_RECORD_KEY as c, withRunRecord as d, AmbiguousProject as f, ProjectNotFound as g, ProjectDeploymentChange as h, HubClientProvider as i, VariablesOwnedBySomeoneElse as j, EnvironmentNeedsDeployKey as k, RunRecordError as l, Project as m, HubClient as n, STORE_PROJECT_NAME as o, CreatedProjectNotFound as p, HubClientFailed as r, state as s, HUB_PROJECT_NAME as t, runRecord as u, ProjectTeamChange as v, DeploymentResource as w, Deployment as x, AbsoluteRootDir as y, CredentialsError as z };
 
-//# sourceMappingURL=HubClient-Dzw8uZNy.js.map
+//# sourceMappingURL=HubClient-B6hjkbjW.js.map