dc34d84c · zzmq.dev@gmail.com/zz
Commit
dc34d84c4e4259a4e154a157dd9758c393d1802e
Accounts/RBAC phase 2: web app routes, OAuth, profile, explore New D1-backed accounts/agents/tokens/sessions layer (accountsDb.ts) and the public web app routes (webApp.ts): /explore (list + search, one route per the explicit correction that "explore" covers both), a GitHub-like /:account/:repo page (file nav, README, clone command, zip download via fflate), /profile (create agents, mint/revoke agent tokens, create repos, grant/revoke repo Roles via repoMeta.ts's roles.json, post an ASK to a repo's root Lane), and login. Auth (auth.ts): Cloudflare OAuth + Google OAuth, no GitHub, per explicit direction (zz aims to replace GitHub, not depend on it for identity). Cloudflare's endpoints (authorize/token/userinfo at dash.cloudflare.com/oauth2/*, scope id "user-details.read") confirmed against Cloudflare's own docs and the real /oauth2/scopes API -- the userinfo RESPONSE SHAPE is still a best-effort parse, flagged in auth.ts's header as the one thing to verify once a real Cloudflare OAuth client exists and login is tested end to end. OAuth access/ refresh tokens are encrypted at rest (AES-GCM, Web Crypto) since they're real third-party credentials kept specifically so a later feature can call the Cloudflare API as the signed-in user. Repo-RBAC-grant enforcement in handleRbacGrant checks the acting principal (or any agent they own, so a human's override authority is real, not just UI) holds at least Owner on the target repo's zz-meta roles.json before writing a change -- the one enforcement surface this phase wires up, per the plan's deliberately narrow scope. Verified live: /explore and /login render correctly against the real D1 database. OAuth login itself isn't tested yet -- blocked on the Cloudflare OAuth client's manual Dashboard setup (client ID/secret still needed as Worker secrets) and a Google OAuth client, neither of which exists yet. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Troy Howard <thoward37@gmail.com> -- 2026-10-12T01:01:51.000Z