Leo
abf232327c
背景：self-hosted 單租戶下 console 原本那格「API Key」其實只是 namespace 明碼字串，不是註冊制 key（leo 原話：理論上根本沒有 API Key 這件事）。leo 拍板： 換成簡單 email+password 登入頁（自己設一組帳密，不用 OAuth），登入成功後端發 session token 存 localStorage；後端 API 呼叫仍用固定租戶字串打 KBDB（登入系統 只擋外人看頁面，不做多租戶）。 租戶字串收斂：發現①已核實 owner_id='leo' 是 D1 中 458,357 筆資料實際使用的 租戶字串（ak_... 只有 2 筆孤兒資料）。CONSOLE_TENANT 預設 "leo"，不製造第三個租戶。 新增： - cypher-executor/src/routes/console-auth.ts：/console/auth-status、 /console/setup（首次自助設定帳密，寫入 SESSIONS_KV console:credentials）、 /console/setup/reset（換帳密，需舊密碼）、/console/login、/console/session （驗 session + 回傳固定租戶字串）、/console/logout。密碼用 salt + 3 輪 SHA-256 雜湊，不存明碼。 - cypher-executor/src/types.ts：Bindings 加 CONSOLE_TENANT。 - cypher-executor/wrangler.toml：[vars] 加 CONSOLE_TENANT = "leo"。 - cypher-executor/src/routes/console.ts：① 卡片從「貼 API Key」改成登入/首次 設定表單；查詢函式改用登入後端回的固定租戶字串，使用者不再需要知道任何 namespace 字串。 驗證見 issue #3 留言。 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
134 lines
4.4 KiB
TOML
134 lines
4.4 KiB
TOML
name = "arcrun-cypher-executor"
|
||
main = "src/index.ts"
|
||
compatibility_date = "2025-02-19"
|
||
workers_dev = true
|
||
# global_fetch_strictly_public：讓 fetch() 走公網「前門」，解 self-hosted 的 same-zone 1042
|
||
# （credential-primitives-wasm Phase 7，2026-06-06）。
|
||
# 病因（官方 docs）：self-hosted 的 cypher 與 auth worker 同在 {sub}.workers.dev zone，
|
||
# cypher fetch auth 屬 same-zone fetch，CF 預設擋（1042）。官方 cypher 在 cypher.arcrun.dev、
|
||
# 打 auth 的 *.workers.dev 屬跨 zone 故不踩。此 flag 讓 same-zone fetch 改走公網前門 → 同 zone 也通。
|
||
# 安全（已查證官方 docs）：唯一副作用是「Worker fetch 自己 hostname 會 self-loop」，
|
||
# 但 cypher 只打外部 API + sibling auth worker（皆非自己 hostname）→ 不 self-loop。
|
||
compatibility_flags = ["nodejs_compat", "global_fetch_strictly_public"]
|
||
|
||
[[kv_namespaces]]
|
||
binding = "EXEC_CONTEXT"
|
||
id = "616967a852eb450a8c01731f71ac8edd"
|
||
|
||
[[kv_namespaces]]
|
||
binding = "WEBHOOKS"
|
||
id = "4d23ccd418414a729bd533ba8e3b341f"
|
||
|
||
[[kv_namespaces]]
|
||
binding = "CREDENTIALS_KV"
|
||
id = "e7f4320f88d343f187e35e3543dd74c9"
|
||
|
||
[[kv_namespaces]]
|
||
binding = "ANALYTICS_KV"
|
||
id = "a43b7997c8e54a34886c2995a853c720"
|
||
|
||
[[kv_namespaces]]
|
||
binding = "RECIPES"
|
||
id = "9cf9db905c6241f78503199e58b2ffe0"
|
||
|
||
[[kv_namespaces]]
|
||
binding = "USERS_KV"
|
||
id = "25bef01d079148919578894434d58c4d"
|
||
|
||
[[kv_namespaces]]
|
||
binding = "SESSIONS_KV"
|
||
id = "455d0505c7534883a4d4985ab8295857"
|
||
|
||
# 2026-06-04：移除 WASM_BUCKET R2 binding。R2 wasm 路徑早已 dead（平台零件 = 獨立 Worker，
|
||
# 不從 R2 動態讀），保留只會誤導且 R2 需綁信用卡，與 open source 零費用核心衝突。
|
||
# SDD: .agents/specs/component-registry-canon/tasks.md Phase 1.5（registry 已於 2026-05-07 移除，此為 cypher-executor 補清）
|
||
|
||
[ai]
|
||
binding = "AI"
|
||
|
||
[[services]]
|
||
binding = "SVC_IF_CONTROL"
|
||
service = "arcrun-if-control"
|
||
|
||
[[services]]
|
||
binding = "SVC_SWITCH"
|
||
service = "arcrun-switch"
|
||
|
||
[[services]]
|
||
binding = "SVC_FOREACH_CONTROL"
|
||
service = "arcrun-foreach-control"
|
||
|
||
[[services]]
|
||
binding = "SVC_FILTER"
|
||
service = "arcrun-filter"
|
||
|
||
[[services]]
|
||
binding = "SVC_MERGE"
|
||
service = "arcrun-merge"
|
||
|
||
[[services]]
|
||
binding = "SVC_TRY_CATCH"
|
||
service = "arcrun-try-catch"
|
||
|
||
[[services]]
|
||
binding = "SVC_WAIT"
|
||
service = "arcrun-wait"
|
||
|
||
[[services]]
|
||
binding = "SVC_SET"
|
||
service = "arcrun-set"
|
||
|
||
[[services]]
|
||
binding = "SVC_ARRAY_OPS"
|
||
service = "arcrun-array-ops"
|
||
|
||
[[services]]
|
||
binding = "SVC_STRING_OPS"
|
||
service = "arcrun-string-ops"
|
||
|
||
[[services]]
|
||
binding = "SVC_NUMBER_OPS"
|
||
service = "arcrun-number-ops"
|
||
|
||
[[services]]
|
||
binding = "SVC_DATE_OPS"
|
||
service = "arcrun-date-ops"
|
||
|
||
[[services]]
|
||
binding = "SVC_VALIDATE_JSON"
|
||
service = "arcrun-validate-json"
|
||
|
||
# ai_transform_compile / ai_transform_run 已於 Phase 2（2026-05-29）刪除
|
||
# （Arcrun 是 AI 呼叫的工具，工作流不該內嵌 AI 節點）。對應 worker 已 wrangler delete，
|
||
# service binding 一併移除（否則 deploy 報 referenced Worker not found）。
|
||
|
||
[vars]
|
||
ENVIRONMENT = "production"
|
||
# MULTI_TENANT = "true"
|
||
# ENCRYPTION_KEY 透過 wrangler secret set 設定
|
||
|
||
# Component worker subdomain（workers.dev 帳號 subdomain）
|
||
# cypher-executor fetch component worker 一律走 arcrun-{name}.{WORKER_SUBDOMAIN}.workers.dev
|
||
# 避開同 zone (*.arcrun.dev) 自循環死鎖，見 arcrun.md P0 #9（2026-05-13）
|
||
# Self-hosted fork：改成自己的 CF 帳號 subdomain（Workers & Pages → 你的帳號 → subdomain settings）
|
||
WORKER_SUBDOMAIN = "uncle6-me"
|
||
|
||
# KBDB 基本盤對外 URL（cypher→KBDB：proxy /kbdb/*、recipe-stats、recipe fragment）。
|
||
# 現役 = arcrun-kbdb（workers.dev，無 auth、不需 token）。舊的 kbdb.finally.click 是 inkstone 遺留已死。
|
||
# Self-hosted fork：改成自己部署的 arcrun-kbdb.<你的subdomain>.workers.dev。
|
||
KBDB_BASE_URL = "https://arcrun-kbdb.uncle6-me.workers.dev"
|
||
|
||
# console 固定租戶字串（Arcrun#3 發現②，routes/console-auth.ts）。非機密——self-hosted
|
||
# 架構本就是明碼 namespace。console 登入後端一律用這個字串打 /kbdb/*、/workflows/search
|
||
# （登入系統只擋外人看頁面，不做多租戶）。Self-hosted fork：改成你自己資料實際所在的租戶字串。
|
||
CONSOLE_TENANT = "leo"
|
||
|
||
[[routes]]
|
||
pattern = "cypher.arcrun.dev/*"
|
||
zone_name = "arcrun.dev"
|
||
|
||
# Cron triggers — 每分鐘 tick，scheduled handler 掃 WEBHOOKS KV 找註冊 cron_expr 的 workflow
|
||
# 對應 arcrun.md 三-A P1 #3 / src/scheduled.ts
|
||
[triggers]
|
||
crons = ["* * * * *"]
|