feat(auth): workspace-scoped connections and dev tooling#2
Open
feat(auth): workspace-scoped connections and dev tooling#2
Conversation
Replace per-user connection isolation (end_user.id) with workspace-scoped access using Nango connection tags (workspace-id, user-id). All members of a workspace now share access to its OAuth connections. - Add workspace membership validation helper - Add listConnectionsByTags using Nango REST API (SDK doesn't support tag filtering) - Require workspace_id on connect-session creation, tag connections accordingly - New GET /api/connections?workspace_id=X endpoint for workspace-scoped listing - Update credentials endpoint to authorize via workspace-id tag + membership - Remove old per-integration/per-user connections endpoint - Update IntegrationProvider interface: endUserId -> workspaceId - Update CloudIntegrationProvider and LocalIntegrationProvider Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…connections - GET/POST /api/workspaces/[workspaceId]/connections for list + create - GET /api/connections/credentials?integration_id&connection_id for fetching creds - Remove /api/nango/connect-session (Nango implementation detail leaked in URL) - Remove /api/credentials/[integrationId] (odd parameterization) - Remove /api/connections?workspace_id (workspace now in path) - Update CloudIntegrationProvider to use new routes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ript - Move DB insert before secrets in create route so WORKSPACE_ID can be included as a machine env var - Inject PUBLIC_URL as OPFLOW_SERVER_URL on new machines for local dev - Pass workspaceId through dev-ui ApiContext to integration provider - Add scripts/dev-auth.sh for local auth-server development with ngrok Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
workspace-idanduser-idinstead of usingendUserId. All workspace members share access to connections within their workspace./api/workspaces/[workspaceId]/connections(GET list, POST create session) and/api/connections/credentials(GET fetch creds with workspace membership check via tags).WORKSPACE_IDas an env var (DB insert moved before secrets). The dev-ui passes it throughApiContextto the integration provider.scripts/dev-auth.shstarts ngrok + auth-server with the ngrok URL injected asPUBLIC_URL, which gets set asOPFLOW_SERVER_URLon new cloud machines.API Routes (auth-server)
Local Development
1. Start local auth-server with ngrok tunnel
# Prerequisites: ngrok installed, docker compose up (postgres), .env.local configured ./scripts/dev-auth.shThis starts ngrok on port 3000, extracts the public URL, and runs the auth-server with
PUBLIC_URLset. New cloud machines will receive the ngrok URL asOPFLOW_SERVER_URL.2. Build and push a custom dev image
To test core SDK changes (e.g.,
CloudIntegrationProvider) on cloud machines:Then add to
packages/auth-server/.env.local:3. Create a workspace against local auth-server