bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-14 06:47:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
logicsrc/apps/pwa
History
Anthony Ettinger 60c0cbfbce
Some checks are pending
CI / build (push) Waiting to run
Details
test / test (push) Waiting to run
Details
fix(pwa): return the caller's own host in the CLI device-flow URLs (#105) 
`logicsrc login --device` told users to open
https://logicsrc-credentials-production.up.railway.app/cli/device even when they
had reached the app on the real domain. /cli/device/code built verification_uri
from `config.origin`, which is a single fixed value read from $PUBLIC_ORIGIN, so
the response was wrong for every hostname except the one that variable happened
to name.

Derive the origin from the request instead: whatever host the CLI called is the
host it gets sent back to. Express honours X-Forwarded-Proto/Host here because
server.mjs sets `trust proxy` behind Railway's TLS terminator.

Deliberately scoped to the two device-flow URLs. The WebAuthn expectedOrigin in
passkey.mjs stays pinned to config.origin — validating a signature against a
host the caller supplied would defeat the check.

Note this fixes which URL is *printed*; the host still has to route to this
service for the link to load.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 09:19:37 -07:00
..
public feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
src fix(pwa): return the caller's own host in the CLI device-flow URLs (#105) 2026-07-30 09:19:37 -07:00
test fix(pwa): return the caller's own host in the CLI device-flow URLs (#105) 2026-07-30 09:19:37 -07:00
.env.example feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
.gitignore feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
package.json feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
Procfile feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
railway.json feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
README.md feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00

README.md

@logicsrc/pwa — LogicSRC credentials

Express + libSQL/Turso app for team credential sharing: auth (email/password, passkeys, CoinPay OAuth, sessions, lsk_ CLI API keys) + end-to-end-encrypted team vaults. Zero-knowledge — the server only stores ciphertext, per-member sealed vault keys, and identity public keys. Decryption happens in the logicsrc CLI.

cp .env.example .env      # set SESSION_SECRET; TURSO_* for prod (else local file db)
npm install
npm start                 # migrates on boot, serves on :8080

The CLI connects with LOGICSRC_API=<origin> logicsrc login (browser OAuth-PKCE loopback → an lsk_ key). See docs/credential-sharing.md in the repo root.