mirror of
https://github.com/dohooo/helmor.git
synced 2026-09-22 16:40:02 +08:00
Caspian Zhao
c56043786d
Per-member Durable Object holds the user's ChatGPT OAuth refresh_token encrypted at rest (AES-GCM) and mints short-lived, empty-RT ChatgptAuthTokens auth.json at container cold-start. Never an API key — subscription only. The refresh_token never enters the container, D1, or the webview. - cloud: CodexIdentity DO (serial-locked rotation, persist-new-RT-before-use crash-safe, ~10-day cache reuse), PUT/GET /team/cloud-identity (member_id derived solely from the team bearer), ensureServe cold-start mint hook, teams.cloud_identity_member_id, wrangler DO migration v2. - desktop: authorize_cloud_codex_identity command (throwaway 0700 CODEX_HOME codex login, RAII-shredded, Zeroizing RT) + cloud-identity settings panel (team-mode gated; single-user byte-unchanged). - tests: 19 workerd DO tests (real AES-GCM + storage) + 9 Rust unit tests; reviewed (auth boundary + RT secrecy PASS). Deployed + live auth-boundary verified (all 401).
16 lines
364 B
JSON
16 lines
364 B
JSON
{
|
|
"compilerOptions": {
|
|
"target": "ES2022",
|
|
"module": "ESNext",
|
|
"moduleResolution": "Bundler",
|
|
"lib": ["ES2022"],
|
|
"types": ["@cloudflare/workers-types"],
|
|
"strict": true,
|
|
"noEmit": true,
|
|
"skipLibCheck": true,
|
|
"esModuleInterop": true,
|
|
"forceConsistentCasingInFileNames": true
|
|
},
|
|
"include": ["src/**/*.ts", "test/**/*.ts", "vitest.config.ts"]
|
|
}
|