mirror of
https://github.com/storytold/artcraft.git
synced 2026-11-11 04:16:55 +00:00
Tanish Manku
c1c33caab5
src/auth/oauth.ts configures @cloudflare/workers-oauth-provider: /mcp and legacy /sse protected; /authorize (ours), /token and /register (library); CIMD enabled (with global_fetch_strictly_public in wrangler.toml); scopes read:account/read:jobs/read:catalog; 1h access, 30d idle refresh; error logging by code/category only. `resource` and `authorization_servers` are derived per request origin so one build serves every environment; production sets workers_dev = false so its only origin is canonical. src/index.ts checks the environment invariant first (a misconfigured deploy fails even /token), then hands off to the provider. src/runtime.ts holds the memoized config+app. src/auth/authorize.ts validates the OAuth request via parseAuthRequest, renders unknown-client errors locally and client-validated errors as redirects, and stops at 501 — it never auto-approves. src/mcp/handler.ts is a 501 stub reachable only with a valid token. Tests (10): 401 + resource_metadata challenge on /mcp and /sse, bogus bearer → 401 not 500, health still reachable; PRM at root and /mcp paths with derived resource and this origin as issuer; AS metadata with S256, CIMD flag, "none" auth method, iss support, registration and revocation endpoints; /authorize 400 locally on malformed and unknown client, 201 DCR then 501 with no redirect. pnpm check: typecheck, eslint, prettier, 87 tests passing. Claude-Session: https://claude.ai/code/session_01H3gfN2NCx3hBXSrZXYHUQ3
Artcraft MCP server
Cloudflare Worker at mcp.getartcraft.com. Read CLAUDE.md first — it holds the constraints,
the architecture, and the working method; this file is only how to run things.
Run locally
corepack enable # once; provides the pinned pnpm
pnpm install
cp .dev.vars.example .dev.vars
pnpm --filter @artcraft/mcp-fake-upstream dev # fake API on http://localhost:12345
pnpm dev # MCP server on http://localhost:8787
Local never talks to production: wrangler.toml's top-level block points at the fake, and
src/config.ts refuses to start otherwise.
Check everything
pnpm check # typecheck (regenerates Worker types) · lint · format · test
pnpm test # vitest, inside workerd with the local bindings
Deploy
Deploys run from .github/workflows/mcp.yml on main once the Cloudflare secrets exist
(docs/infra-request.md). Manual deploys, when needed:
pnpm deploy:preview # workers.dev, talks to the deployed fake
pnpm deploy:production # mcp.getartcraft.com, talks to api.storyteller.ai
Layout
See CLAUDE.md → Layout.