feat(runtime): /auth /ai 两域 handler 体抽出 — ADR-0076 D11 步骤③ PR-7 (#2462)#3551
Merged
Conversation
…076 D11 step ③ PR-7 (#2462) - domains/auth.ts: better-auth service bridge + the MSW/browser mock fallback; the local browser-safe randomUUID wrapper moves with its only consumer. - domains/ai.ts: dispatches the AI plugin's kernel-cached __aiRoutes table, enforcing each route's declared auth contract and threading the resolved actor. Receives the FULL cleanPath (legacy branch passed cleanPath whole; the matcher re-prefixes /api/v1) — preserved. - DomainHandlerDeps grows isAuthRequired() (lazily read — the requireAuth field initializes AFTER the deps object, a construction- order trap TS2729 caught) and getRegisteredAiRoutes(). - /mcp deliberately EXCLUDED: buildMcpBridge couples to the action-execution family (callData/actionPermissionError/ invokeBusinessAction/…), so the whole MCP family goes with the /actions /meta /data deep-coupling batch. Verified: seam suite 42 tests, runtime 647 green, http-conformance 41 green, dependent closure builds with DTS (--force). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 17 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…js/insecure-randomness) The extraction made the legacy Math.random() RFC4122 fallback "changed code" and CodeQL flagged it (the ids feed mock session tokens). Prefer crypto.randomUUID, fall back to crypto.getRandomValues-built v4; the no-crypto-at-all branch (ancient runtimes, mock-only) avoids Math.random too. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
动机（#2462 D11 步骤③，系列第七刀）
抽出
/auth（better-auth 服务桥 + MSW/浏览器 mock fallback，浏览器安全randomUUID包装随唯一消费方走）和/ai（分派 AI 插件缓存在 kernel 上的__aiRoutes路由表，逐路由 auth 契约强制 + actor 透传）。关键点
/ai接收完整 cleanPath（旧分支整传、matcher 内部拼回/api/v1）——原样保真。DomainHandlerDeps扩两个惰性成员：isAuthRequired()（requireAuth 字段初始化晚于 deps 对象，TS2729 抓到的构造顺序陷阱——惰性读取绕开）+getRegisteredAiRoutes()。/mcp有意排除：调查发现buildMcpBridge耦合 action 执行家族（callData/actionPermissionError/invokeBusinessAction 等，正是 handleActions 的 helper 群）——MCP 家族整体归 /actions /meta /data 深耦合批。验证
接缝套件 42 测试（新增 5：auth 服务桥 / mock sign-up / ai agents 空列表非 404 / ai 404 / kernel 路由表分派含 params+actor）；runtime 全量 647 绿；conformance 41 绿；闭包
--force含 DTS 绿。关联 #2462（D11 步骤③ PR-7）。机械批至此收官；剩余全部为深耦合批：/actions /meta /data /mcp /graphql（共享 action 执行 + env 解析状态设施，需单独设计 deps 形态）。
🤖 Generated with Claude Code