From f3f7f857f7e8385ec564b29e037aa8801d187d11 Mon Sep 17 00:00:00 2001 From: Tom Wilson Date: Tue, 28 Jul 2026 14:09:49 -0400 Subject: [PATCH] enable managed auth in production MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flips VITE_MANAGED_AUTH to "true". Users sign in with Clerk and the server provisions a per-user OpenRouter key, so nobody pastes their own. Rollback is the same line back to "false" — one deploy, no data migration, since projects live in IndexedDB and are untouched either way. Also records the Phase 2 COEP spike result, open since June. Serving a real managed build behind the same COEP: require-corp / COOP: same-origin headers render.yaml sets and driving it in Chrome: crossOriginIsolated is true, Clerk's chunks load and initialize, ZERO external origins are requested, and nothing is blocked. The no-rhc + bundled @clerk/ui approach does what it was meant to. Two things must be true in the dashboards or this deploy is not what it looks like, and both are noted in render.yaml: VITE_CLERK_PUBLISHABLE_KEY must be set (unset silently falls back to BYOK, because isManagedAuthEnabled() requires BOTH), and Google must be enabled as a Clerk social connection — which on a production instance needs your own Google OAuth credentials. Still unvalidated: the OAuth redirect round-trip, and the managed agent loop itself. /api/agent/step and the three web tools have only ever seen fixtures. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_019gS8yjMedGgujEad6zRD7i --- docs/managed-openrouter-migration-plan.md | 14 ++++++++++++++ render.yaml | 19 ++++++++++++++----- 2 files changed, 28 insertions(+), 5 deletions(-) diff --git a/docs/managed-openrouter-migration-plan.md b/docs/managed-openrouter-migration-plan.md index 1d86840..280a24b 100644 --- a/docs/managed-openrouter-migration-plan.md +++ b/docs/managed-openrouter-migration-plan.md @@ -91,6 +91,20 @@ create table users ( 3. `gleam-externals/agent.mjs`: fetch a fresh token via `clerk.session.getToken()` per request (Clerk tokens are short-lived) and send `Authorization: Bearer ` to `/api/agent`. > **Status (2026-06-10):** Code side implemented behind `VITE_MANAGED_AUTH` (off by default; old behavior unchanged): bundled `@clerk/clerk-js` (code-split chunk, no CDN script), boot gate in `src/main-gleam.ts` (`src/managed-auth.ts`), fresh `getToken()` per request to `/api/agent` (`src/managed-agent-client.ts`, unit-tested incl. 402 code mapping). Spike **validation** still requires a Render preview deploy with a Clerk dev instance — runbook in `docs/phase2-coep-spike.md`. +> +> **Status (2026-07-28): the COEP half of the spike PASSES.** Measured by serving +> a real `VITE_MANAGED_AUTH=true` production build behind the same +> `COEP: require-corp` + `COOP: same-origin` headers `render.yaml` sets, then +> driving it in Chrome: `crossOriginIsolated === true` (so WebContainers still +> work), Clerk's chunks load and initialize, **zero external origins are +> requested**, and nothing is blocked by COEP. The `no-rhc` + bundled +> `@clerk/ui` approach does what it was supposed to. Managed auth also builds +> cleanly — ~240 code-split chunks, 4.4 MB total, none of it in the entry chunk. +> +> Still unvalidated, and needing real credentials: the **OAuth redirect +> round-trip** (it leaves the origin and comes back, which a placeholder key +> cannot exercise) and the **managed agent loop** — `/api/agent/step`, +> `web_search`, `web_fetch`, `web_post` have only ever seen fixtures. **Success criteria (spike — gate for the rest of the phase):** diff --git a/render.yaml b/render.yaml index 35591ce..698ab09 100644 --- a/render.yaml +++ b/render.yaml @@ -5,12 +5,21 @@ services: envVars: - key: GLEAM_VERSION value: 1.16.0 - # Phase 5 rollout switch: off in production until the COEP spike passes - # and dogfooding is done; PR previews get the managed flow automatically. - # The production flip is: change this value to "true" (and the rollback - # is flipping it back — one deploy each way). + # Phase 5 rollout switch, flipped on 2026-07-28. Managed mode: users sign + # in with Clerk and the server provisions a per-user OpenRouter key, so + # nobody pastes their own. + # + # ROLLBACK is this value back to "false" — one deploy, no data migration + # (projects live in IndexedDB and are untouched either way). + # + # Two things must be true in the dashboards or this is not what it looks + # like: VITE_CLERK_PUBLISHABLE_KEY must be set below — unset silently + # falls back to BYOK, because isManagedAuthEnabled() requires BOTH — and + # Google must be enabled as a Clerk social connection, which on a + # production instance needs your own Google OAuth credentials rather than + # Clerk's shared development ones. - key: VITE_MANAGED_AUTH - value: "false" + value: "true" previewValue: "true" - key: VITE_CLERK_PUBLISHABLE_KEY sync: false