fix(auth): handle Astro v6 removal of locals.runtime.env in OAuth routes#763
Open
kamine81 wants to merge 10 commits into
Open
fix(auth): handle Astro v6 removal of locals.runtime.env in OAuth routes#763kamine81 wants to merge 10 commits into
kamine81 wants to merge 10 commits into
Conversation
@astrojs/cloudflare v13+ (Astro v6) removed locals.runtime.env, causing OAuth login to fail silently with a generic error redirect. Resolution order for env vars: 1. locals.runtime.env — Astro v5 + @astrojs/cloudflare 2. cloudflare:workers — Astro v6 + @astrojs/cloudflare 3. import.meta.env — Node.js / Vite dev server fallback Adds unit tests for all three resolution paths and the error cases.
🦋 Changeset detectedLatest commit: 7dcab01 The changes in this PR will be included in the next version bump. This PR includes changesets to release 14 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@emdash-cms/admin
@emdash-cms/auth
@emdash-cms/blocks
@emdash-cms/cloudflare
emdash
create-emdash
@emdash-cms/gutenberg-to-portable-text
@emdash-cms/x402
@emdash-cms/plugin-ai-moderation
@emdash-cms/plugin-atproto
@emdash-cms/plugin-audit-log
@emdash-cms/plugin-color
@emdash-cms/plugin-embeds
@emdash-cms/plugin-forms
@emdash-cms/plugin-webhook-notifier
commit: |
Rollup statically resolves string-literal dynamic imports at build time. Using a variable (`const cfWorkersModId = "cloudflare:workers"`) defers resolution to runtime, avoiding build failures in Node.js fixture builds.
Contributor
|
This PR has been inactive for 14 days. It will be closed automatically in 7 days if there is no further activity. If you're still working on this, please push an update or leave a comment. |
Bring the branch up to date with upstream/main. The only conflicts were in the OAuth routes ([provider].ts, [provider]/callback.ts); resolve them by taking the upstream version so this commit is a clean main integration. The Astro v6 locals.runtime.env fix is re-applied in the following commit.
@astrojs/cloudflare v13+ (Astro v6) removed locals.runtime.env, so the OAuth initiation and callback routes threw when reading env. Resolve env through a fallback chain: locals.runtime.env (Astro v5) -> cloudflare:workers (Astro v6) -> import.meta.env (Node). The cloudflare:workers import is a literal dynamic import; the core build preserves it as a runtime-only import, so no static-analysis workaround is needed. Matches the production-validated patch in kamine81/my-emdash-site#100.
The callback route ([provider]/callback.ts) received the same locals.runtime.env -> cloudflare:workers -> import.meta.env fallback as the initiation route, but had no test. Add a unit test mirroring the provider-route suite, including the regression case where the Astro v6 locals.runtime.env getter throws and must be caught (error=invalid_state, not error=oauth_error).
github-actions
Bot
added
review/needs-review
…solve
The literal `import("cloudflare:workers")` in the OAuth routes broke
non-Cloudflare (Node adapter) template builds: Rollup statically
resolves the specifier at build time and fails because the module only
exists on workerd. Build the module id at runtime
(`["cloudflare", "workers"].join(":")` + @vite-ignore) so neither this
package's bundler nor the downstream Astro/Rollup template build
resolves it statically.
On Cloudflare the dynamic import is left as a runtime expression and
resolves natively on workerd (verified: the adapter externalizes via a
`/^cloudflare:/` resolveId filter, and the marketing-cloudflare build
keeps the runtime import intact). On Node it throws and is caught,
falling through to import.meta.env.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Fixes GitHub/Google OAuth login when using
@astrojs/cloudflarev13+ (Astro v6).The
@astrojs/cloudflareadapter removedAstro.locals.runtime.envin Astro v6, replacing it withimport { env } from "cloudflare:workers". The OAuth initiation ([provider].ts) and callback ([provider]/callback.ts) routes were still reading fromlocals.runtime.env, which now throws at runtime — causing every OAuth login attempt to silently redirect to a genericoauth_errorpage.Resolution order after this fix:
locals.runtime.env— Astro v5 +@astrojs/cloudflare(unchanged behaviour)cloudflare:workers— Astro v6 +@astrojs/cloudflare. New fallback via a dynamicimport()whose module specifier is built at runtime (["cloudflare", "workers"].join(":")), so it is not statically analyzable.import.meta.env— Node.js / Vite dev server (unchanged fallback)Why the specifier is computed: A literal
import("cloudflare:workers")is statically resolved by Rollup at build time. On Node-adapter templates (templates/marketing,templates/blog, …) there is no plugin to externalize it, so the template build fails with "Rollup failed to resolve import cloudflare:workers". Computing the specifier at runtime keeps it out of static analysis:@astrojs/cloudflareexternalizes via aresolveIdfilter{ id: /^cloudflare:/ }(a build-time regex on the specifier string). A computed specifier never hits that filter, so Rollup leaves theimport()as a runtime expression and workerd resolvescloudflare:workersnatively. (Verified: themarketing-cloudflaretemplate build keeps the runtime import intact indist/server/chunks/.)import.meta.env.Related issues: #464, #249
Type of change
Checklist
pnpm typecheckpassespnpm lintpassespnpm testpasses (or targeted tests for my change)pnpm formathas been runpnpm locale:extracthas been run (if applicable)AI-generated code disclosure
Screenshots / test output