feat: switch the data layer and auth exchange to the ATK API, retire auth-function - #2
Merged
Merged
Conversation
…auth-function
Hard switch from GitHub (Octokit + Contents API + client-side JSZip) to the
ATK API for every registry interaction. No fallback flag.
- Generate a typed client from the vendored contract (`openapi/openapi.json`)
with @hey-api/openapi-ts 0.99.0 into `src/lib/api/` (`pnpm refresh-openapi`,
`pnpm generate-api`). `src/lib/api-client.ts` owns the base URL
(`VITE_ATK_API_URL` replaces `VITE_AUTH_FUNCTION_URL`), bearer auth from
the session token, retries via `fetch-retry.ts` (now accepts a Request),
and maps every `{ error, message, details? }` envelope to `ApiRequestError`.
- Auth: the OAuth code exchange posts to `POST /auth/github/exchange`;
`SessionProvider` verifies with `GET /me` (401 -> signed-out, 403
not_org_member / org_membership_unverifiable -> non-member, hints kept).
The session context exposes a configured `api` client instead of `octokit`.
- Registry reads go to `/registry`, `/assets/.../manifest|readme|files` and
`/bundles/.../manifest` (Zod guards kept). The Files card reads the API
directory listing via a new `useAssetFiles` hook and `useManifestGraph`
(one cached request per asset); `file-list.ts` and `registry-paths.ts`
are gone.
- Downloads fetch the server-built zip / .skill archives in one request.
- Publish sends `POST /publish` (`client: "web"`), `POST /publish/plan` for
dry runs; API error codes map to typed PublishErrors and validation
`details[]` render on the review step. CreateBundle gains an org field so
org bundles publish with `org` in bundle.json.
- Delete `auth-function/`, its deploy workflow, and its steps in
validate.yml / deploy-pages.yml; the Pages build reads
`vars.VITE_ATK_API_URL`. `@octokit/rest` removed; `jszip` stays for the
Contribute .skill upload.
- Tests rewritten against the API shapes with fetch stubs; docs updated.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AVx9yUuzMoxCS3xYaxzKbc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Step 4 of the ATK API-first plan (
docs/Direction.mdin the monorepo): the web app's data layer and auth exchange move from GitHub to the ATK API, andauth-functionis retired. Hard switch, no fallback.What changed
@hey-api/openapi-ts0.99.0 generatessrc/lib/api/from the vendoredopenapi/openapi.json(pnpm refresh-openapi,pnpm generate-api).src/lib/api-client.tsownsVITE_ATK_API_URL, bearer auth, retries, and error mapping (ApiRequestErrorwithcode/status/details).POST /auth/github/exchangereplaces the auth-function;SessionProviderverifies withGET /me(401 → signed-out, 403not_org_member/org_membership_unverifiable→ non-member).useSession().apireplacesoctokit;@octokit/restis removed./registry,/assets/{type}/{name}/{version}/manifest|readme|files,/bundles/{name}/{version}/manifest, all?org=scoped. The Files card now shows the API's directory listing (newuseAssetFileshook;useManifestGraphalso lists files per dependency).…/download?format=zip|skill; JSZip zip-building deleted (JSZip stays for the Contribute.skillupload).POST /publishwithclient: "web",POST /publish/planfor?dryRun=1.409 branch_exists→PublishBranchCollisionError;409 version_*→PublishVersionConflictError;400 validation_failed|schema_invalid→PublishValidationErrorwhosedetails[]render on the review step. CreateBundle gains an Org field so org bundles carryorginbundle.json.auth-function/,deploy-auth-function.yml, and the auth-function steps invalidate.yml/deploy-pages.yml. The Pages build now readsvars.VITE_ATK_API_URL.docs/deployment.md,docs/OAUTH_APP_SETUP.md,PROJECT_OVERVIEW.mddescribe the API-based setup and the real repo-variable names.Verification
pnpm lint && pnpm typecheck && pnpm test(272 tests) andpnpm buildare green.https://func-atk-dev.azurewebsites.net: see the session notes in the PR conversation.Before merging (merging deploys Pages = prod cutover)
gh variable set VITE_ATK_API_URL --body https://func-atk-prod.azurewebsites.netAfter the Pages deploy is verified against prod
Out-of-band: delete the
atk-authFunction App, theAZURE_CREDENTIALSsecret, and theAZURE_FUNCTION_APP_NAME/VITE_AUTH_FUNCTION_URLrepo variables.🤖 Generated with Claude Code
https://claude.ai/code/session_01AVx9yUuzMoxCS3xYaxzKbc