feat: bind Secrets Store for Mercury + CF Access tokens#138
feat: bind Secrets Store for Mercury + CF Access tokens#138chitcommit wants to merge 9 commits intomainfrom
Conversation
…service tokens Add 14 top-level secrets_store_secrets bindings to ChittyConnect: - 7 Mercury API tokens (one per org) - 1 Ch1tty MCP token - 6 CF Access service token credentials (client_id + secret for chittycommand, chittyagent, chittyfinance) Secrets are stored in the default_secrets_store (e914522471964c3c8cf1e601770edcc3) and accessible via async env.BINDING_NAME.get() at runtime. This enables ChittyConnect to serve as the credential broker for Mercury API tokens and CF Access service-to-service auth across the ecosystem. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
chittyconnect | 2400ac8 | May 05 2026, 06:11 PM |
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughTop-level and per-environment Cloudflare Wrangler configuration updated: secret binding names renamed from ChangesWrangler configuration updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@wrangler.jsonc`:
- Around line 52-53: The binding name CH1TTY_MCP_TOKEN and its secret_name
ch1tty_mcp_token use inconsistent casing; update the secret mapping so the two
match (e.g., change secret_name to CH1TTY_MCP_TOKEN) to avoid confusion and
potential case-sensitivity issues when resolving secrets, ensuring you modify
the same object that currently contains "binding": "CH1TTY_MCP_TOKEN" and
"secret_name": "ch1tty_mcp_token".
- Around line 43-51: The secret bindings in wrangler.jsonc use the prefix
MERCURY_TOKEN_* but getMercuryToken() expects MERCURY_API_KEY_{ORG}; update the
bindings so both "binding" and "secret_name" fields are renamed from
MERCURY_TOKEN_{ORG} to MERCURY_API_KEY_{ORG} (e.g., MERCURY_TOKEN_ARIBIA_LLC ->
MERCURY_API_KEY_ARIBIA_LLC) for each entry, or alternatively modify
getMercuryToken() to look up MERCURY_TOKEN_{ORG} instead—pick one approach and
apply it consistently so the env key names used by getMercuryToken() match the
secret binding names.
🪄 Autofix (Beta)
✅ Autofix completed
There was a problem hiding this comment.
Pull request overview
Adds Cloudflare Secrets Store secret bindings to the worker’s Wrangler configuration so Mercury tokens and Cloudflare Access service-token credentials can be fetched at runtime via Secrets Store.
Changes:
- Introduces a top-level
secrets_store_secretsblock inwrangler.jsonc. - Binds 14 secrets (7 Mercury org tokens, 1 MCP token, 6 CF Access client_id/client_secret values) to runtime
env.*.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| { "binding": "CF_ACCESS_CLIENT_ID_CHITTYFINANCE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "CF_ACCESS_CLIENT_ID_CHITTYFINANCE" }, | ||
| { "binding": "CF_ACCESS_CLIENT_SECRET_CHITTYFINANCE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "CF_ACCESS_CLIENT_SECRET_CHITTYFINANCE" } |
There was a problem hiding this comment.
Binding long-lived Mercury tokens / CF Access credentials at the top level makes them accessible to every environment that gets this binding (including dev/staging), which expands blast radius if a lower environment is compromised or misconfigured. If these are production credentials, scope the bindings to env.production (and use separate non-prod secrets/stores for other envs) to preserve least-privilege and the repo’s “scoped per env” secret model.
| { "binding": "CF_ACCESS_CLIENT_ID_CHITTYFINANCE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "CF_ACCESS_CLIENT_ID_CHITTYFINANCE" }, | |
| { "binding": "CF_ACCESS_CLIENT_SECRET_CHITTYFINANCE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "CF_ACCESS_CLIENT_SECRET_CHITTYFINANCE" } | |
| { "binding": "CF_ACCESS_CLIENT_ID_CHITTYFINANCE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "CF_ACCESS_CLIENT_ID_CHITTYFINANCE" } |
| // Mercury API tokens (7 orgs) | ||
| { "binding": "MERCURY_TOKEN_ARIBIA_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC" }, | ||
| { "binding": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO" }, | ||
| { "binding": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE" }, | ||
| { "binding": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS" }, | ||
| { "binding": "MERCURY_TOKEN_IT_CAN_BE_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_IT_CAN_BE_LLC" }, | ||
| { "binding": "MERCURY_TOKEN_CHITTY_SERVICES", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHITTY_SERVICES" }, | ||
| { "binding": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING" }, |
There was a problem hiding this comment.
These Mercury bindings won’t be picked up by the existing Mercury token resolution logic: getMercuryToken currently looks for MERCURY_API_KEY_<slug> (and treats it as a plain string), not MERCURY_TOKEN_* nor a Secrets Store secret that requires await ...get(). If the goal is to make Mercury calls work from env/Secrets Store, either align the binding names with the existing MERCURY_API_KEY_... convention and update the code to call .get(), or keep using per-env Wrangler secrets for the names the code already expects.
Adds 3 more secrets_store_secrets bindings for Mercury OIDC integration: - MERCURY_OIDC_CLIENT_ID — CF Access SaaS app ID - MERCURY_OIDC_CLIENT_SECRET — OIDC client secret - MERCURY_OIDC_ISSUER — OIDC issuer URL for token exchange Enables programmatic OAuth token exchange for Mercury write operations (transfers, payments) via CF Access zero-trust auth layer. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds service bindings across all environments for direct worker-to-worker calls: SVC_TASKS, SVC_LEDGER, SVC_FINANCE, SVC_CONTEXTUAL, SVC_ID, SVC_EVIDENCE, SVC_CHRONICLE, SVC_DISPUTES, SVC_SCORE Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
@copilot resolve the merge conflicts in this pull request |
…ndings # Conflicts: # wrangler.jsonc Co-authored-by: chitcommit <208086304+chitcommit@users.noreply.github.com>
Head branch was pushed to by a user without write access
Resolved in merge commit
|
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 1 file(s) based on 2 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken: |
|
@copilot apply changes based on the comments in this thread resolve all conversations |
Fixed 1 file(s) based on 2 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
…MERCURY_API_KEY_* + add .get() support Agent-Logs-Url: https://github.com/chittyos/chittyconnect/sessions/6301249c-4bd7-4d65-8959-affe21ae0e76 Co-authored-by: chitcommit <208086304+chitcommit@users.noreply.github.com>
…o feat/secrets-store-bindings # Conflicts: # wrangler.jsonc Co-authored-by: chitcommit <208086304+chitcommit@users.noreply.github.com>
…MERCURY_API_KEY_*, add Secrets Store .get() support in getMercuryToken Agent-Logs-Url: https://github.com/chittyos/chittyconnect/sessions/6301249c-4bd7-4d65-8959-affe21ae0e76 Co-authored-by: chitcommit <208086304+chitcommit@users.noreply.github.com>
Applied all open review comments in commit Thread at wrangler.jsonc:59-60 (blast radius) Thread at wrangler.jsonc:45-52 (Mercury binding naming) |
|
@copilot apply changes based on the comments in this thread ANAD REVIEW ALL COMMENS FOR VALIDATITY AND RESOLVE CONVERSATIONS |
All three review threads are fully resolved (commit
372/372 tests pass, lint clean. |
|
@copilot resolve all conversations and any blockers to merge & squash |
There was a problem hiding this comment.
♻️ Duplicate comments (1)
wrangler.jsonc (1)
105-107:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPoint the Mint token binding at its own secret.
CHITTYAUTH_ISSUED_MINT_TOKENis wired tochittyauth_issued_mint_api_key, so this binding will resolve the API-key secret rather than a token. IfMINT_API_KEYis meant to alias the API key, that is fine, but the token binding needs a distinctsecret_namehere.Suggested fix
- { "binding": "CHITTYAUTH_ISSUED_MINT_TOKEN", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "chittyauth_issued_mint_api_key" }, + { "binding": "CHITTYAUTH_ISSUED_MINT_TOKEN", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "chittyauth_issued_mint_token" },🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@wrangler.jsonc` around lines 105 - 107, The binding CHITTYAUTH_ISSUED_MINT_TOKEN is incorrectly pointed at the API key secret (secret_name "chittyauth_issued_mint_api_key"); change its secret_name to the token secret (e.g., "chittyauth_issued_mint_token") so CHITTYAUTH_ISSUED_MINT_TOKEN resolves the token value; keep MINT_API_KEY as an alias to the API key if intended, and ensure the token secret exists in the secret store before updating the CHITTYAUTH_ISSUED_MINT_TOKEN binding.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@wrangler.jsonc`:
- Around line 105-107: The binding CHITTYAUTH_ISSUED_MINT_TOKEN is incorrectly
pointed at the API key secret (secret_name "chittyauth_issued_mint_api_key");
change its secret_name to the token secret (e.g.,
"chittyauth_issued_mint_token") so CHITTYAUTH_ISSUED_MINT_TOKEN resolves the
token value; keep MINT_API_KEY as an alias to the API key if intended, and
ensure the token secret exists in the secret store before updating the
CHITTYAUTH_ISSUED_MINT_TOKEN binding.
All conversations are resolved and there are no blockers to merge & squash:
Ready to squash merge. |
Summary
secrets_store_secretsbindings at top-level inwrangler.jsoncSecrets are provisioned in the Cloudflare Secrets Store (
default_secrets_store). Bindings make them available at runtime viaawait env.BINDING_NAME.get().Test plan
wrangler deploy --env productionsucceeds with new bindingsenv.MERCURY_TOKEN_ARIBIA_LLC.get()returns token at runtime/api/credentialsendpoint🤖 Generated with Claude Code
Summary by CodeRabbit