feat(worker): Phase 1 Hono skeleton + canonical Phase 0 remediation#33
Open
chitcommit wants to merge 2 commits into
Open
feat(worker): Phase 1 Hono skeleton + canonical Phase 0 remediation#33chitcommit wants to merge 2 commits into
chitcommit wants to merge 2 commits into
Conversation
Phase 0 — canonical artifacts and config: - CHARTER.md, CHITTY.md, AGENTS.md, SECURITY.md, register.json (canonical frontmatter, P/L/T/E/A entity-type declarations, repo slug fix, MIGRATING status flag) - wrangler.jsonc replaces wrangler.toml (compat 2026-03-28, observability, tail_consumers: chittytrack, assets.chitty.cc route in env.production) - .github/CODEOWNERS - sovereignty.cert deleted (non-canonical) Phase 1 — Hono Worker skeleton: - worker/src/env.ts — ENTITY_TYPES const tuple, ChittyAuthClaimsSchema (zod), CHITTY_ID_PATTERN - worker/src/auth.ts — JWKS verify with audience claim, distinguishes validation errors (401) from JWKS infra failures (503), logs every reject with reason code to tail consumer, configured JWKS timeout+cooldown, Person-only principal enforcement - worker/src/index.ts — /health, /api/v1/status, /api/auth/user, anonymous 501 stub (no auth oracle), CORS allowlist, correlation-id error handler that scrubs err.message from client response - client/src/lib/chittyAuthUrls.ts — ChittyAuth issuer URLs Validated: typecheck clean, wrangler deploy --dry-run --env production succeeds (250 KiB / 50 KiB gzip), tail consumer chittytrack bound. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR bootstraps the ChittyAssets Cloudflare Workers API service with JWT-protected endpoints, client-side authentication URL helpers, service registration metadata, and comprehensive governance documentation defining tier, certification, security policy, and operational constraints. ChangesChittyAssets Worker Service Initialization
Sequence Diagram(s)sequenceDiagram
participant Client
participant HonoApp as Hono App
participant CORS as CORS Middleware
participant Auth as requireChittyAuth
participant JWKS as JWKS Cache
participant Handler as Route Handler
Client->>HonoApp: HTTP Request
HonoApp->>CORS: Check origin allowlist
CORS->>HonoApp: Allowed/Rejected
alt Public Route
HonoApp->>Handler: GET /health or /api/v1/status
Handler->>Client: JSON metadata + timestamp
else Protected Route
HonoApp->>Auth: Extract bearer token or cookie
Auth->>JWKS: Verify JWT signature
JWKS->>Auth: Remote JWKS key set
alt Valid JWT
Auth->>Auth: Validate claims schema
alt Person entity
Auth->>Handler: Proceed with claims in context
Handler->>Client: Response with user data
else Non-person
Auth->>Client: 403 Forbidden
end
else Invalid/Expired
Auth->>Client: 401 Unauthorized
end
else Unimplemented
HonoApp->>Client: 501 Not Yet Migrated
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
client/src/lib/chittyAuthUrls.ts (1)
16-22: 💤 Low valueConsider simplifying URL base construction.
The
buildAuthUrlfunction adds a trailing slash to the origin when creating the base URL (${getChittyAuthOrigin()}/), butnormalizeOriginalready strips trailing slashes. While theURLconstructor handles this correctly, it creates inconsistency. Consider passing the origin directly:function buildAuthUrl(path: string, params: Record<string, string>): string { - const url = new URL(path, `${getChittyAuthOrigin()}/`); + const url = new URL(path, getChittyAuthOrigin()); for (const [k, v] of Object.entries(params)) {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@client/src/lib/chittyAuthUrls.ts` around lines 16 - 22, The buildAuthUrl function constructs the base URL using `${getChittyAuthOrigin()}/` which is redundant because normalizeOrigin already strips trailing slashes; update buildAuthUrl to pass getChittyAuthOrigin() directly into the URL constructor (i.e., new URL(path, getChittyAuthOrigin())) while keeping the existing loop that sets url.searchParams from params; reference the buildAuthUrl function and ensure no other behavior changes around path handling or query param population.worker/src/index.ts (1)
36-66: ⚡ Quick winConsider centralizing service metadata constants.
The metadata fields
version,tier, andcanonical_uriare hardcoded and duplicated across both/healthand/api/v1/statusendpoints. Consider extracting these into constants at the top of the file or inworker/src/env.tsto ensure consistency and ease of maintenance.♻️ Proposed refactor
+const SERVICE_METADATA = { + name: "chittyassets", + tier: 4, + canonical_uri: "chittycanon://core/services/chittyassets", + version: "1.0.0", +} as const; + const app = new Hono<{ Bindings: Env; Variables: Variables }>(); app.get("/health", (c) => c.json({ status: "ok", - service: "chittyassets", - tier: 4, - canonical_uri: "chittycanon://core/services/chittyassets", - version: "1.0.0", + ...SERVICE_METADATA, environment: c.env.ENVIRONMENT, timestamp: new Date().toISOString(), }), ); app.get("/api/v1/status", (c) => c.json({ status: "ok", - service: "chittyassets", - tier: 4, - canonical_uri: "chittycanon://core/services/chittyassets", - version: "1.0.0", + ...SERVICE_METADATA, environment: c.env.ENVIRONMENT, migration_status: "MIGRATING_EXPRESS_TO_HONO",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@worker/src/index.ts` around lines 36 - 66, Extract duplicated service metadata (version, tier, canonical_uri and any other repeated literals like service name) into shared constants (e.g., SERVICE_NAME, SERVICE_VERSION, SERVICE_TIER, SERVICE_CANONICAL_URI) defined at the top of this file or exported from worker/src/env.ts, then replace the hardcoded values in the handlers for app.get("/health", ...) and app.get("/api/v1/status", ...) to reference those constants (also reuse for the "service" field). Ensure timestamp and environment still come from c.env and that entity_types_handled and dependencies remain unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 46: Change the invalid dependency version for `@hono/zod-validator` in
package.json from "^0.8.0" to the valid latest stable version "^0.7.6"; update
the dependency entry ("@hono/zod-validator") accordingly and run your package
manager (npm/yarn/pnpm) to reinstall and verify no dependency conflicts.
In `@register.json`:
- Around line 254-258: The repo metadata lists "cloudflare-r2" in register.json
but docs mention Google Cloud Storage; decide which storage is authoritative and
make consistent: if Cloudflare R2 is correct, update CHITTY.md (references
around the stack table and architecture diagram) and SECURITY.md (the "Evidence
File ACL" threat surface) to replace "Google Cloud Storage" and GCS-specific
terminology with "Cloudflare R2" and R2-specific details; if Google Cloud
Storage is correct, change the register.json external entry from "cloudflare-r2"
to "google-cloud-storage" and update the storage endpoint descriptions (the
endpoint text referenced in CHITTY.md lines ~194 and ~200) to GCS
endpoints/terminology so all docs and register.json match. Ensure you update all
occurrences of GCS/R2 in CHITTY.md and SECURITY.md to avoid mixed references.
---
Nitpick comments:
In `@client/src/lib/chittyAuthUrls.ts`:
- Around line 16-22: The buildAuthUrl function constructs the base URL using
`${getChittyAuthOrigin()}/` which is redundant because normalizeOrigin already
strips trailing slashes; update buildAuthUrl to pass getChittyAuthOrigin()
directly into the URL constructor (i.e., new URL(path, getChittyAuthOrigin()))
while keeping the existing loop that sets url.searchParams from params;
reference the buildAuthUrl function and ensure no other behavior changes around
path handling or query param population.
In `@worker/src/index.ts`:
- Around line 36-66: Extract duplicated service metadata (version, tier,
canonical_uri and any other repeated literals like service name) into shared
constants (e.g., SERVICE_NAME, SERVICE_VERSION, SERVICE_TIER,
SERVICE_CANONICAL_URI) defined at the top of this file or exported from
worker/src/env.ts, then replace the hardcoded values in the handlers for
app.get("/health", ...) and app.get("/api/v1/status", ...) to reference those
constants (also reuse for the "service" field). Ensure timestamp and environment
still come from c.env and that entity_types_handled and dependencies remain
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 40a6c92c-4e8d-4e11-915b-a0fb8ff15d77
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (13)
.github/CODEOWNERSAGENTS.mdCHARTER.mdCHITTY.mdSECURITY.mdclient/src/lib/chittyAuthUrls.tspackage.jsonregister.jsonworker/src/auth.tsworker/src/env.tsworker/src/index.tswrangler.jsoncwrangler.toml
💤 Files with no reviewable changes (1)
- wrangler.toml
| "@clerk/express": "^2.0.1", | ||
| "@clerk/types": "^4.0.0", | ||
| "@google-cloud/storage": "^7.16.0", | ||
| "@hono/zod-validator": "^0.8.0", |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the latest stable version of @hono/zod-validator npm package?
💡 Result:
The latest stable version of the @hono/zod-validator npm package is 0.7.6 [1][2]. Evidence: the npm package page lists “0.7.6” as the current version [1], and JSR also shows @hono/zod-validator at version 0.7.6 (released as the latest in the 0.7.x series) [2].
Citations:
- 1: https://www.npmjs.com/package/@hono/zod-validator
- 2: https://jsr.io/@hono/zod-validator/doc/~/zValidator
Update @hono/zod-validator to a valid version. The specified version ^0.8.0 does not exist; the latest stable release is 0.7.6. Update to ^0.7.6 to resolve dependency conflicts during installation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 46, Change the invalid dependency version for
`@hono/zod-validator` in package.json from "^0.8.0" to the valid latest stable
version "^0.7.6"; update the dependency entry ("@hono/zod-validator")
accordingly and run your package manager (npm/yarn/pnpm) to reinstall and verify
no dependency conflicts.
Comment on lines
+254
to
+258
| "external": [ | ||
| "openai-gpt4o", | ||
| "cloudflare-r2", | ||
| "neon-postgresql" | ||
| ] |
Contributor
There was a problem hiding this comment.
Resolve object storage platform inconsistency across documentation.
This file declares cloudflare-r2 as the external storage dependency, but CHITTY.md specifies "Google Cloud Storage" in the stack table and architecture diagram, and SECURITY.md describes "Evidence File ACL (Google Cloud Storage)" as a threat surface.
Please clarify which platform is actually deployed:
- If Cloudflare R2 is correct: update CHITTY.md lines 34, 58-59 and SECURITY.md lines 89-95 to replace GCS references with R2
- If Google Cloud Storage is correct: change line 256 to
"google-cloud-storage"and update endpoint descriptions at lines 194, 200
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@register.json` around lines 254 - 258, The repo metadata lists
"cloudflare-r2" in register.json but docs mention Google Cloud Storage; decide
which storage is authoritative and make consistent: if Cloudflare R2 is correct,
update CHITTY.md (references around the stack table and architecture diagram)
and SECURITY.md (the "Evidence File ACL" threat surface) to replace "Google
Cloud Storage" and GCS-specific terminology with "Cloudflare R2" and R2-specific
details; if Google Cloud Storage is correct, change the register.json external
entry from "cloudflare-r2" to "google-cloud-storage" and update the storage
endpoint descriptions (the endpoint text referenced in CHITTY.md lines ~194 and
~200) to GCS endpoints/terminology so all docs and register.json match. Ensure
you update all occurrences of GCS/R2 in CHITTY.md and SECURITY.md to avoid mixed
references.
- Provisioned Hyperdrive 'chittyassets-db' (id: 4bd7964c46dd42be86e8a5e3dd0d7376) pointing at Neon project steep-cloud-28172078 pooled endpoint - Added Worker [assets] static binding (Option B per chittyagent-cloudflare): serves dist/public as SPA fallback, single deploy artifact for UI + API - DNS AAAA assets.chitty.cc → 100:: proxied (record 8f5080ce71da05449312b1b1bc7c22a1) - Verified: wrangler deploy --dry-run --env production binds CHITTYASSETS_DB Hyperdrive + ASSETS static + chittytrack tail consumer Phase 2 prerequisites: complete. Ready for read-route migration. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This was referenced May 16, 2026
feat(worker): Phase 2b — port simple owner-scoped reads (warranties/insurance/legal-cases/tools)
#37
Open
Open
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
wrangler.jsoncreplaces stalewrangler.toml,.github/CODEOWNERS, P/L/T/E/A entity types declared, repository slug + compat date fixedworker/src/with JWKS-validated ChittyAuth,/health,/api/v1/status,/api/auth/user. Defer-by-501 stub for unmigrated routes. Express server still serves dev — no breaking change to existing dev flowMulti-agent review applied
Findings from
chittyos-core:chittycanon-code-cardinal,pr-review-toolkit:code-reviewer,pr-review-toolkit:silent-failure-hunter,pr-review-toolkit:type-design-analyzer,chittyos-governance:chittyagent-neon,chittyos-proxy-agents:chittyagent-cloudflare,chittyos-core:chittyschema-overlordconsolidated:CHITTYAUTH_AUDIENCE=chittyassets-api)503) distinguished from validation failures (401)chittytracktail consumer with reason codestimeoutDuration+cooldownDurationconfiguredtrust_levelbounded0..5,sub === chitty_idinvariant,exp > iatENTITY_TYPESconst tuple — single source of truth (was triplicated)requireChittyAuth(closes auth-oracle leak)err.messagescrubbed from 500 responses, replaced with correlation_iddecodeURIComponents JWTsValidation
tsc --noEmitcleanwrangler deploy --dry-run --env productionsucceeds (250 KiB / 50 KiB gzip)chittytrackboundchittyassets-api*worker, R2 bucket, orassets.chitty.ccDNS record (per chittyagent-cloudflare audit) — clean first-deploy statePhase 2 prerequisites (next PR)
steep-cloud-28172078chittyassets-db(bindingCHITTYASSETS_DB)AAAA assets 100::forassets.chitty.cc[assets]binding vs new Pages project —chittyassetsPages project does not exist in account)chittyschema-overlord: addchitty_id UNIQUE,entity_typediscriminator,r2_object_acltable, dropsessions, planusers.chitty_idmigrationTest plan
curl preview-url/healthreturns canonical envelopecurl preview-url/api/v1/statusshowsmigration_status: MIGRATING_EXPRESS_TO_HONOcurl preview-url/api/auth/userreturns 401 without bearercurl -H 'Authorization: Bearer <valid-ChittyAuth-JWT>' preview-url/api/auth/userreturns claimscurl preview-url/api/assetsreturns 501 anonymously (no auth oracle)auth_rejectevents with reason codes🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation
Chores