feat(#754 auth-accounts): unit #9 — auth + accounts + onboarding on TanStack - #771
Merged
Conversation
…anStack
Port the real authentication, accounts-management, and onboarding surfaces onto
the TanStack route tree (reusing every shared component verbatim — C1/C3 surgical
changes only), and wire the worker's OAuth WRITE through the existing phase-1 302
callback (no new auth-write path).
Surfaces: /login (replaces #5 placeholder), /accounts (inside the _app shell),
/welcome/{new,connect,success} + /auth/auth-code-error (under a faithful _auth
pathless layout).
G1 (load-bearing): the auth/accounts routes are the first eager, ungated importers
of @farcaster/hub-web's module-scope test factory (Factory.build()->randomBytes),
which Rollup hoisted into the eager worker-entry chunk -> 'Disallowed operation in
global scope' crashed worker init for EVERY route. Fixed by stubbing the two
client-only route pages (AccountsPage/WelcomeConnectPage) in the ssr env and
mounting /welcome/new's CreateAccountPage via dynamic(ssr:false), confining the
factory to lazy chunks that only run in the browser.
Shared-file edit (the one allowed): rainbowkit.tsx ALCHEMY key made host-agnostic
((import.meta as any).env?.VITE_ALCHEMY_API_KEY ?? process.env.NEXT_PUBLIC_*) so
Vite RPC works while the Next build stays green; + define/.env.local.example entry.
Green: web:build 0, web:typecheck 0, live typecheck 0, test 150/150, worker bundle
2317.73 KiB gzip (<3MB). Canary: all 6 routes + /api/health + /feeds SSR 200 on
workerd with zero global-scope throws, with and without secrets.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unit #9 — auth + accounts + onboarding (OAuth write)
Track B of epic #754 (Next.js → TanStack Start on Cloudflare Workers). The critical-path surface-tier unit: it alone unblocks #11 → #12 → #13 (cutover). Spec:
docs/migration/phase-2-auth-accounts.md.What it does
Ports the real authentication + accounts + onboarding surfaces onto the TanStack route tree, reusing every shared component verbatim (C1/C3 surgical changes only —
next/navigation→@/web/lib/navigation,next/link→@/web/components/link, drop'use client'), and wires the worker's OAuth WRITE through the existing phase-1 302 callback (no new auth-write path)./loginapp/(auth)/login_app/accountsapp/(app)/accounts_appshell/welcome/{new,connect,success}app/(auth)/welcome/*_authpathless layout (= port ofapp/(auth)/layout.tsx)/auth/auth-code-errorapp/auth/auth-code-errorThe hard part — G1 (worker-init crash)
The auth/accounts routes are the first eager, ungated importers of
@farcaster/hub-web's module-scope test factory (Factory.build()→@noble/hashes randomBytes). Rollup hoisted that factory into the eager worker-entry chunk, so every route 500'd at init withDisallowed operation called within global scope … generating random values(even/api/health). Earlier units only reached it through SSR-gated routes (feeds hydrate gate) or lazily-chunked components, where it stays in a lazy chunk and only runs in the browser.Fix: stub the two client-only route pages (
AccountsPage,WelcomeConnectPage— both SSR-gated) in the workerdssrenv viassrClientOnlyModules, and mount/welcome/new'sCreateAccountPageviadynamic(ssr:false). This confines the factory to lazy chunks (random-gen is fine in the browser). Root-caused via bundle bisection; rationale documented invite.config.mts+ the spec's G1.The one allowed shared-file edit
src/common/helpers/rainbowkit.tsxALCHEMY key made host-agnostic:(import.meta as any).env?.VITE_ALCHEMY_API_KEY ?? process.env.NEXT_PUBLIC_ALCHEMY_API_KEY— Vite inlinesVITE_*(RPC works); the?.keeps the Next/webpack runtime (noimport.meta.env) from throwing;as anykeeps the root-tsconfig typecheck green. +define/.env.local.exampleentries. (Clears the strategy.md deferred item.)Green / verified
pnpm web:build0 ·pnpm web:typecheck0 · livepnpm typecheck0 ·pnpm test150/150web:deploy:dry-runworker bundle 2317.73 KiB gzip (< 3 MB; +24 KiB over Add support for user reactions to posts #6)wrangler dev):/login,/accounts,/welcome/{new,connect,success},/auth/auth-code-error,/api/health,/feedsall SSR 200 with zeroDisallowed operationthrows — both with and without secrets (forkability bar met).define-pinned toundefined).Not verified here (needs real secrets)
The OAuth WRITE round-trip (login through the worker → 302 sets chunked
sb-*cookies →getUserFnreturns a real UUID) and wallet RPC success need real Supabase secrets + a configured OAuth provider +VITE_ALCHEMY_API_KEYat build — see the canary DoD in the spec.Boundaries honored
No changes to
app/,pages/,next.config.mjs,vercel.json,src/globals.css, or any sharedsrc/file exceptrainbowkit.tsx. The live Next/Vercel app is untouched.Do not merge — leave for review. (Tier-2 codex integration review runs at the surface-tier boundary after #6–#9 all land.)