Melvin StroblandClaude Fable 5
8d82d6c4ec
Playwright Tests / test-playwright (1, 2) (push) Canceled after 0s
Playwright Tests / test-playwright (2, 2) (push) Canceled after 0s
pre-commit / pre-commit (push) Canceled after 0s
Test Backend / test-backend (push) Canceled after 0s
Compose Smoke Test / test-compose (push) Canceled after 0s
Playwright Tests / merge-reports (push) Canceled after 0s
The engine now speaks MCP at /mcp, with a built-in OAuth 2.1 authorization server in front of it: an agent registers itself, sends a human to the browser to approve it, and exchanges the resulting code for a token. PKCE is required, codes are single-use and stored only as hashes, the browser is redirected to the URI that was registered rather than the one asked for, and refresh tokens rotate so that replaying a spent one revokes the whole line. Twenty tools cover reading, building, publishing and running flows, and each one calls the same REST endpoint the dashboard calls, in-process, carrying the caller's own token. That keeps one description of what a flow is and what may be done to it — validation, the draft/publish split, the version check — and means an agent can do nothing a person could not do in the browser. Agent tokens are RS256 with a keypair of their own rather than the secret that signs browser sessions, so deleting the key withdraws every agent without logging anyone out, and deps.decode_token grew the branch that trusting a second issuer will need when the hosted login arrives. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
54 lines
1.5 KiB
Bash
54 lines
1.5 KiB
Bash
# Template for the app stack's .env. The workspace root's scripts/setup.sh copies
|
|
# this file to .env on first run and then keeps the shared keys in sync with the
|
|
# root .env. Secrets stay as `changethis` here and are generated locally.
|
|
|
|
# Domain Traefik routes on and acquires TLS certificates for.
|
|
DOMAIN=localhost
|
|
|
|
# Used by the backend to build links in outgoing emails.
|
|
FRONTEND_HOST=http://localhost:5173
|
|
|
|
# local, staging, production
|
|
ENVIRONMENT=local
|
|
|
|
PROJECT_NAME="Fluksio"
|
|
STACK_NAME=fluksio-app
|
|
|
|
# Backend
|
|
# `http://frontend` is the compose-network origin the Playwright job loads the
|
|
# SPA from (docker/compose.ci.yml); without it every spec fails CORS at login.
|
|
BACKEND_CORS_ORIGINS="http://localhost,http://localhost:5173,http://app.localhost,https://localhost,https://localhost:5173,http://frontend"
|
|
SECRET_KEY=changethis
|
|
FIRST_SUPERUSER=admin@fluksio.com
|
|
FIRST_SUPERUSER_PASSWORD=changethis
|
|
|
|
# Emails
|
|
SMTP_HOST=
|
|
SMTP_USER=
|
|
SMTP_PASSWORD=
|
|
EMAILS_FROM_EMAIL=noreply@fluksio.com
|
|
SMTP_TLS=True
|
|
SMTP_SSL=False
|
|
SMTP_PORT=587
|
|
|
|
# Postgres
|
|
POSTGRES_SERVER=localhost
|
|
POSTGRES_PORT=5432
|
|
POSTGRES_DB=app
|
|
POSTGRES_USER=postgres
|
|
POSTGRES_PASSWORD=changethis
|
|
|
|
# Redis — flow engine state. Empty keeps the state in memory; the compose stack
|
|
# points the backend at its own `redis` service.
|
|
REDIS_HOST=
|
|
REDIS_PORT=6379
|
|
|
|
SENTRY_DSN=
|
|
|
|
# Docker registry images
|
|
DOCKER_IMAGE_BACKEND=fluksio-backend
|
|
DOCKER_IMAGE_FRONTEND=fluksio-frontend
|
|
|
|
# The MCP endpoint agents connect to, and the OAuth server behind it.
|
|
MCP_ENABLED=true
|