Repository navigation
Add experimental local Workers OIDC identity bindings - #16455
Draft
irvinebroque wants to merge 7 commits into
Draft
irvinebroque wants to merge 7 commits into
irvinebroque wants to merge 7 commits into
Conversation
🦋 Changeset detectedLatest commit: 40ff3ab The changes in this PR will be included in the next version bump. This PR includes changesets to release 15 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@cloudflare/autoconfig
@cloudflare/build-output-utils
@cloudflare/codemods
@cloudflare/config
@cloudflare/containers-shared
create-cloudflare
@cloudflare/deploy-helpers
@cloudflare/kv-asset-handler
miniflare
@cloudflare/pages-functions
@cloudflare/pages-shared
@cloudflare/runtime-types
@cloudflare/unenv-preset
@cloudflare/vite-plugin
@cloudflare/vitest-plugin
@cloudflare/workers-auth
@cloudflare/workers-editor-shared
@cloudflare/workers-utils
wrangler
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add experimental local Workers OIDC through explicit identity bindings. A configured binding selects an existing approved identity and audience policy;
env.IDENTITY.getToken({ audience, fresh })requests an assertion. Configuration and Worker deployment do not create grants.Share lazy authenticated sessions across Wrangler, Vite, and opted-in Vitest runs. Keep credentials in the host, check current authorization on every getter, and forward concurrent fresh requests separately. Carry the binding through configuration conversion, upload metadata, Previews, native Miniflare bindings, and generated types. Local Durable Objects use the local development identity profile.
Validation: all affected package type checks pass; 252 config tests, 698 workers-utils tests, 106 development authorization/API tests, 33 deploy-helper tests, and 55 Miniflare tests pass. Native Miniflare tests use the matching workerd build and cover multiple bindings, fresh calls, DOs, service/RPC targets, reloads, and failures. Vitest opt-in tests also pass.
This remains a draft behind
workers_oidc. Native execution requires the matching workerd implementation and the authorization services; the pinned npm runtime predates the native callback. This PR also supplies prerelease SDK packages for the matching cf integration branch.