flo-bit.dev
[READ-ONLY] Mirror of https://github.com/flo-bit/svelte-cloudflare-statusphere.
statusphere.atmo.tools
atproto
cloudflare-workers
oauth
svelte
2.7 kB
65 lines
1# svelte atproto cloudflare workers oauth
2
3SvelteKit + AT Protocol OAuth on Cloudflare Workers. Server-side OAuth with `@atcute/oauth-node-client`, Cloudflare KV for session/state storage, and SvelteKit remote functions for type-safe client-server communication.
4
5## Quick Start
6
7```sh
8pnpm install
9pnpm dev
10```
11
12Dev mode uses a loopback OAuth client — no keys or Cloudflare setup needed. Open http://127.0.0.1:5183 and log in with any Bluesky handle.
13
14See [GETTING_STARTED.md](GETTING_STARTED.md) for production deployment, tunnel setup, and configuration.
15
16## Adding to an existing project
17
18**With an AI agent** — paste this into Claude Code (or similar) in your existing repo:
19
20```
21add atproto oauth to this project https://raw.githubusercontent.com/flo-bit/atproto-oauth-cloudflare/main/AGENT_SETUP.md
22```
23
24The [agent prompt](AGENT_SETUP.md) asks a few questions and sets everything up.
25
26**Manually** — see [SETUP.md](SETUP.md) for a step-by-step guide.
27
28## Project Structure
29
30```
31src/lib/atproto/
32├── auth.svelte.ts # Client-side auth state & login/logout/signup
33├── index.ts # Public exports
34├── metadata.ts # OAuth scope from permissions
35├── methods.ts # AT Protocol helpers (read/write/resolve)
36├── settings.ts # Permissions config, constants
37├── server/
38│ ├── oauth.ts # OAuthClient factory (loopback vs confidential)
39│ ├── oauth.remote.ts # Remote functions: login, logout
40│ ├── repo.remote.ts # Remote functions: putRecord, deleteRecord, uploadBlob
41│ ├── session.ts # Session restoration from signed cookie
42│ ├── profile.ts # Profile loading with optional KV cache
43│ ├── kv-store.ts # Cloudflare KV-backed Store
44│ └── signed-cookie.ts # HMAC-signed cookie helpers
45└── scripts/
46 ├── generate-key.ts
47 ├── generate-secret.ts
48 └── setup-dev.ts
49
50src/routes/(oauth)/
51├── oauth/callback/+server.ts
52├── oauth/jwks.json/+server.ts
53└── oauth-client-metadata.json/+server.ts
54```
55
56## How It Works
57
58- **Auth**: Server-side OAuth via `@atcute/oauth-node-client`. Sessions stored in KV, identified by HMAC-signed `did` cookie.
59- **Remote functions**: Write operations and auth actions use SvelteKit remote functions — type-safe server calls without manual API routes.
60- **Dev mode**: Loopback client by default. Set `OAUTH_PUBLIC_URL` in `.env` for confidential client via tunnel.
61- **Prod mode**: Confidential client with `private_key_jwt`, KV stores, `OAUTH_PUBLIC_URL` from `wrangler.jsonc`.
62
63## License
64
65MIT