fix(auth): disable runtime schema validation on D1 and sync Gmail OAuth secret

Author: codercatdev

.github/workflows/deploy-workers.yml

@@ -75,6 +75,9 @@ jobs:
           if [ -n "$GOOGLE_REFRESH_TOKEN" ]; then
             echo "$GOOGLE_REFRESH_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put GOOGLE_REFRESH_TOKEN --env=""
           fi
+          if [ -n "$GOOGLE_WORKSPACE_REFRESH_TOKEN" ]; then
+            echo "$GOOGLE_WORKSPACE_REFRESH_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put GOOGLE_WORKSPACE_REFRESH_TOKEN --env=""
+          fi
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -87,6 +90,7 @@ jobs:
           GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
           GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
           GOOGLE_REFRESH_TOKEN: ${{ secrets.GOOGLE_REFRESH_TOKEN }}
+          GOOGLE_WORKSPACE_REFRESH_TOKEN: ${{ secrets.GOOGLE_WORKSPACE_REFRESH_TOKEN }}
 
   deploy-production:
     if: github.ref == 'refs/heads/main'
@@ -149,6 +153,9 @@ jobs:
           if [ -n "$GOOGLE_REFRESH_TOKEN" ]; then
             echo "$GOOGLE_REFRESH_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put GOOGLE_REFRESH_TOKEN --env production
           fi
+          if [ -n "$GOOGLE_WORKSPACE_REFRESH_TOKEN" ]; then
+            echo "$GOOGLE_WORKSPACE_REFRESH_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put GOOGLE_WORKSPACE_REFRESH_TOKEN --env production
+          fi
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -161,3 +168,4 @@ jobs:
           GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
           GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
           GOOGLE_REFRESH_TOKEN: ${{ secrets.GOOGLE_REFRESH_TOKEN }}
+          GOOGLE_WORKSPACE_REFRESH_TOKEN: ${{ secrets.GOOGLE_WORKSPACE_REFRESH_TOKEN }}

apps/site/src/lib/auth.ts

@@ -105,6 +105,15 @@ export async function ensureDefaultUserAndSession(db: D1Database) {
 				"updatedAt" integer NOT NULL
 			)`,
 		),
+		db.prepare(
+			`CREATE TABLE IF NOT EXISTS "jwks" (
+				"id" text PRIMARY KEY NOT NULL,
+				"publicKey" text NOT NULL,
+				"privateKey" text NOT NULL,
+				"createdAt" integer NOT NULL,
+				"expiresAt" integer
+			)`,
+		),
 		db
 			.prepare(
 				`INSERT OR IGNORE INTO user (id, name, email, emailVerified, createdAt, updatedAt)
@@ -155,9 +164,8 @@ function resolveSocialProviders() {
 	return providers;
 }
 
-function buildAuthPlugins(origin: string) {
+function buildPortalAuthPlugins() {
 	return [
-		jwt(),
 		emailOTP({
 			otpLength: 6,
 			expiresIn: 300,
@@ -257,6 +265,13 @@ function buildAuthPlugins(origin: string) {
 				});
 			},
 		}),
+	];
+}
+
+function buildMcpAuthPlugins(origin: string) {
+	return [
+		jwt(),
+		...buildPortalAuthPlugins(),
 		mcp({
 			resource: `${origin}/mcp`,
 			resources: [`${origin}/mcp`, origin],
@@ -295,11 +310,20 @@ export function getAuth(origin: string, d1?: D1Database) {
 		trustedOrigins: [
 			"https://codingcat.dev",
 			"https://dev.codingcat.dev",
+			"https://postiz.codingcat.dev",
 			origin,
 		],
 		...(db ? { database: db } : {}),
+		advanced: {
+			database: {
+				validateSchema: false,
+			},
+		},
+		account: {
+			skipStateCookieCheck: true,
+		},
 		socialProviders: resolveSocialProviders(),
-		plugins: buildAuthPlugins(origin),
+		plugins: buildMcpAuthPlugins(origin),
 	});
 
 	if (!db) {
@@ -328,10 +352,15 @@ export function getPortalAuth(origin: string, d1?: D1Database) {
 			origin,
 		],
 		...(db ? { database: db } : {}),
+		advanced: {
+			database: {
+				validateSchema: false,
+			},
+		},
 		account: {
 			skipStateCookieCheck: true,
 		},
 		socialProviders: resolveSocialProviders(),
-		plugins: buildAuthPlugins(origin),
+		plugins: buildPortalAuthPlugins(),
 	});
 }

apps/site/src/pages/portal/[token].astro

@@ -1314,7 +1314,7 @@ const pageDescription = !portalFound
 			googleBtn.addEventListener("click", async () => {
 				googleBtn.setAttribute("disabled", "true");
 				try {
-					const callbackURL = window.location.pathname + window.location.hash;
+					const callbackURL = window.location.origin + window.location.pathname;
 					const res = await fetch("/api/auth/sign-in/social", {
 						method: "POST",
 						headers: { "Content-Type": "application/json" },
@@ -1415,7 +1415,7 @@ const pageDescription = !portalFound
 				const origText = sendMagicBtn.textContent;
 				sendMagicBtn.textContent = "Sending Magic Link...";
 				try {
-					const callbackURL = window.location.pathname + window.location.hash;
+					const callbackURL = window.location.origin + window.location.pathname;
 					const res = await fetch("/api/auth/sign-in/magic-link", {
 						method: "POST",
 						headers: {