open-platform/app-template
Template
3
0
Fork 0
Code Issues Pull requests Releases 5 Packages 2 Wiki Activity Actions

chart: platform-mode apps mount no app-auth secret (0.6.1) #13

Merged
plat merged 1 commit from feat/platform-mode-no-oauth into main 2026-08-12 19:32:25 +00:00
Conversation 0 Commits 1 Files changed 2 +7 -1
plat commented 2026-08-12 19:07:57 +00:00
Owner
Copy link

Gates the app-auth envFrom on auth.mode==app. Platform-mode apps authenticate via the shared forwardAuth edge (one OAuth registration for the whole fleet) and no longer carry a per-app app-auth secret — so the pod must not require it. app-mode apps (per-user Forgejo token, e.g. warden) unchanged. Pairs with mcp 0.39.0. 35/35 tests, helm-template verified both modes.

Gates the `app-auth` envFrom on `auth.mode==app`. Platform-mode apps authenticate via the shared forwardAuth edge (one OAuth registration for the whole fleet) and no longer carry a per-app app-auth secret — so the pod must not require it. app-mode apps (per-user Forgejo token, e.g. warden) unchanged. Pairs with mcp 0.39.0. 35/35 tests, helm-template verified both modes.
chart: platform-mode apps mount no app-auth secret
Some checks failed
preview / preview (pull_request) Failing after 0s
Details
guard-ppt / no-ppt (pull_request) Successful in 0s
Details
guard-ppt / no-ppt (push) Successful in 0s
Details
check / check (pull_request) Successful in 24s
Details
check / check (push) Successful in 23s
Details
c07a205f68 
The fleet forwardAuth edge holds ONE shared OAuth app for the whole
fleet; a platform-mode app runs no in-app OAuth and the platform no
longer provisions its per-app app-auth Secret (Forgejo client creds +
better-auth secret). Gate the app-auth envFrom on auth.mode==app so a
platform-mode pod doesn't require a Secret that isn't there. app-mode
apps (warden pattern — per-user Forgejo token) are unchanged. Pairs
with mcp >=0.39.0, which stops minting the OAuth app + secret for
platform-mode apps. version 0.6.1.
plat merged commit deb2123b4e into main 2026-08-12 19:32:25 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-work
Queue this for an agent: it will build it and open a PR

  
agent-working
An agent is actively working on this

  
ultracode
Operators: run a Fable ultracode orchestrator on this issue

No labels
agent-work
agent-working
ultracode
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
open-platform/app-template!13
No description provided.