refactor(storage): extract registry.Store and vault.Backend interfaces#1
Draft
doramirdor wants to merge 1 commit into
Draft
refactor(storage): extract registry.Store and vault.Backend interfaces#1doramirdor wants to merge 1 commit into
doramirdor wants to merge 1 commit into
Conversation
Turn the gateway's storage seams into interfaces so alternative
implementations (notably a multi-tenant deployment that lives in a
separate repo) can plug in without forking.
- registry.Store mirrors *registry.Registry's full method set; the
SQLite-backed Registry remains the default OSS impl.
- vault.Backend mirrors *vault.Vault's full method set; the
OS-keychain-backed Vault remains the default OSS impl.
- Gateway, Supervisor, and Resolver depend on the interfaces; CLI
commands keep using the concrete types directly.
Interfaces are deliberately tenant-agnostic. A multi-tenant impl is
expected to bind the tenant via construction (per-request wrapper that
filters by user_id), not by adding a parameter to every method.
No behavior change. Compile-time `var _ Store = (*Registry)(nil)` and
`var _ Backend = (*Vault)(nil)` checks ensure the OSS impls keep
satisfying the contract.
doramirdor
force-pushed
the
claude/hosted-mcp-auth-uF72t
branch
from
c1b1fd7 to
228a3e8
Compare
doramirdor
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Turns the gateway's storage seams into interfaces so alternative implementations — notably a private hosted/multi-tenant build in a separate repo — can plug in without forking. No behavior change for the OSS binary.
This PR replaces the earlier WorkOS-AuthKit auth scaffolding (force-pushed away). All hosted-flavored code (OAuth/JWT, web UI, multi-tenant impls) will live in a separate private repo (
nucleus-hosted) that vendors this module. The OSS gateway keeps stdio + the existing--tokenstatic-bearer HTTP path only.What's in this PR
internal/registry/store.go— newStoreinterface mirroring*registry.Registry's full method set. SQLite remains the default impl.internal/vault/backend.go— newBackendinterface mirroring*vault.Vault's full method set. OS keychain remains the default impl.internal/server.Gateway,internal/workspace.Resolver,internal/supervisor.Supervisornow depend on the interfaces. CLI commands keep using concrete types directly.var _ Store = (*Registry)(nil)/var _ Backend = (*Vault)(nil)checks pin the contract.CONTRIBUTING.mddocuments the seams.Design note
Interfaces are deliberately tenant-agnostic. A multi-tenant implementation is expected to bind the tenant via construction (a per-request wrapper that filters by
user_id), not by adding a parameter to every method. This keeps the contract stable for the OSS use case while letting the hosted side do whatever it needs.Test plan
go build ./...,go vet ./...,go test ./...— all greennucleus serve(stdio) on a workspace with profiles and confirm tools appear unchangednucleus serve --http 127.0.0.1:8787 --token fooand confirm the existing static-token path still workshttps://claude.ai/code/session_01RacGUaDSFGTSwwvtTBxF5X