docs(proposal): GitHub authentication for the hosted tunnel-hub - #42
Merged
Conversation
Slice 6 of the warm-loop hub work: add owner-only GitHub authentication so a hosted hub.mxcli.org shows each user only their own previews and gates who may register a runtime, while self-hosted hubs stay fully open (opt-in via config). Two planes, both keyed to a single GitHub OAuth App: a browser web flow with a .mxcli.org session cookie for SSO across preview subdomains (viewer.login == preview.Owner), and a headless device-flow bootstrap that mints a hub API key bound to the GitHub login for run --hub registration (X-Hub-Key → stamp Owner). Adds Backend.Owner + filtered listing, the HTTP/flag surface, security notes, five implementation slices, and open questions (key persistence, web bootstrap, OAuth App ownership). Repo/team sharing and GitHub App installs are future work. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JXnEgoc2NQP1Y2TWMCMXC4
ako
pushed a commit
that referenced
this pull request
Jul 29, 2026
Two check gaps confirmed with mx check on Mendix 11.12.1 — both pass mxcli check but fail the build: - MDL048 (#42): `retrieve … where [id = $Var]` → CE0161. Mendix XPath has no id operator reachable from a microflow expression. Regex a word-boundaried `id` before a comparison (a user attribute can't be named `id`). Hint points at a GUID marketplace action OR exposing the id as a String on a view entity via `cast(id as string)` and constraining on that column. - MDL049 (#43/#44): a call argument bound to an association-object path (`B = $Edit/M.Edit_Budget`) → CE0117. An association path isn't a value; it must be retrieved first. Flags an AttributePathExpr whose final segment is module-qualified (an association → object); an attribute value over the same association (`…/Name`) is not flagged. Tests: TestValidateMicroflow_XPathIdConstraint, _AssociationObjectArg. Repros + symptom table. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JXnEgoc2NQP1Y2TWMCMXC4
ako
pushed a commit
that referenced
this pull request
Jul 29, 2026
…ll gaps (FINDINGS #42/#36/#23/#48/#47) - #42 DESCRIBE WORKFLOW dropped the `with (...)` param mappings: the modelsdk read path built a CallMicroflowTask with only Microflow+Outcomes and never populated ParameterMappings, so describe→drop→exec silently lost the mapping (which nothing then reports). Added microflowParamMappingsFromGen and wired it into both the CallMicroflowTask and CallMicroflowActivity read cases; the legacy sdk/mpr parser already read them. Round-trip test added; verified `describe workflow` now emits `call microflow M.ACT_Do with (Item = '$workflowContext')`. - #36 SEC005 lint suggested `ALTER PROJECT SECURITY STRICT MODE ON`, a statement the parser doesn't implement. Strict mode is Studio Pro-only — the suggestion now says so instead of naming an unrunnable command. - #23 documented `create or modify association` (the idempotent form) in the domain-model skill: plain `create association` is not idempotent and its failure aborts the rest of the script. - #48 documented `set task outcome $Task '<Outcome>'` (there is no `complete task`) and the other workflow task statements in write-workflows. - #47 documented that System-module enumerations are read from the runtime, not the .mpr, so mxcli can't resolve them — constrain on an attribute instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JXnEgoc2NQP1Y2TWMCMXC4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Design proposal (slice 6 of the warm-loop hub work) for adding owner-only GitHub authentication to the multi-tenant tunnel-hub, so a hosted
hub.mxcli.orgcan show each user only their own app previews and gate who may register a runtime. Self-hosted hubs stay fully open — everything is opt-in via config.Per the design discussion, the locked decisions are:
What it covers
.mxcli.org(SSO across preview subdomains);cookie.login == backend.Owneror 403.mxcli auth hub logindevice-flow bootstrap mints a hub API key bound to the login;run --hubsendsX-Hub-Key→ hub stampsBackend.Owner. The GitHub token never lands in the cookie/registry.Backend.Owner, owner inidentity(),List(sort, viewer)filtering (empty viewer = open mode).MXCLI_HUB_KEY, OAuth App ownership).Docs-only; no code changes. Continues the slice numbering in
PROPOSAL_mxcli_dev_warm_loop.md.🤖 Generated with Claude Code
Generated by Claude Code