Repository navigation
Conversation
Reference for the component Bearer-validator hook added in HarperFast/harper#3313: the result contract, expiry and caching, rejection and timeout behavior, and an example. The overview's authentication paragraph links to it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKif56wJ3LB5ZqsGi3E9eg
… release note - The authExpiresAt entry states the one-year ceiling, the 5-minute default, and that a JWT whose exp has passed is refused (HarperFast/harper#3313 now does this) while the validator must still verify expiry itself. - timeoutMs distinguishes the per-call limit from the per-request deadline the validators and the user lookup share. - The JWT guide notes that a Bearer-validator caller cannot mint tokens without a password; the security overview links the hook; 5.4 release notes gain an Authentication entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKif56wJ3LB5ZqsGi3E9eg
Scoped minting stays refused for a Bearer-validator caller even with a password; the release note limits the hook to the application port; the abort applies only to a validator still running. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKif56wJ3LB5ZqsGi3E9eg
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces documentation and release notes for the new server.registerBearerValidator() API, which enables components to validate custom Bearer tokens. The feedback suggests a grammatical improvement and structural separation of a security warning in the API documentation to ensure clarity and better visibility of fallback behaviors.
🚀 Preview DeploymentYour preview deployment is ready! 🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-737 This preview will update automatically when you push new commits. |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKif56wJ3LB5ZqsGi3E9eg
🚀 Preview DeploymentYour preview deployment is ready! 🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-737 This preview will update automatically when you push new commits. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
⊙ Problem
Let components authenticate their own Bearer tokens as Harper users adds
server.registerBearerValidator, a new public API for components, with no reference page.🤔 Document it before the core PR merges?
Yes: the docs PR stays in draft until the core PR merges, and the OAuth plugin team needs the contract now. The page is badged v5.4.0, the next minor.
💡 Solution
reference/http/api.mdgets aserver.registerBearerValidator(validator, options?)section: what a validator returns, expiry and caching, rejections and deadlines, rollback, and an example.reference/http/overview.mdandreference/security/overview.mdlink to it from their authentication paragraphs.reference/security/jwt-authentication.mdnotes that a Bearer-validator caller cannot mint tokens without a password, or scoped tokens at all, including from a custom Resource.✅ Verification
npm run format:checkpasses.server/Server.tsJSDoc,security/bearerValidators.tsandserver/DESIGN.md, and by the pre-push review.🤖 Generated by Claude Code (Claude Opus 5.5); posted via @kriszyp.
https://claude.ai/code/session_01FKif56wJ3LB5ZqsGi3E9eg
Related PRs: none found
Complexity: easy
Review-Coverage: authored=claude; ran=gemini,cursor-composer,codex; adjudicated=domain; declined=cursor-grok,cursor-kimi,cursor-muse,muse; rounds=2; full=1 @ bc55a88
Review-Attention: skim ~2m (decisions: ship-docs-before-core-merge, shared-chain-budget) @ bc55a88