konnosDashboard
README.md96 lines · main
1# auth-pilot
2
3Smallest trustworthy **Briven Auth** setup for a real browser test (dogfood kit).
4
5**For humans:** follow repo root `AUTH-GO-LIVE-CHECKLIST.md` + `BETA-V1-NEXT-STEPS.md`.
6**For agents:** follow the `briven-auth` skill.
7
8## What you get
9
10Not a full product UI — a **wiring kit**:
11
121. Next-style `middleware.ts` that forwards `/api/auth/*` to Briven
132. `lib/auth.ts` using `@briven/auth`
143. Env template for project id + `pk_briven_auth_…`
154. One hosted sign-in button pattern
16
17Email + password only is enough for a pilot. Turn on Google/magic link later in the dashboard.
18
19**If you enable two-factor:** after password sign-in, users may hit the hosted
20`/auth/<projectId>/two-factor` step (authenticator code **or** a backup recovery
21code). In React apps use `TwoFactorChallenge` from `@briven/auth/react`.
22
23**For CI/e2e:** mint a testing token in the dashboard (or admin API) and call
24`auth.signIn.testToken(process.env.BRIVEN_AUTH_TEST_TOKEN!)`.
25
26## 10-minute dogfood path (recommended)
27
28This is the **Clerk-gap soft item**: a second human can sign up without you pasting code at them.
29
30```sh
31# 0. Platform awake
32# ./scripts/s6-auth-verify.sh
33
34# 1. Copy this kit outside the monorepo (or use your real app)
35cp -r examples/auth-pilot ~/Desktop/auth-pilot-dogfood
36cd ~/Desktop/auth-pilot-dogfood
37
38# 2. Wire to cloud (Convex-style)
39briven setup --name auth-pilot
40# or: briven connect p_YOUR_EXISTING_PILOT
41
42# 3. Auth files + package
43briven auth scaffold
44pnpm add @briven/auth
45
46# 4. Dashboard: project → Auth → Enable → API keys → create
47# pk_briven_auth_… only (never put brk_ in the browser)
48
49# 5. Paste into .env.local (do not commit)
50# NEXT_PUBLIC_BRIVEN_PROJECT_ID=p_…
51# NEXT_PUBLIC_BRIVEN_API_ORIGIN=https://api.briven.tech
52# NEXT_PUBLIC_BRIVEN_AUTH_KEY=pk_briven_auth_…
53# BRIVEN_AUTH_PUBLIC_KEY=pk_briven_auth_…
54
55# 6. Run Next, open /sign-in
56# 7. YOU: AUTH-GO-LIVE rows 3, 4, 7
57# 8. FRIEND: same URL — sign up with their email (soft gap closed)
58# 9. Isolation: second project must NOT list either user
59# → ./scripts/auth-isolation-check.sh
60```
61
62Record pass/fail in `docs/CLERK-GAP-EVIDENCE.md`.
63
64### Manual key path (if you already have a key)
65
66```sh
67briven login --project p_… --key brk_… # server/cli key only
68briven link
69briven auth scaffold
70```
71
72## Files in this folder
73
74```
75auth-pilot/
76├─ briven.json # name only until setup/link
77├─ middleware.ts # /api/auth/* → api.briven.tech/v1/auth-tenant/*
78├─ lib/
79│ └─ auth.ts # createBrivenAuth client
80├─ app/
81│ └─ sign-in/
82│ └─ page.tsx # hosted sign-in redirect button
83└─ README.md
84```
85
86## Security
87
88- Only `pk_briven_auth_…` in the browser.
89- Never commit a filled `.env.local`.
90- Do not paste full keys into chat.
91
92## Docs
93
94- https://docs.briven.tech/auth
95- https://docs.briven.tech/connect
96- Repo: `AUTH-GO-LIVE-CHECKLIST.md`, `BETA-V1-NEXT-STEPS.md`, `docs/S6-RELIABILITY.md`
Preview

auth-pilot

Smallest trustworthy Briven Auth setup for a real browser test (dogfood kit).

For humans: follow repo root AUTH-GO-LIVE-CHECKLIST.md + BETA-V1-NEXT-STEPS.md.
For agents: follow the briven-auth skill.

What you get

Not a full product UI — a wiring kit:

  1. Next-style middleware.ts that forwards /api/auth/* to Briven
  2. lib/auth.ts using @briven/auth
  3. Env template for project id + pk_briven_auth_…
  4. One hosted sign-in button pattern

Email + password only is enough for a pilot. Turn on Google/magic link later in the dashboard.

If you enable two-factor: after password sign-in, users may hit the hosted /auth/<projectId>/two-factor step (authenticator code or a backup recovery code). In React apps use TwoFactorChallenge from @briven/auth/react.

For CI/e2e: mint a testing token in the dashboard (or admin API) and call auth.signIn.testToken(process.env.BRIVEN_AUTH_TEST_TOKEN!).

10-minute dogfood path (recommended)

This is the Clerk-gap soft item: a second human can sign up without you pasting code at them.

# 0. Platform awake
#    ./scripts/s6-auth-verify.sh

# 1. Copy this kit outside the monorepo (or use your real app)
cp -r examples/auth-pilot ~/Desktop/auth-pilot-dogfood
cd ~/Desktop/auth-pilot-dogfood

# 2. Wire to cloud (Convex-style)
briven setup --name auth-pilot
#    or: briven connect p_YOUR_EXISTING_PILOT

# 3. Auth files + package
briven auth scaffold
pnpm add @briven/auth

# 4. Dashboard: project → Auth → Enable → API keys → create
#    pk_briven_auth_… only (never put brk_ in the browser)

# 5. Paste into .env.local (do not commit)
#    NEXT_PUBLIC_BRIVEN_PROJECT_ID=p_…
#    NEXT_PUBLIC_BRIVEN_API_ORIGIN=https://api.briven.tech
#    NEXT_PUBLIC_BRIVEN_AUTH_KEY=pk_briven_auth_…
#    BRIVEN_AUTH_PUBLIC_KEY=pk_briven_auth_…

# 6. Run Next, open /sign-in
# 7. YOU: AUTH-GO-LIVE rows 3, 4, 7
# 8. FRIEND: same URL — sign up with their email (soft gap closed)
# 9. Isolation: second project must NOT list either user
#    → ./scripts/auth-isolation-check.sh

Record pass/fail in docs/CLERK-GAP-EVIDENCE.md.

Manual key path (if you already have a key)

briven login --project p_… --key brk_…   # server/cli key only
briven link
briven auth scaffold

Files in this folder

auth-pilot/
├─ briven.json          # name only until setup/link
├─ middleware.ts        # /api/auth/* → api.briven.tech/v1/auth-tenant/*
├─ lib/
│  └─ auth.ts           # createBrivenAuth client
├─ app/
│  └─ sign-in/
│     └─ page.tsx       # hosted sign-in redirect button
└─ README.md

Security

  • Only pk_briven_auth_… in the browser.
  • Never commit a filled .env.local.
  • Do not paste full keys into chat.

Docs