Skip to content

Tenant Lifecycle and Verification with Browser app and auth - #1

Open
kumanday wants to merge 20 commits into
mainfrom
feat/client
Open

kumanday wants to merge 20 commits into
mainfrom
feat/client

Conversation

@kumanday

@kumanday kumanday commented Mar 9, 2026

Copy link
Copy Markdown
Owner

Summary

This PR turns OCTW into a browser-first deploy-and-chat flow with containerized public ingress.

It adds:

  • reverse-proxy OIDC login for the browser app
  • one-tenant-per-user deploy-or-resume flow
  • verified tenant readiness before reporting success
  • authenticated WebSocket proxying for chat
  • containerized nginx + oauth2-proxy in Compose
  • config/docs updates for Keycloak and Google Workspace

What Changed

Browser app and auth

  • Added /app and /app/chat as the OCTW browser entrypoint.
  • Added GET /api/v1/app/session to bootstrap browser sessions.
  • Added POST /api/v1/app/deploy-or-resume for idempotent one-click create/resume.
  • Added trusted reverse-proxy session bootstrap using forwarded email headers.
  • Continued using octw_session, now issued from the browser app flow as well.

Tenant lifecycle and verification

  • Switched v1 app behavior to one tenant per user.
  • Added deterministic user-owned tenant slug generation.
  • Extended provisioning so success means verified, not just started.
  • Verification now checks:
    • openclaw.json exists
    • container starts
    • gateway health responds
    • server-side WebSocket connection succeeds
  • Persisted verification state/error metadata on tenants.

Edge proxy and OpenClaw integration

  • Upgraded octw-edge from HTTP-only forwarding to HTTP + WebSocket proxying.
  • Added /t/{slug}/ws for browser chat traffic.
  • Added membership checks before tenant proxying.
  • Added wake-on-connect / wake-on-request behavior.
  • Connected octw-edge to tenant Docker networks.
  • Rewrote tenant OpenClaw config for trusted-proxy auth and explicit allowedOrigins.
  • Removed reliance on insecure auth/device-auth fallbacks.

Containerized ingress

  • Added octw-proxy (nginx) and octw-oidc (oauth2-proxy) to docker-compose.
  • Public traffic now terminates at octw-proxy on 80/443.
  • octw-api and octw-edge remain bound to 127.0.0.1 for operator use.
  • Added self-signed cert bootstrap if no certs are mounted yet.

Config and docs

  • Added sample env file:
    • .env.example
  • Added production-oriented oauth2-proxy config:
    • configs/oauth2-proxy/oauth2-proxy.cfg
  • Added provider examples:
    • configs/oauth2-proxy/keycloak.example.cfg
    • configs/oauth2-proxy/google-workspace.example.cfg
  • Updated README and docs to reflect:
    • browser app flow
    • new app endpoints
    • containerized ingress/OIDC
    • trusted-proxy security model
    • verified provisioning behavior

API Additions

  • GET /api/v1/app/session
  • POST /api/v1/app/deploy-or-resume
  • WebSocket path: /t/{slug}/ws

Config Additions

  • OCTW_PUBLIC_BASE_URL
  • OCTW_DEFAULT_PROVIDER
  • OCTW_TRUSTED_PROXY_ENABLED
  • OCTW_TRUSTED_PROXY_USER_HEADER
  • OCTW_TRUSTED_PROXY_IPS
  • OCTW_API_INTERNAL_BASE_URL
  • OCTW_OIDC_PROVIDER
  • OCTW_OIDC_CONFIG_FILE
  • OCTW_OIDC_ISSUER_URL
  • OCTW_OIDC_CLIENT_ID
  • OCTW_OIDC_CLIENT_SECRET
  • OCTW_OIDC_COOKIE_SECRET
  • OCTW_OIDC_EMAIL_DOMAINS
  • OCTW_OIDC_WHITELIST_DOMAINS

Validation

Ran:

  • docker compose --env-file .env.example config
  • uv run ruff check src tests
  • uv run pytest tests/unit -q

Result:

  • 37 passed

Notes

  • This PR does not include live IdP credentials or a real domain-backed OIDC acceptance test.
  • Google Workspace group restriction is documented and scaffolded, but requires Admin SDK service-account setup.
  • Self-signed cert generation is for bootstrap only; production should mount a real cert.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a1557d13d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/orchestrator/tenant_service.py
Comment thread src/octw/web/static/app.js
Comment thread src/octw/api/routers/app_router.py
@github-advanced-security

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out
the documentation.

1 similar comment
@github-advanced-security

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out
the documentation.

Comment thread src/octw/api/app_logic.py
Comment thread src/octw/web/static/app.css
Comment thread src/octw/edge/proxy.py
Comment thread src/octw/orchestrator/docker_orch.py Dismissed
Comment thread src/octw/orchestrator/docker_orch.py Dismissed
@kumanday kumanday changed the title Plan Tenant Wrapper subprojects Tenant Lifecycle and Verification with Browser app and auth Mar 9, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5b2838db7b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/db/tables.py
Comment thread src/octw/api/routers/provision_router.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5b2838db7b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/web/static/app.js

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f9038a4cb1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/api/auth.py Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0c65803d9c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/orchestrator/docker_orch.py
Comment thread src/octw/db/engine.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b51a69fe78

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread configs/nginx/default.conf.template
Comment thread src/octw/api/app_logic.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b0f17f1308

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread configs/nginx/default.conf.template

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8a27d58bbc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/db/engine.py
Comment thread src/octw/orchestrator/docker_orch.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f03bb30a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/api/app_logic.py
Comment thread src/octw/orchestrator/tenant_service.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 27a6efbcf6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/orchestrator/docker_orch.py
Comment thread src/octw/api/app_logic.py
Comment thread src/octw/api/routers/app_router.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8d5a01c633

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/api/app_logic.py
Comment thread src/octw/orchestrator/docker_orch.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd74c1ae8f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/api/routers/app_router.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4c01b4ae4d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/api/app_logic.py
Comment thread src/octw/orchestrator/docker_orch.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b892927e9f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/orchestrator/tenant_service.py
Comment thread src/octw/api/app_logic.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b892927e9f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/api/app_logic.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6ff71f0061

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/octw/web/static/app.js
@kumanday

Copy link
Copy Markdown
Owner Author

All review issues have been addressed. Waiting for a new rounds of testing before merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants