feat(cloud): per-project independent auth on cloud objectos

Each project owns its own users in its own Turso DB:
- AuthPlugin moves from host kernel to per-project kernel via
  ArtifactKernelFactory (HKDF-derived per-project secret)
- New AuthProxyPlugin mounts /api/v1/auth/* on the host Hono app and
  forwards Web Request to the per-project AuthManager.handleRequest
- Per-project ObjectQLPlugin has skipSchemaSync:false so sys_user/
  sys_session tables provision on first cold-start
- Removed dispatcher /auth/* wildcard (was hijacking before AuthProxy
  via mockAuthFallback)
- Removed OS_COOKIE_DOMAIN so cookies stay scoped per-project hostname
- Strengthened CLI guard to skip host AuthPlugin in runtime mode

Verified: sign-up, sign-in, get-session, cookie isolation across
crm.objectos.app and other project subdomains.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

apps/objectos/cloudflare/worker.ts

@@ -95,7 +95,7 @@ const FORWARDED_ENV_KEYS: readonly (keyof Env)[] = [
     // auth
     'AUTH_SECRET', 'OS_AUTH_SECRET',
     'AUTH_BASE_URL', 'OS_BASE_URL',
-    'OS_TRUSTED_ORIGINS', 'OS_COOKIE_DOMAIN', 'OS_ROOT_DOMAIN',
+    'OS_TRUSTED_ORIGINS', 'OS_ROOT_DOMAIN',
     'GOOGLE_CLIENT_ID', 'GOOGLE_CLIENT_SECRET',
     'GITHUB_CLIENT_ID', 'GITHUB_CLIENT_SECRET',
     // cloud client

apps/objectos/wrangler.toml

@@ -44,7 +44,7 @@ compatibility_flags = ["nodejs_compat"]
 # rebuild + re-push to ship a new version, then run `wrangler deploy`.
 [[containers]]
 class_name = "ObjectOSContainer"
-image = "registry.cloudflare.com/2846eb40a60f4738e292b90dcd8cce10/objectos:59ed1a93-r2"
+image = "registry.cloudflare.com/2846eb40a60f4738e292b90dcd8cce10/objectos:per-project-auth-14"
 max_instances = 5
 instance_type = "standard-1"
 

packages/cli/src/commands/serve.ts

@@ -591,7 +591,22 @@ export default class Serve extends Command {
             ?? process.env.OS_AUTH_SECRET
             ?? (isDev ? 'dev-only-insecure-secret-change-me-in-production' : undefined);
 
-          if (!secret) {
+          // Guard: in cloud-connected runtime mode (e.g. objectos worker)
+          // the host kernel is a pure routing shell. Auth is owned by each
+          // per-project kernel (`ArtifactKernelFactory` injects an
+          // `AuthPlugin` per project against the project's own DB so users
+          // persist and stay isolated per subdomain). Injecting a host-level
+          // AuthPlugin here would compete with the per-project one — its
+          // shared OS_AUTH_SECRET would erroneously validate cookies across
+          // unrelated projects. Refuse to inject in runtime mode.
+          const cloudUrl = process.env.OS_CLOUD_URL?.trim();
+          const isRuntimeMode = !!cloudUrl && cloudUrl.toLowerCase() !== 'local' && cloudUrl.toLowerCase() !== 'off';
+          if (isRuntimeMode) {
+            console.warn(chalk.yellow(
+              '  ⚠ AuthPlugin skipped on host kernel — runtime mode (OS_CLOUD_URL set).\n' +
+              '    Auth is owned per-project by ArtifactKernelFactory (see service-cloud).'
+            ));
+          } else if (!secret) {
             console.warn(chalk.yellow('  ⚠ AuthPlugin skipped — set AUTH_SECRET to enable authentication in production'));
           } else {
             const baseUrl = process.env.AUTH_BASE_URL

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -35,6 +35,17 @@ export interface AuthPluginOptions extends Partial<AuthConfig> {
    * @default '/api/v1/auth'
    */
   basePath?: string;
+
+  /**
+   * Override the datasource that owns the identity tables (sys_user,
+   * sys_session, …) when AuthPlugin's manifest is registered.
+   *
+   * Defaults to `'cloud'` (control-plane DB) so the historical
+   * single-tenant control-plane behaviour is preserved. Per-project
+   * kernels in objectos pass `'default'` so identity tables live in the
+   * project's own database — each project owns its own users.
+   */
+  manifestDatasource?: string;
 }
 
 /**
@@ -107,6 +118,9 @@ export class AuthPlugin implements Plugin {
 
     ctx.getService<{ register(m: any): void }>('manifest').register({
       ...authPluginManifestHeader,
+      ...(this.options.manifestDatasource
+        ? { defaultDatasource: this.options.manifestDatasource }
+        : {}),
       objects: authIdentityObjects,
       // The platform Setup App is a static metadata artifact (lives in
       // @objectstack/platform-objects/apps). plugin-auth is the natural

packages/runtime/src/dispatcher-plugin.ts

@@ -230,6 +230,16 @@ export function createDispatcherPlugin(config: DispatcherPluginConfig = {}): Plu
             });
 
             // ── Auth ────────────────────────────────────────────────────
+            // NOTE: /auth/* wildcard is mounted by AuthProxyPlugin (cloud)
+            // or AuthPlugin (single-tenant) directly on the raw Hono app —
+            // those handlers can return native Web `Response` objects which
+            // is what better-auth produces. The dispatcher cannot represent
+            // a streaming Response cleanly through `IHttpServer.send`, so
+            // we deliberately do NOT register a dispatcher wildcard here.
+            //
+            // Legacy explicit /auth/login retained for self-hosted clients
+            // that still POST there; superseded by the wildcard above for
+            // the better-auth surface (sign-up/email, sign-in/email, …).
             server.post(`${prefix}/auth/login`, async (req: any, res: any) => {
                 try {
                     const result = await dispatcher.handleAuth('login', 'POST', req.body, { request: req });

packages/runtime/src/http-dispatcher.ts

@@ -294,11 +294,14 @@ export class HttpDispatcher {
      * so project-scoped meta routes can resolve their project).
      */
     private async resolveEnvironmentContext(context: HttpProtocolContext, path: string): Promise<void> {
-        // Skip environment resolution for control-plane routes.
-        // NOTE: /meta is intentionally not in this list anymore — a scoped
+        // Skip environment resolution for control-plane routes only.
+        // NOTE: /meta is intentionally not in this list — a scoped
         // /projects/:id/meta path still needs the project resolved so the
         // protocol can scope its answer.
-        const skipPaths = ['/auth', '/cloud', '/health', '/discovery'];
+        // NOTE: /auth was removed — per-project AuthPlugin needs the
+        // hostname-resolved projectId so the dispatcher kernel-swap routes
+        // to the project's auth manager (not the host's).
+        const skipPaths = ['/cloud', '/health', '/discovery'];
         if (skipPaths.some(p => path.startsWith(p))) {
             return;
         }

packages/services/service-cloud/src/artifact-kernel-factory.ts

@@ -13,12 +13,20 @@
  *     plane: each project kernel only knows about its own data driver.
  *
  * The kernel is bootstrapped with:
- *   • DriverPlugin(driver)  — project-scoped data driver
+ *   • DriverPlugin(driver)  — project-scoped data driver, also aliased
+ *                              as the `'cloud'` datasource so AuthPlugin's
+ *                              identity manifest resolves locally.
  *   • ObjectQLPlugin
  *   • MetadataPlugin (no system-object registration)
+ *   • AuthPlugin    — per-project, derives an HKDF secret from
+ *                     `OS_AUTH_SECRET` + projectId. Each project owns its
+ *                     own `sys_user/sys_session/...` tables in its own
+ *                     Turso DB. Cookies are scoped to the project's
+ *                     hostname (no `.<root>`-wide cross-project leak).
  *   • AppPlugin(artifact.metadata)  — compiled developer code
  */
 
+import { createHmac } from 'node:crypto';
 import { ObjectKernel } from '@objectstack/core';
 import type * as Contracts from '@objectstack/spec/contracts';
 import { DriverPlugin, AppPlugin } from '@objectstack/runtime';
@@ -35,19 +43,44 @@ export interface ArtifactKernelFactoryConfig {
     logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };
     /** Optional kernel constructor config. */
     kernelConfig?: ConstructorParameters<typeof ObjectKernel>[0];
+    /**
+     * Base secret used to derive per-project AuthPlugin secrets via
+     * HKDF-style HMAC-SHA256(baseSecret, projectId). Falls back to
+     * `process.env.OS_AUTH_SECRET` / `AUTH_SECRET` at construction time.
+     */
+    authBaseSecret?: string;
+}
+
+/**
+ * Derive a deterministic per-project auth secret. HMAC-SHA256 of the
+ * projectId keyed by the base secret yields a 64-char hex string that is:
+ *   - stable across container cold-starts (no DB lookup needed)
+ *   - independent per project (forging a token on project A does not
+ *     compromise project B)
+ *   - rotatable by changing the base secret (will invalidate all sessions)
+ */
+function deriveProjectAuthSecret(baseSecret: string, projectId: string): string {
+    return createHmac('sha256', baseSecret).update(`project:${projectId}`).digest('hex');
 }
 
 export class ArtifactKernelFactory implements ProjectKernelFactory {
     private readonly client: ArtifactApiClient;
     private readonly envRegistry: EnvironmentDriverRegistry;
     private readonly logger: NonNullable<ArtifactKernelFactoryConfig['logger']>;
     private readonly kernelConfig?: ArtifactKernelFactoryConfig['kernelConfig'];
+    private readonly authBaseSecret: string;
 
     constructor(config: ArtifactKernelFactoryConfig) {
         this.client = config.client;
         this.envRegistry = config.envRegistry;
         this.logger = config.logger ?? console;
         this.kernelConfig = config.kernelConfig;
+        this.authBaseSecret = (
+            config.authBaseSecret
+            ?? process.env.OS_AUTH_SECRET
+            ?? process.env.AUTH_SECRET
+            ?? ''
+        ).trim();
     }
 
     async create(projectId: string): Promise<ObjectKernel> {
@@ -76,15 +109,62 @@ export class ArtifactKernelFactory implements ProjectKernelFactory {
 
         const kernel = new ObjectKernel(this.kernelConfig);
 
-        await kernel.use(new DriverPlugin(driver));
-        await kernel.use(new ObjectQLPlugin({ projectId: projectId }));
+        // Register the project driver as both the unnamed default AND under
+        // the `'cloud'` alias. AuthPlugin's manifest header historically
+        // declares `defaultDatasource: 'cloud'`; aliasing here keeps that
+        // path working without forcing every project's identity table
+        // through a control-plane proxy.
+        await kernel.use(new DriverPlugin(driver, { datasourceName: 'cloud' } as any));
+        // Enable schema sync per-project so sys_user / sys_session / etc.
+        // tables get created on the project's own DB. The host worker sets
+        // `OS_SKIP_SCHEMA_SYNC=1` for the control-plane DB; that env var
+        // must NOT bleed into project kernels because their auth tables
+        // need provisioning. KernelManager caches kernels so this runs
+        // at most once per cold-start per project.
+        await kernel.use(new ObjectQLPlugin({ projectId: projectId, skipSchemaSync: false }));
         await kernel.use(new MetadataPlugin({
             watch: false,
             projectId: projectId,
             organizationId: project.organization_id,
             registerSystemObjects: false,
         }));
 
+        // Per-project AuthPlugin — only when an OS_AUTH_SECRET base is
+        // configured. Without it we cannot derive a secret deterministically
+        // and refuse to start auth (better silent-fail than insecure default).
+        if (this.authBaseSecret) {
+            try {
+                const { AuthPlugin } = await import('@objectstack/plugin-auth');
+                const projectSecret = deriveProjectAuthSecret(this.authBaseSecret, projectId);
+                const baseUrl = project.hostname
+                    ? (project.hostname.startsWith('http') ? project.hostname : `https://${project.hostname}`)
+                    : undefined;
+                await kernel.use(new AuthPlugin({
+                    secret: projectSecret,
+                    baseUrl,
+                    // Project kernel has no http-server (host owns it). The
+                    // dispatcher's handleAuth path resolves `auth` via
+                    // getService and invokes the handler directly — route
+                    // registration is unnecessary and would warn.
+                    registerRoutes: false,
+                    // Identity tables live in the project's own DB — keep
+                    // sys_user/sys_session local to this kernel.
+                    manifestDatasource: 'default',
+                    // Cookie scope: default to the project's own host. We
+                    // intentionally do NOT pass crossSubDomainCookies here
+                    // so cookies stay isolated per project subdomain.
+                    trustedOrigins: baseUrl ? [baseUrl] : undefined,
+                } as any));
+            } catch (err: any) {
+                this.logger.warn?.('[ArtifactKernelFactory] AuthPlugin not registered', {
+                    projectId,
+                    error: err?.message,
+                });
+            }
+        } else {
+            this.logger.warn?.('[ArtifactKernelFactory] OS_AUTH_SECRET not set — per-project AuthPlugin skipped (auth endpoints will return 404)', { projectId });
+        }
+
         const projectName = project.hostname ?? projectId;
         const bundle = artifact.metadata as any;
         const sys = bundle?.manifest ?? bundle;
@@ -104,6 +184,7 @@ export class ArtifactKernelFactory implements ProjectKernelFactory {
             projectId,
             commitId: artifact.commitId,
             checksum: artifact.checksum,
+            authEnabled: Boolean(this.authBaseSecret),
         });
 
         return kernel;

packages/services/service-cloud/src/auth-proxy-plugin.ts

@@ -0,0 +1,152 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * AuthProxyPlugin
+ *
+ * Mounts a single `/api/v1/auth/*` wildcard route on the host's Hono server
+ * that forwards every request to the per-project `AuthManager` registered
+ * by `ArtifactKernelFactory`.
+ *
+ * Why a dedicated plugin: AuthPlugin (better-auth) registers its routes by
+ * grabbing the host's `http-server` service from its own `PluginContext`.
+ * In objectos runtime mode AuthPlugin lives on a per-project kernel — it
+ * has no access to the host's HTTP server, so its `kernel:ready` route
+ * registration is a no-op. The dispatcher plugin's wildcard registration
+ * via `IHttpServer.post('/auth/*', …)` proved unreliable in practice,
+ * so this plugin uses Hono's raw app directly (same path AuthPlugin took
+ * historically) which is rock solid.
+ *
+ * Routing:
+ *   1. Resolve the project from the request hostname via `env-registry`.
+ *   2. Acquire the project's kernel via `kernel-manager`.
+ *   3. Look up the `auth` service on that kernel — this is the better-auth
+ *      handler injected by `ArtifactKernelFactory`.
+ *   4. Build a Web `Request` using the project's canonical baseUrl and
+ *      hand it to the better-auth handler.
+ *   5. Stream the response back through Hono.
+ */
+
+import type { Plugin, PluginContext } from '@objectstack/core';
+import type { KernelManager } from './kernel-manager.js';
+import type { EnvironmentDriverRegistry } from './environment-registry.js';
+
+const AUTH_PREFIX = '/api/v1/auth';
+
+interface AuthCapableManager {
+    handler?: (req: Request) => Promise<Response>;
+    getApi?: () => Promise<{ handler: (req: Request) => Promise<Response> }>;
+    api?: { handler: (req: Request) => Promise<Response> };
+}
+
+function pickHandler(svc: any): ((req: Request) => Promise<Response>) | undefined {
+    if (!svc) return undefined;
+    // AuthManager exposes handleRequest(req) — preferred entry point.
+    if (typeof svc.handleRequest === 'function') return svc.handleRequest.bind(svc);
+    if (typeof svc.handler === 'function') return svc.handler.bind(svc);
+    if (svc.api && typeof svc.api.handler === 'function') return svc.api.handler.bind(svc.api);
+    // AuthManager keeps the better-auth instance under `auth`.
+    if (svc.auth && typeof svc.auth.handler === 'function') return svc.auth.handler.bind(svc.auth);
+    return undefined;
+}
+
+async function resolveAuthHandler(svc: any): Promise<((req: Request) => Promise<Response>) | undefined> {
+    const direct = pickHandler(svc);
+    if (direct) return direct;
+    if (typeof svc?.getApi === 'function') {
+        try {
+            const api = await svc.getApi();
+            return pickHandler(api) ?? pickHandler({ api });
+        } catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+
+export class AuthProxyPlugin implements Plugin {
+    readonly name = 'com.objectstack.runtime.auth-proxy';
+    readonly version = '1.0.0';
+
+    init = async (_ctx: PluginContext): Promise<void> => {
+        // No services registered — pure HTTP wiring during start().
+    };
+
+    start = async (ctx: PluginContext): Promise<void> => {
+        // Mount routes on kernel:ready so HonoServerPlugin has finished
+        // registering the http-server service. Doing this in start() can
+        // race with HonoServerPlugin.init/start ordering.
+        ctx.hook('kernel:ready', async () => {
+            let httpServer: any;
+            try {
+                httpServer = ctx.getService('http-server');
+            } catch {
+                ctx.logger?.warn?.('[AuthProxyPlugin] http-server not available — auth routes not mounted');
+                return;
+            }
+            if (!httpServer || typeof httpServer.getRawApp !== 'function') {
+                ctx.logger?.warn?.('[AuthProxyPlugin] http-server missing getRawApp() — auth routes not mounted');
+                return;
+            }
+
+            const rawApp = httpServer.getRawApp();
+            const kernelManager = ctx.getService<KernelManager>('kernel-manager');
+            const envRegistry = ctx.getService<EnvironmentDriverRegistry>('env-registry');
+
+            const handler = async (c: any) => {
+                try {
+                    const url = new URL(c.req.url);
+                    const host = url.hostname;
+                    let projectId: string | undefined;
+                    try {
+                        const env = await envRegistry.resolveByHostname(host);
+                        projectId = env?.projectId;
+                    } catch {
+                        // ignore
+                    }
+                    if (!projectId) {
+                        return c.json({ error: 'project_not_found', host }, 404);
+                    }
+
+                    const projectKernel = await kernelManager.getOrCreate(projectId);
+                    let authSvc: any;
+                    try {
+                        authSvc = await (projectKernel as any).getServiceAsync?.('auth');
+                    } catch { authSvc = undefined; }
+                    if (!authSvc) {
+                        try { authSvc = (projectKernel as any).getService?.('auth'); } catch { /* ignore */ }
+                    }
+
+                    const fn = await resolveAuthHandler(authSvc);
+                    if (!fn) {
+                        return c.json({ error: 'auth_service_unavailable', projectId }, 503);
+                    }
+
+                    // Forward the original Web Request directly — better-auth
+                    // accepts a standard `Request` and returns a `Response`.
+                    return await fn(c.req.raw);
+                } catch (err: any) {
+                    ctx.logger?.error?.('[AuthProxyPlugin] auth dispatch failed', {
+                        error: err?.message,
+                        stack: err?.stack,
+                    });
+                    return c.json({
+                        error: 'auth_dispatch_failed',
+                        message: err?.message ?? String(err),
+                    }, 500);
+                }
+            };
+
+            // Mount on every method via Hono's `all`. AuthPlugin previously
+            // registered with `rawApp.all('/api/v1/auth/*', handler)` — same
+            // shape here.
+            if (typeof rawApp.all === 'function') {
+                rawApp.all(`${AUTH_PREFIX}/*`, handler);
+            } else {
+                for (const m of ['get', 'post', 'put', 'delete', 'patch', 'options'] as const) {
+                    try { rawApp[m]?.(`${AUTH_PREFIX}/*`, handler); } catch { /* best effort */ }
+                }
+            }
+            ctx.logger?.info?.(`[AuthProxyPlugin] auth proxy mounted at ${AUTH_PREFIX}/*`);
+        });
+    };
+}