feat: Better Auth OAuth/OIDC server for the Intervals.icu MCP product

DCR-capable (RFC 7591) OAuth authorization server so Claude's MCP connector self-registers — the thing Authentik can't do until 2026.8.0. Users sign in with Google/Apple; oidcProvider + jwt issue asymmetric JWTs (JWKS) the MCP server verifies. Shares the existing CNPG Postgres (own `betterauth` schema). Scaffold: auth config, minimal Node server + login page, Dockerfile, CI.
2026-07-05 16:14:32 -04:00
commit f47d873262
9 changed files with 3646 additions and 0 deletions
@@ -0,0 +1,36 @@
+name: build
+on:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: catthehacker/ubuntu:act-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: npm ci
+      - run: npm run typecheck
+
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    container:
+      image: catthehacker/ubuntu:act-latest
+    env:
+      IMAGE: git.farh.net/farhoodlabs/intervalsicu-mcp-auth
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v3
+      - name: Log in to registry
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u cpfarhood --password-stdin
+      - name: Build and push
+        run: |
+          docker build -t "$IMAGE:${GITHUB_SHA}" -t "$IMAGE:latest" .
+          docker push "$IMAGE:${GITHUB_SHA}"
+          docker push "$IMAGE:latest"