Support Workers identity bindings and caller runtime types by irvinebroque · Pull Request #465 · cloudflare/cf

irvinebroque · 2026-10-31T19:18:41Z

Consume direct JSRPC identity bindings through the matching SDK configuration, upload, Preview, local-stub, and generated-type packages. Pin all ten SDK previews to 87c195a, published from workers-sdk PR #16455.

const customer = await env.IDENTITY.getIdentity("customer-x");
const signatureAgent = await customer.signatureAgent;
await customer.fetch("https://api.example.com");

Selected identities are fixed-selection RPC stubs with asynchronous readonly metadata and normal forwarding, duplication, and disposal. Normalize URL, FormData, and URLSearchParams inputs with new Request(...) before selected-handle fetch. Select the default identity with getIdentity() before fetching; the parent has no public fetch method. AbortSignal options and cross-RPC cancellation guarantees are outside this contract. No identity-specific runtime wrapper, customer SDK import, or identity compatibility flag is needed. Token audience remains optional and is required only for getToken(); HTTP signing has no public profile selector. Local identity operations remain unavailable: use mocks or deployed Previews.

Validation: normal frozen install passes with the committed supply-chain policy unchanged. The lockfile changes only SDK URLs/integrities; dependency versions are unchanged. Exact root pnpm check passes 7/7 tasks (8014 formatted files,564 linted files). Focused configuration and actual workers-types command tests pass 10/10. SDK prerelease workflow 41243938912 passes; its config 327, Wrangler type-generation 137, local 2, Preview 26, compiler and lint checks pass.

Draft; no deployment or provisioning performed. Account enablement, security review, live receiver enrollment/provider compatibility, and edge performance remain release gates. Full platform CI is reported in checks.

Runtime receiver update: preserve runtime-generated CloudflareIdentityContext.caller() types for Workers with no outbound identity binding. Add no receiver configuration or JavaScript polyfill. caller means the authenticated software making the request, separate from any human identity.

Validation: all 10 workers types command tests pass, including binding-free caller type passthrough. The existing SDK preview pins remain available artifacts; a matched runtime/SDK/types release is still required before advertising receiver support. See docs/workers-oidc.md for the release dependency.

Pin the SDK packages to 40ff3ab so configuration, development sessions, and deployment share the reviewed audience validation. Keep the dependency integrity lock and supply-chain policy enabled.

Pin the reviewed Workers SDK prerelease for fixed audiences, fresh grants and signed fetch. Preserve development auth-profile forwarding and update config tests and release notes.

pkg-pr-new · 2026-10-31T19:50:09Z

npm i https://pkg.pr.new/cf@465

commit: a19a558

ask-bonk · 2026-10-31T19:50:30Z

LGTM

github run

github-actions · 2026-10-31T19:51:20Z

`cf --help` startup

	mean	stddev	min	max
PR	280.0 ms	5.2 ms	274.6 ms	291.6 ms
base	279.3 ms	4.5 ms	271.8 ms	285.2 ms

Δ (PR vs base): — +0.7 ms (+0.2%)

Measured with hyperfine on ubuntu-latest (3 warmup runs, 20 timed runs). CI numbers carry ±a few ms of runner jitter; treat small deltas as noise.

ask-bonk · 2026-10-31T19:59:44Z

LGTM!

github run

Remove identity-specific local auth profile forwarding. Consume matching SDK packages with explicit unsupported local methods and deployed Preview support. Preserve identity configuration and upload validation.

ask-bonk · 2026-10-31T20:32:04Z

LGTM!

github run

…tion

ask-bonk · 2026-10-31T21:08:39Z

+					/\/oidc\/(identities|assignments|development_sessions)/.test(request)
+				)
+			).toBe(false);
+		});


The deploy test only uploads identity bindings with an audience, so a regression in the newly supported signing-only serialization path would still pass. Add a deployed signing-only case:

Suggested change

});

});

it("uploads signing-only identity bindings without provisioning identities", async () => {

const requests = recordRequests();

const upload = mockWorkerUpload();

await seed({

".cloudflare/output/v0/config.json": buildOutputRootConfig(),

".cloudflare/output/v0/workers/default/worker.config.json":

workerConfig({

compatibilityFlags: ["workers_oidc"],

env: {

IDENTITY: {

type: "identity",

request_signing: {

allowed_origins: ["https://api.example.com"],

allowed_methods: ["GET"],

},

},

},

}),

".cloudflare/output/v0/workers/default/bundle/index.js":

"export default {fetch() {return new Response('ok')}}",

});

const { exitCode } = await runCf([

"deploy",

"--prebuilt",

"--no-provision",

]);

expect(exitCode).toBe(0);

expect(upload.metadata?.bindings).toContainEqual({

name: "IDENTITY",

type: "identity",

request_signing: {

allowed_origins: ["https://api.example.com"],

allowed_methods: ["GET"],

},

});

expect(

requests.some((request) =>

/\/oidc\/(identities|assignments|development_sessions)/.test(request)

)

).toBe(false);

});

ask-bonk · 2026-10-31T21:08:45Z

🤖 I've done a thorough review of your PR.

Pins the Workers SDK previews and adds identity binding configuration/type tests.

Warning: deploy/index.test.ts:94 lacks signing-only identity upload coverage; an upload serialization regression would pass. Suggested inline.

github run

ask-bonk · 2026-10-31T21:30:37Z

No new concerns since the last review

github run

ask-bonk · 2026-10-31T21:37:46Z

No new concerns since the last review

github run

ask-bonk · 2026-10-31T22:19:06Z

No new concerns since the last review

github run

ask-bonk · 2026-10-31T23:02:08Z

No new concerns since the last review

github run

irvinebroque added 5 commits October 22, 2026 22:01

fix(dev): forward selected auth profile to development servers

a4a3495

feat: support explicit OIDC identity bindings

69a29eb

fix: use reviewed OIDC validation in cf

deae4ce

Pin the SDK packages to 40ff3ab so configuration, development sessions, and deployment share the reviewed audience validation. Keep the dependency integrity lock and supply-chain policy enabled.

feat: expose identity bindings through the matching SDK build

e2ee875

Pin the reviewed Workers SDK prerelease for fixed audiences, fresh grants and signed fetch. Preserve development auth-profile forwarding and update config tests and release notes.

feat: integrate identity bindings with current SDK and dev auth

001dbbc

chore: consume identity migration SDK prerelease

16b3881

refactor: defer local identity issuance in cf

6b5975c

Remove identity-specific local auth profile forwarding. Consume matching SDK packages with explicit unsupported local methods and deployed Preview support. Preserve identity configuration and upload validation.

irvinebroque changed the title ~~Support fresh Workers identity operations in cf dev~~ Oct 31, 2026

Consume unified managed WBA identity SDK and signing-only type genera…

3083b64

…tion

ask-bonk Bot reviewed Oct 31, 2026

View reviewed changes

feat: use direct JSRPC identity binding previews

563a235

refactor: select all identities through direct JSRPC handles

a15657b

Cover runtime caller types without receiver configuration

7f0e572

irvinebroque changed the title ~~Support deployed Workers identity bindings in cf~~ Oct 31, 2026

Verify native caller types without receiver configuration

a19a558

Navigation Menu

Repository navigation

Support Workers identity bindings and caller runtime types - #465

Support Workers identity bindings and caller runtime types#465
irvinebroque wants to merge 12 commits into
mainfrom
codex/workers-oidc-local-dev

irvinebroque commented Oct 31, 2026 •

edited

Loading

pkg-pr-new Bot commented Oct 31, 2026 •

edited

Loading

ask-bonk Bot commented Oct 31, 2026

github-actions Bot commented Oct 31, 2026 •

edited

Loading

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot Oct 31, 2026

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot commented Oct 31, 2026

Uh oh!

Labels

1 participant

-		});
+		});
+		it("uploads signing-only identity bindings without provisioning identities", async () => {
+			const requests = recordRequests();
+			const upload = mockWorkerUpload();
+			await seed({
+				".cloudflare/output/v0/config.json": buildOutputRootConfig(),
+				".cloudflare/output/v0/workers/default/worker.config.json":
+					workerConfig({
+						compatibilityFlags: ["workers_oidc"],
+						env: {
+							IDENTITY: {
+								type: "identity",
+								request_signing: {
+									allowed_origins: ["https://api.example.com"],
+									allowed_methods: ["GET"],
+								},
+							},
+						},
+					}),
+				".cloudflare/output/v0/workers/default/bundle/index.js":
+					"export default {fetch() {return new Response('ok')}}",
+			});
+			const { exitCode } = await runCf([
+				"deploy",
+				"--prebuilt",
+				"--no-provision",
+			]);
+			expect(exitCode).toBe(0);
+			expect(upload.metadata?.bindings).toContainEqual({
+				name: "IDENTITY",
+				type: "identity",
+				request_signing: {
+					allowed_origins: ["https://api.example.com"],
+					allowed_methods: ["GET"],
+				},
+			});
+			expect(
+				requests.some((request) =>
+					/\/oidc\/(identities|assignments|development_sessions)/.test(request)
+				)
+			).toBe(false);
+		});

Conversation

irvinebroque commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

pkg-pr-new Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ask-bonk Bot commented Oct 31, 2026

github-actions Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

cf --help startup

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot Oct 31, 2026

Choose a reason for hiding this comment

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot commented Oct 31, 2026

ask-bonk Bot commented Oct 31, 2026

Uh oh!

Labels

1 participant

irvinebroque commented Oct 31, 2026 •

edited

Loading

pkg-pr-new Bot commented Oct 31, 2026 •

edited

Loading

github-actions Bot commented Oct 31, 2026 •

edited

Loading

`cf --help` startup