feat: add new auth_request flow for logging in with comfy deploy

web/src/app/(app)/api/[[...routes]]/route.ts

@@ -1,4 +1,3 @@
-import { app } from "../../../../routes/app";
 import { registerCreateRunRoute } from "@/routes/registerCreateRunRoute";
 import { registerGetOutputRoute } from "@/routes/registerGetOutputRoute";
 import { registerUploadRoute } from "@/routes/registerUploadRoute";
@@ -6,6 +5,9 @@ import { isKeyRevoked } from "@/server/curdApiKeys";
 import { parseJWT } from "@/server/parseJWT";
 import type { Context, Next } from "hono";
 import { handle } from "hono/vercel";
+import { app } from "../../../../routes/app";
+import { registerWorkflowUploadRoute } from "@/routes/registerWorkflowUploadRoute";
+import { registerGetAuthResponse } from "@/routes/registerGetAuthResponse";
 
 export const dynamic = "force-dynamic";
 export const maxDuration = 300; // 5 minutes
@@ -21,7 +23,10 @@ async function checkAuth(c: Context, next: Next) {
   const userData = token ? parseJWT(token) : undefined;
   if (!userData || token === undefined) {
     return c.text("Invalid or expired token", 401);
-  } else {
+  }
+
+  // If the key has expiration, this is a temporary key and not in our db, so we can skip checking
+  if (userData.exp === undefined) {
     const revokedKey = await isKeyRevoked(token);
     if (revokedKey) return c.text("Revoked token", 401);
   }
@@ -31,18 +36,20 @@ async function checkAuth(c: Context, next: Next) {
   await next();
 }
 
-app.use("/run", async (c, next) => {
-  return checkAuth(c, next);
-});
-
-app.use("/upload-url", async (c, next) => {
-  return checkAuth(c, next);
-});
+app.use("/run", checkAuth);
+app.use("/upload-url", checkAuth);
+app.use("/upload-workflow", checkAuth);
 
+// create run endpoint
 registerCreateRunRoute(app);
 registerGetOutputRoute(app);
+
+// file upload endpoint
 registerUploadRoute(app);
 
+registerWorkflowUploadRoute(app);
+registerGetAuthResponse(app);
+
 // The OpenAPI documentation will be available at /doc
 app.doc("/doc", {
   openapi: "3.0.0",

web/src/app/(app)/api/file-upload/route.ts

@@ -1,11 +1,12 @@
-import { parseDataSafe } from "../../../../lib/parseDataSafe";
 import { handleResourceUpload } from "@/server/resource";
 import { NextResponse } from "next/server";
 import { z } from "zod";
+import { parseDataSafe } from "../../../../lib/parseDataSafe";
 
 const Request = z.object({
   file_name: z.string(),
   run_id: z.string(),
+
   type: z.string(),
 });
 
@@ -29,7 +30,7 @@ export async function GET(request: Request) {
       {
         url: uploadUrl,
       },
-      { status: 200 }
+      { status: 200 },
     );
   } catch (error: unknown) {
     const errorMessage =
@@ -38,7 +39,7 @@ export async function GET(request: Request) {
       {
         error: errorMessage,
       },
-      { status: 500 }
+      { status: 500 },
     );
   }
 }

web/src/app/(app)/api/upload/route.ts

@@ -1,17 +1,14 @@
-import { createNewWorkflow } from "../../../../server/createNewWorkflow";
-import { parseJWT } from "../../../../server/parseJWT";
-import { db } from "@/db/db";
-import {
-  snapshotType,
-  workflowAPIType,
-  workflowTable,
-  workflowType,
-  workflowVersionTable,
-} from "@/db/schema";
+import { snapshotType, workflowAPIType, workflowType } from "@/db/schema";
 import { parseDataSafe } from "@/lib/parseDataSafe";
-import { eq, sql } from "drizzle-orm";
 import { NextResponse } from "next/server";
 import { z } from "zod";
+import {
+  createNewWorkflow,
+  createNewWorkflowVersion,
+} from "../../../../server/createNewWorkflow";
+import { parseJWT } from "../../../../server/parseJWT";
+
+// This is will be deprecated
 
 const corsHeaders = {
   "Access-Control-Allow-Origin": "*",
@@ -55,7 +52,7 @@ export async function POST(request: Request) {
   const [data, error] = await parseDataSafe(
     UploadRequest,
     request,
-    corsHeaders
+    corsHeaders,
   );
 
   if (!data || error) return error;
@@ -75,7 +72,7 @@ export async function POST(request: Request) {
 
   // Case 1 new workflow
   try {
-    if ((!workflow_id || workflow_id.length == 0) && workflow_name) {
+    if ((!workflow_id || workflow_id.length === 0) && workflow_name) {
       // Create a new parent workflow
       const { workflow_id: _workflow_id, version: _version } =
         await createNewWorkflow({
@@ -91,56 +88,17 @@ export async function POST(request: Request) {
 
       workflow_id = _workflow_id;
       version = _version;
-
-      // const workflow_parent = await db
-      //   .insert(workflowTable)
-      //   .values({
-      //     user_id,
-      //     name: workflow_name,
-      //     org_id: org_id,
-      //   })
-      //   .returning();
-
-      // workflow_id = workflow_parent[0].id;
-
-      // // Create a new version
-      // const data = await db
-      //   .insert(workflowVersionTable)
-      //   .values({
-      //     workflow_id: workflow_id,
-      //     workflow,
-      //     workflow_api,
-      //     version: 1,
-      //     snapshot: snapshot,
-      //   })
-      //   .returning();
-      // version = data[0].version;
     } else if (workflow_id) {
       // Case 2 update workflow
-      const data = await db
-        .insert(workflowVersionTable)
-        .values({
-          workflow_id,
-          workflow: workflow,
+      const { version: _version } = await createNewWorkflowVersion({
+        workflow_id: workflow_id,
+        workflowData: {
+          workflow,
           workflow_api,
-          // version: sql`${workflowVersionTable.version} + 1`,
-          snapshot: snapshot,
-          version: sql`(
-        SELECT COALESCE(MAX(version), 0) + 1
-        FROM ${workflowVersionTable}
-        WHERE workflow_id = ${workflow_id}
-      )`,
-        })
-        .returning();
-      version = data[0].version;
-
-      await db
-        .update(workflowTable)
-        .set({
-          updated_at: new Date(),
-        })
-        .where(eq(workflowTable.id, workflow_id))
-        .returning();
+          snapshot,
+        },
+      });
+      version = _version;
     } else {
       return NextResponse.json(
         {
@@ -150,7 +108,7 @@ export async function POST(request: Request) {
           status: 500,
           statusText: "Invalid request",
           headers: corsHeaders,
-        }
+        },
       );
     }
   } catch (error: any) {
@@ -162,7 +120,7 @@ export async function POST(request: Request) {
         status: 500,
         statusText: "Invalid request",
         headers: corsHeaders,
-      }
+      },
     );
   }
 
@@ -174,6 +132,6 @@ export async function POST(request: Request) {
     {
       status: 200,
       headers: corsHeaders,
-    }
+    },
   );
 }

web/src/app/(app)/auth-request/[request_id]/page.tsx

@@ -0,0 +1,54 @@
+import { ButtonAction } from "@/components/ButtonActionLoader";
+import { Button } from "@/components/ui/button";
+import { createAuthRequest } from "@/server/curdApiKeys";
+import { auth } from "@clerk/nextjs";
+import { redirect } from "next/navigation";
+import { getOrgOrUserDisplayName } from "../../../../server/getOrgOrUserDisplayName";
+import { db } from "@/db/db";
+import { eq } from "drizzle-orm";
+import { authRequestsTable } from "@/db/schema";
+
+export default async function Home({
+  params,
+}: {
+  params: { request_id: string };
+}) {
+  const { userId, orgId } = await auth();
+
+  if (!userId) redirect("/");
+
+  if (!params.request_id)
+    return (
+      <div className="h-full w-full flex flex-col gap-2 items-center justify-center">
+        No valid request_id
+      </div>
+    );
+
+  const existingResult = await db.query.authRequestsTable.findFirst({
+    where: eq(authRequestsTable.request_id, params.request_id),
+  });
+
+  if (existingResult?.api_hash) {
+    return (
+      <div className="h-full w-full flex flex-col gap-2 items-center justify-center">
+        Request already consumed.
+      </div>
+    );
+  }
+
+  const userName = await getOrgOrUserDisplayName(orgId, userId);
+
+  return (
+    <div className="h-full w-full flex flex-col gap-2 items-center justify-center">
+      <div className="text-lg">Grant API Access to {userName}</div>
+      <Button asChild>
+        <ButtonAction
+          routerAction="do-nothing"
+          action={createAuthRequest.bind(null, params.request_id)}
+        >
+          Grant Access
+        </ButtonAction>
+      </Button>
+    </div>
+  );
+}