workers-oauth-provider

We'll have to see how it pans out for Cloudflare. They published an oauth thing and all the prompts used to create it. https://github.com/cloudflare/workers-oauth-provider/

There's many examples of exactly what you're asking for, such as Kenton Varda's Cloudlfare oauth provider [1] and Simon Willison's tools [2]. I see a new blog post like this with detailed explanations of what they did pretty frequently, like Steve Klabnik's recent post [3], which while it isn't as detailed has a lot of very concrete facts. There's even more blog posts from prominent devs like antirez who talk about other things they're doing with AI like rubber ducking [4], if you're curious about how some people who say "I used Sonnet last week and it was great" are working, because not everyone uses it to write code - I personally don't because I care a lot about code style. [1]: https://github.com/cloudflare/workers-oauth-provider/ [2]: https://tools.simonwillison.net/ [3]: https://steveklabnik.com/writing/a-tale-of-two-claudes/ [4]: h

> A very good piece that clearly illustrates one of the dangers with LLS's: responsibility for code quality is blindly offloaded on the automatic system It does not illustrate that at all. > Claude's output was thoroughly reviewed by Cloudflare engineers with careful attention paid to security and compliance with standards. > To emphasize, *this is not "vibe coded"*. Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs. — https://github.com/cloudflare/workers-oauth-provider The humans who worked on it very, very clearly took responsibility for code quality. That they didn’t get it 100% right does not mean that they “blindly offloaded responsibility”. Perhaps you can level that accusation at other people doing different things, but Cloudflare explicitly pla

The author goes into great detail about how he looked at my commit log[0] where I used AI, and he found it "nauseating" and concluded he'd never want to work that way. I'm certainly not going to tell anyone that they're wrong if they try AI and don't like it! But this guy... did not try it? He looked at a commit log, tried to imagine what my experience was like, and then decided he didn't like that? And then he wrote about it? Folks, it's really not that hard to actually try it. There is no learning curve. You just run the terminal app in your repo and you ask it to do things. Please, I beg you, before you go write walls of text about how much you hate the thing, actually try it, so that you actually have some idea what you're talking about. Six months ago, I myself imagined that I would hate AI-assisted coding! Then I tried it. I found o

> I found the experience of reading this commit history and imagining myself using such a tool — without exaggeration — nauseating. The commit history[1] looks like a totally normal commit history on page 1, but I clicked farther down and found commits like > Ask Claude to fix bug with token exchange callback when reusing refresh token. > As explained in the readme, when we rotate the refresh token, we still allow the previous refresh token to be used again, in case the new token is lost due to an error. However, in the previous commit, we hadn't properly updated the wrapped key to handle this case. > Claude also found that the behavior when `grantProps` was returend without `tokenProps` was confusing -- you'd expect the access token to have the new props, not the old. I agreed and had Claude update it. > Claude Code transcript: https://c

> did he save any time though Yes: > It took me a few days to build the library with AI. > I estimate it would have taken a few weeks, maybe months to write by hand. – https://news.ycombinator.com/item?id=44160208 > or just tried to prove a point that if you actually already know all details of impl you can guide llm to do it? No: > I was an AI skeptic. I thoughts LLMs were glorified Markov chain generators that didn't actually understand code and couldn't produce anything novel. I started this project on a lark, fully expecting the AI to produce terrible code for me to laugh at. And then, uh... the code actually looked pretty good. Not perfect, but I just told the AI to fix things, and it did. I was shocked. — https://github.com/cloudflare/workers-oauth-provider/?tab=re...

https://github.com/cloudflare/workers-oauth-provider/commits... Start at the bottom...they are in the commit messages, or sometimes the .md file

We changed the URL from https://github.com/cloudflare/workers-oauth-provider/commits... to the project page.

Is it really good form in TypeScript to make all functions async, even when functions don't use await? like this, https://github.com/cloudflare/workers-oauth-provider/blob/fe...

Approximately speaking, what do you want to see put up? I ask this because it reads like you have a specific challenge in mind when it comes to generative AI and it sounds like anything short of "proof of the unlimited powers" will fall short of being deemed "useful". Here's the deal: Reasonable people aren't claiming this stuff is a silver bullet or a panacea. They're not even suggesting it should be used without supervision. It's useful when used by people who understand its limitations and leverage its strengths. If you want to see how it's been used by someone who was happy with the results, and is willing to share their results, you can scroll down a few stories on the front-page and check the commit history of this project: https://github.com/cloudflare/workers-oauth-provider/commits... Now here's the deal: These people aren't t

Some examples of prompt exchanges that seem representative: https://claude-workerd-transcript.pages.dev/oauth-provider-t... ("Total cost: $6.45")! https://github.com/cloudflare/workers-oauth-provider/commit/... https://github.com/cloudflare/workers-oauth-provider/commit/... The first transcript includes the cost, would be interesting to know the ballpark of total Claude spend on this library so far. -- This is opportune for me, as I've been looking for a description of AI workflows from people of some presumed competency. You'd think there would be many, but it's hard to find anything reliable amidst all the hype. Is anyone live coding anything but todo lists? antirez: https://antirez.com/news/144#:~:text=Yesterday%20I%20needed%... tptacek: https://news.ycombinator.com/item?id=44163292

The most clearly Claude-written commits are on the first page, this link should get you to them: https://github.com/cloudflare/workers-oauth-provider/commits...

The secret token is hashed first, and it's the hash that is looked up in storage. In this arrangement, an attacker cannot use timing to determine the correct value byte-by-byte, because any change to the secret token is expected to randomize the whole hash. So, timing-safe equality is not needed. That said, if you have spotted a place in the code where you believe there is such a vulnerability, please do report it. Disclosure guidelines are at: https://github.com/cloudflare/workers-oauth-provider/blob/ma...

> Again, please check out the commit history -- especially early commits -- to understand how this went. Direct link to earliest page of history: https://github.com/cloudflare/workers-oauth-provider/commits... A lot of very explicit & clear prompting, with direct directions to go. Some examples on the first page: https://github.com/cloudflare/workers-oauth-provider/commit/... https://github.com/cloudflare/workers-oauth-provider/commit/...

From this commit: https://github.com/cloudflare/workers-oauth-provider/commit/... === "Fix Claude's bug manually. Claude had a bug in the previous commit. I prompted it multiple times to fix the bug but it kept doing the wrong thing. So this change is manually written by a human. I also extended the README to discuss the OAuth 2.1 spec problem." === This is super relatable to my experience trying to use these AI tools. They can get halfway there and then struggle immensely.