docs(stack): unwrap the OidcFederationStrategy Result in the README example by coderdan · Pull Request #1342 · cipherstash/stack

coderdan · 2026-10-23T12:14:32Z

The Authentication example in the README passes OidcFederationStrategy.create(...) straight to config.authStrategy.
create() returns a Result<OidcFederationStrategy, AuthFailure> ({ data } | { failure }), not the strategy, so Encryption() fails with:

[encryption]: Credential error: opts.strategy.getToken is missing

Reproduced against published @cipherstash/stack@1.2.1 with Bun.

The fix unwraps the Result before passing it, the same way the Encryption() JSDoc and the stash-auth skill already do:

const strategy = OidcFederationStrategy.create(workspaceCrn, () => getUserJwt(req));
if (strategy.failure) throw new Error(strategy.failure.error.message);

const client = await Encryption({
  schemas: [users],
  config: { authStrategy: strategy.data },
});

This version was checked end to end against a real CTS + ZeroKMS.
It's applied to the root README.md, its copy at languages/typescript/packages/stack/README.md (the one that ships to npm), and the LockContext JSDoc example in stack/src/identity/index.ts, which had the same mistake.
There's a patch changeset for @cipherstash/stack so the npm README gets the fix.

Summary by CodeRabbit

Documentation
- Updated OIDC federation examples to check for strategy creation failures and pass the successfully created strategy to encryption configuration.

…xample OidcFederationStrategy.create() returns a Result<OidcFederationStrategy, AuthFailure>, not the strategy. The README's Authentication example passed that envelope straight to config.authStrategy, so Encryption() failed with "[encryption]: Credential error: opts.strategy.getToken is missing". Reproduced against @cipherstash/stack 1.2.1. Unwrap it the way the Encryption() JSDoc and the stash-auth skill already do: check .failure, then pass .data. Fixed in the root README, its copy in the stack package, and the LockContext JSDoc example, which had the same mistake.

changeset-bot · 2026-10-23T12:14:38Z

🦋 Changeset detected

Latest commit: 4b14ee6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
@cipherstash/stack	Patch
@cipherstash/bench	Patch
stash	Patch
@cipherstash/stack-drizzle	Patch
@cipherstash/stack-prisma	Patch
@cipherstash/stack-supabase	Patch
@cipherstash/test-kit	Patch
@cipherstash/basic-example	Patch
@cipherstash/prisma-example	Patch
@cipherstash/e2e	Patch
@cipherstash/wizard	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

chatgpt-codex-connector · 2026-10-23T12:14:43Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-23T12:14:41.502795Z	`4b14ee6`	PR opened
🔒 Security Review	✅ Completed 2026-10-23T12:16:35.792648Z	`4b14ee6`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-10-23T12:15:00Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI; Enforced overrides: Organization
Review profile: CHILL
Plan: Advanced
Run ID: 9ce17990-7612-4817-aa42-6a97523ff3fa

📥 Commits

Reviewing files that changed from the base of the PR and between 8d48bbc and 4b14ee6.

📒 Files selected for processing: 4

.changeset/readme-unwrap-oidc-federation-result.md
README.md
languages/typescript/packages/stack/README.md
languages/typescript/packages/stack/src/identity/index.ts

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The OIDC federation examples now check the result of strategy creation. On success, they pass strategy.data to Encryption; on failure, they throw an error with the failure message.

Changes: OIDC federation examples

Layer / File(s)	Summary
Handle strategy creation results `README.md`, `languages/typescript/packages/stack/README.md`, `languages/typescript/packages/stack/src/identity/index.ts`, `.changeset/readme-unwrap-oidc-federation-result.md`	The examples check the result of `OidcFederationStrategy.create()`, throw an error with the failure message, and pass `strategy.data` to `Encryption`. The changeset records a patch release for `@cipherstash/stack`.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: auxesis

Merge Risk: ⚪ Minimal · up to 4b14e

The OIDC examples now follow the documented strategy creation contract, with no remaining merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: unwrapping the OidcFederationStrategy Result in the README example.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (3 skipped: 3 unsupported.)

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

cipherstash-agent

Review attestation: /code-review medium followed by company-skills:cross-check-review-findings, run on head 4b14ee6.

Findings: none. No critical or blocking issues.

The unwrap matches create() returning Result<…, AuthFailure> (packages/auth/index.d.ts), and failure.error.message exists on every AuthFailure variant.
The root and package READMEs and the LockContext JSDoc agree with the Encryption() and wasm-inline JSDoc and the stash-auth / stash-encryption skills.
No other OidcFederationStrategy.create(...) example under README.md, skills/ or stack/src still passes the unwrapped Result.
No skill change needed, and the patch changeset for @cipherstash/stack is present.
No existing review threads or reviews to cross-check; the bot comments contain no findings.

Static review only. I did not run the example against a live CTS or ZeroKMS.

Generated by Claude Code

cipherstash-bot

Recommendation: 🟢 merge as it is

Nothing must change before merging. This pull request changes only documentation (two README copies, one JSDoc example) and adds a changeset. The new example unwraps the Result correctly. One follow-up is listed below.

Agent	Model	Review type	Result
claude	claude-opus-5-5	test-gap	0 found, 0 posted
claude	claude-opus-5-5	typescript	0 found, 0 posted
codex	gpt-5.6-terra	test-gap	0 found, 0 posted
codex	gpt-5.6-terra	typescript	0 found, 0 posted

Navigation Menu

Repository navigation

docs(stack): unwrap the OidcFederationStrategy Result in the README example - #1342

docs(stack): unwrap the OidcFederationStrategy Result in the README example#1342
coderdan merged 1 commit into
mainfrom
docs/unwrap-oidc-federation-result

coderdan commented Oct 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

changeset-bot Bot commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

cipherstash-agent left a comment

Uh oh!

cipherstash-bot left a comment

Uh oh!

auxesis left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

coderdan commented Oct 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

changeset-bot Bot commented Oct 23, 2026

🦋 Changeset detected

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cipherstash-agent left a comment

Choose a reason for hiding this comment

Uh oh!

cipherstash-bot left a comment

Choose a reason for hiding this comment

Recommendation: 🟢 merge as it is

Other findings not posted as comments

Uh oh!

auxesis left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coderdan commented Oct 23, 2026 •

edited by coderabbitai Bot

Loading

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading