meta platform login

apps/mono/src/context.ts

@@ -12,6 +12,9 @@ import type { SharedHonoEnv, SharedHonoVariables } from '@repo/hono-helpers/src/
 export type Env = SharedHonoEnv & {
 	// HS256 JWT signing key (shared Secrets Store). Tokens signed by `auth` verify everywhere.
 	JWT_SECRET: SecretsStoreSecret
+	// Meta (Oculus) app secret, from the same store. Read only by `auth`, to validate a
+	// headset login's nonce with Meta (see apps/auth/src/meta-nonce.ts).
+	META_APP_SECRET: SecretsStoreSecret
 	// Shared `recflare` database (accounts, auth, api, clubs, match, rooms, …).
 	DB: D1Database
 	// Image storage bucket (api, img).

apps/mono/wrangler.jsonc

@@ -50,13 +50,20 @@
 		"crons": ["*/5 * * * *"]
 	},
 	"logpush": false,
-	// Shared Secrets Store holding the HS256 JWT signing key. "local" store_id replaced
-	// with RECFLARE_SECRETS_STORE at deploy.
+	// Shared Secrets Store holding the HS256 JWT signing key, plus the Meta app secret
+	// the mounted `auth` app needs to verify Oculus logins. "local" store_id replaced
+	// with RECFLARE_SECRETS_STORE at deploy. Both must exist in the store or the deploy
+	// fails — see DEPLOYING.md.
 	"secrets_store_secrets": [
 		{
 			"binding": "JWT_SECRET",
 			"store_id": "local",
 			"secret_name": "JWT_SECRET"
+		},
+		{
+			"binding": "META_APP_SECRET",
+			"store_id": "local",
+			"secret_name": "META_APP_SECRET"
 		}
 	],
 	"upload_source_maps": true,