@ripplo/auth

Ripplo reviews your pull requests by driving your app end to end. Mount one signed endpoint so it can sign in.

import { createAuthenticationHandler } from "@ripplo/auth/express";

app.use(createAuthenticationHandler({ createSession, teardown }));

createSession({ runId }) creates or gets the run's user and returns its browser session. teardown removes it when the run ends.

Set RIPPLO_WEBHOOK_SECRET from your project settings. The handler verifies every call from Ripplo against it.

Every request a run makes carries a signed x-ripplo-run header. ripploRunId(headers) returns the run id when the header is valid, so the app can route Ripplo runs to fakes, skip rate limits, or tag what a run created. Nothing else in the app has to change.

Adapters: express, fastify, hono, koa, nestjs, nextjs, elysia. The root export is a fetch-standard handler for anything else.

Then comment @ripplo review <preview-url> on a pull request.