1tube 0.1.3 → 0.1.4

package/.env.example

@@ -18,6 +18,7 @@ TAVILY_API_KEY=
 # Gateway config
 PORT=3100
 FUNCTIONS_PATH=../sciobot-next/supabase/functions
+# INTERNAL_KEY=00000000-0000-0000-0000-000000000000  # optional, random GUID is fine
 
 # Optional: Sentry error tracking
 # SENTRY_DSN=

package/eslint-plugin.js

@@ -57,6 +57,51 @@ const plugin = {
       },
     },
 
+    "require-access-policy": {
+      meta: {
+        type: "problem",
+        docs: {
+          description:
+            "Require every serve() call to declare an access policy via the `require` option",
+        },
+        messages: {
+          missingRequire:
+            'serve() must declare an access policy. Add { require: "public" }, { require: ["authenticated"] }, or { require: ["isAdminOrHigher"] } etc.',
+        },
+        schema: [],
+      },
+      create(context) {
+        return {
+          CallExpression(node) {
+            if (
+              node.callee.type !== "Identifier" ||
+              node.callee.name !== "serve"
+            ) {
+              return;
+            }
+
+            const opts = node.arguments[1];
+
+            if (!opts || opts.type !== "ObjectExpression") {
+              context.report({ node, messageId: "missingRequire" });
+              return;
+            }
+
+            const hasRequire = opts.properties.some(
+              (p) =>
+                p.type === "Property" &&
+                p.key.type === "Identifier" &&
+                p.key.name === "require",
+            );
+
+            if (!hasRequire) {
+              context.report({ node, messageId: "missingRequire" });
+            }
+          },
+        };
+      },
+    },
+
     "no-direct-edge-url": {
       meta: {
         type: "problem",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "1tube",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "private": false,
   "description": "Self-hosted Supabase Edge Functions gateway for Deno, plus an ESLint plugin for consumers",
   "license": "MIT",

package/src/health.ts

@@ -6,20 +6,41 @@ import type { Context } from "npm:hono@4";
 import type { FunctionRegistry } from "./registry.ts";
 import { getCollectedMetrics, getPrometheusMetrics } from "./gateway/logging.ts";
 
-export function createHealthHandler(registry: FunctionRegistry) {
+function hasValidKey(c: Context, secretKey?: string): boolean {
+  return !!secretKey && c.req.query("key") === secretKey;
+}
+
+export function createHealthHandler(
+  registry: FunctionRegistry,
+  secretKey?: string,
+) {
   return (c: Context) => {
+    if (!hasValidKey(c, secretKey)) {
+      return c.json({ status: "ok" });
+    }
+
     const metrics = getCollectedMetrics();
+    const mem = Deno.memoryUsage();
     return c.json({
       status: "ok",
       function_count: registry.size,
       functionList: registry.list(),
+      memory: {
+        rss_mb: Math.round(mem.rss / 1024 / 1024),
+        heap_used_mb: Math.round(mem.heapUsed / 1024 / 1024),
+        heap_total_mb: Math.round(mem.heapTotal / 1024 / 1024),
+      },
       ...metrics,
     });
   };
 }
 
-export function createMetricsHandler() {
+export function createMetricsHandler(secretKey?: string) {
   return (c: Context) => {
+    if (!hasValidKey(c, secretKey)) {
+      return c.json({ error: "Forbidden" }, 403);
+    }
+
     return new Response(getPrometheusMetrics(), {
       headers: { "Content-Type": "text/plain; version=0.0.4; charset=utf-8" },
     });

package/src/server.ts

@@ -19,6 +19,19 @@ import { createRateLimiter } from "./gateway/rate-limit.ts";
 import { createHealthHandler, createMetricsHandler } from "./health.ts";
 import { VERSION } from "./version.ts";
 
+// ---------------------------------------------------------------------------
+// Process-level error handlers
+// ---------------------------------------------------------------------------
+
+globalThis.addEventListener("unhandledrejection", (e) => {
+  e.preventDefault();
+  console.error("[1tube] Unhandled promise rejection:", e.reason);
+});
+
+globalThis.addEventListener("error", (e) => {
+  console.error("[1tube] Uncaught error:", e.error ?? e.message);
+});
+
 // ---------------------------------------------------------------------------
 // CLI args & env
 // ---------------------------------------------------------------------------
@@ -72,6 +85,7 @@ function parseArgs(): { port: number; functionsPath: string; defaultTimeoutMs: n
 // ---------------------------------------------------------------------------
 
 const { port, functionsPath, defaultTimeoutMs } = parseArgs();
+const internalKey = Deno.env.get("INTERNAL_KEY")?.trim() || undefined;
 
 applyLocalDefaults();
 
@@ -181,7 +195,16 @@ app.all("/functions/v1/:name{.+}", async (c) => {
   const originalUrl = new URL(c.req.raw.url);
   const rewrittenPath = originalUrl.pathname.replace(/^\/functions\/v1/, "") || "/";
   const rewrittenUrl = new URL(rewrittenPath + originalUrl.search, originalUrl.origin);
-  const rewrittenReq = new Request(rewrittenUrl.toString(), c.req.raw);
+
+  const abort = new AbortController();
+  const rewrittenReq = new Request(rewrittenUrl.toString(), {
+    method: c.req.raw.method,
+    headers: c.req.raw.headers,
+    body: c.req.raw.body,
+    signal: abort.signal,
+    // @ts-ignore -- Deno supports duplex on Request
+    duplex: "half",
+  });
 
   let handlerPromise: Promise<Response>;
 
@@ -199,7 +222,10 @@ app.all("/functions/v1/:name{.+}", async (c) => {
   try {
     if (timeoutMs > 0) {
       const timeout = new Promise<never>((_, reject) =>
-        setTimeout(() => reject(new Error(`Function "${name}" timed out after ${timeoutMs}ms`)), timeoutMs),
+        setTimeout(() => {
+          abort.abort();
+          reject(new Error(`Function "${name}" timed out after ${timeoutMs}ms`));
+        }, timeoutMs),
       );
       return await Promise.race([handlerPromise, timeout]);
     }
@@ -215,8 +241,8 @@ app.all("/functions/v1/:name{.+}", async (c) => {
 });
 
 // Health & observability
-app.get("/health", createHealthHandler(registry));
-app.get("/metrics", createMetricsHandler());
+app.get("/health", createHealthHandler(registry, internalKey));
+app.get("/metrics", createMetricsHandler(internalKey));
 
 // Root info
 app.get("/", (c) =>