@alteran/astro 0.6.1 → 0.6.3

package/README.md

@@ -254,6 +254,18 @@ validateConfigOrThrow(env);
 - Handle format is valid
 - Numeric values are positive
 
+### Cloudflare Security Rules
+
+`com.atproto.server.refreshSession` is a valid bodyless `POST`. Production deployments must allow this request shape through to the XRPC handler:
+
+```txt
+(http.request.method eq "POST" and http.request.uri.path eq "/xrpc/com.atproto.server.refreshSession")
+```
+
+Astro's SSR origin-check middleware rejects unsafe requests with no `Origin` header before project middleware runs. Alteran normalizes `/xrpc/*` requests at the Worker entrypoint so bearer-token XRPC clients can send bodyless POSTs without tripping Astro's form CSRF guard.
+
+If Cloudflare WAF/API Shield also protects the deployment, keep any exception narrow to the expression above. This exception is not configured in `wrangler.jsonc`; Wrangler only manages the Worker deployment and bindings.
+
 ### Environment-Specific Settings
 
 See [`wrangler.jsonc`](wrangler.jsonc:40) for environment-specific configurations:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alteran/astro",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Astro integration for running a Cloudflare-hosted Bluesky PDS with Alteran.",
   "module": "index.js",
   "types": "index.d.ts",

package/src/handlers/root.ts

@@ -81,7 +81,7 @@ const HTML_TEMPLATE = (
         <strong>DID:</strong>
         <span class="pill">${did}</span>
       </p>
-      <a href="https://github.com/alteran-dev/alteran" target="_blank" rel="noopener noreferrer">
+      <a href="https://github.com/alteran-social/alteran" target="_blank" rel="noopener noreferrer">
         <svg viewBox="0 0 24 24" role="img" aria-hidden="true" focusable="false">
           <path
             fill="currentColor"

package/src/worker/runtime.ts

@@ -140,11 +140,33 @@ export function createPdsFetchHandler(options?: CreatePdsFetchHandlerOptions): P
     }
 
     const astroFetch = await getAstroFetch(options);
-    const response = await astroFetch(request, resolvedEnv as any, ctx);
+    const response = await astroFetch(normalizeXrpcRequestForAstro(request), resolvedEnv as any, ctx);
     return response as unknown as WorkersResponse;
   };
 }
 
+export function normalizeXrpcRequestForAstro(request: WorkersRequest): WorkersRequest {
+  const url = new URL(request.url);
+  if (!url.pathname.startsWith('/xrpc/')) {
+    return request;
+  }
+
+  // Astro's SSR origin-check middleware rejects unsafe requests when Origin is
+  // absent or cross-origin. XRPC is a bearer-token API, not cookie/form auth,
+  // and atproto clients legitimately send bodyless POSTs from native runtimes.
+  if (request.headers.get('origin') === url.origin) {
+    return request;
+  }
+
+  const headerRecord: Record<string, string> = {};
+  request.headers.forEach((value, key) => {
+    headerRecord[key] = value;
+  });
+  headerRecord.origin = url.origin;
+
+  return new Request(request as any, { headers: headerRecord }) as unknown as WorkersRequest;
+}
+
 type AstroFetchHandler = (
   request: WorkersRequest,
   env: Env,