@auth-craft/aws-cf-stack 1.2.0 → 1.3.0

package/.env.example

@@ -75,6 +75,15 @@ CF_WORKER_ROUTE_PREFIX_CUSTOMER=/customer
 CF_WORKER_CUSTOM_DOMAIN_SYSTEM=
 CF_WORKER_CUSTOM_DOMAIN_TENANT=
 CF_WORKER_CUSTOM_DOMAIN_CUSTOMER=
+# Disable the public worker URL — turns off BOTH workers.dev AND preview URLs (Pages-proxy
+# / Service-Binding deploys reach the worker in-network, so no public URL should be
+# exposed; CF won't drop preview URLs just for workers.dev being off). Truthy: 1/true/yes.
+# CF_WORKER_DISABLE_PUBLIC_URL is the shared default; override one scope with the
+# per-scope var. Ignored when a custom domain is set for that scope.
+CF_WORKER_DISABLE_PUBLIC_URL=          # shared default (e.g. true to disable all)
+CF_WORKER_DISABLE_PUBLIC_URL_SYSTEM=   # e.g. true — admin app via Pages proxy
+CF_WORKER_DISABLE_PUBLIC_URL_TENANT=
+CF_WORKER_DISABLE_PUBLIC_URL_CUSTOMER=
 
 # ─── Internal service JWT (optional — enables /internal/* + service worker verify) ─
 LAMBDA_INTERNAL_JWT_PUBLIC_KEY=          # optional — also fed to workers as SERVICE_JWT_PUBLIC_KEY

package/README.md

@@ -218,6 +218,18 @@ billed as a second request). If you can't use a binding, set `AUTH_GATEWAY_URL`
 gateway URL from `outputs.gatewayUrls.<scope>` instead — that path is a normal billable
 request. See [@auth-craft/pages-auth-proxy](../pages-auth-proxy/README.md).
 
+**Disable the public worker URL.** With a Service Binding the worker is reached in-network,
+so its public `workers.dev` URL only widens the attack surface (and bypasses the Pages
+same-origin path). Set `CF_WORKER_DISABLE_PUBLIC_URL=true` (or per scope, e.g.
+`CF_WORKER_DISABLE_PUBLIC_URL_SYSTEM=true`) and the deploy ships the worker with
+`workers_dev = false` **and** `preview_urls = false` — turning off both the production
+`workers.dev` subdomain **and** the per-version preview URLs (Cloudflare does *not* drop
+preview URLs just because `workers.dev` is off, so both must be set; the deploy does this
+for you). The worker then stays reachable only via its Service Binding (and any custom
+domain). This applies only when no `CF_WORKER_CUSTOM_DOMAIN_<SCOPE>` is set for the scope;
+if you're using `AUTH_GATEWAY_URL` (no binding) leave it off, since that path needs the
+public URL.
+
 ### Per-scope token transport
 
 `REFRESH_TOKEN_STRATEGY` sets the transport for every scope. To mix, use the per-scope

package/lib/deploy-gateway.sh

@@ -30,6 +30,21 @@ custom_domain_for() {
   echo "${!var:-}"
 }
 
+# Resolve whether to disable the public workers.dev URL for a scope (Pages-proxy /
+# Service-Binding deploys reach the worker in-network and don't need a public URL).
+# Precedence: CF_WORKER_DISABLE_PUBLIC_URL_<SCOPE> > CF_WORKER_DISABLE_PUBLIC_URL > '' (off).
+# Truthy values: 1 / true / yes (case-insensitive). Ignored when a custom domain is set.
+disable_public_url_for() {
+  local scope="$1" upper var val
+  upper="$(echo "$scope" | tr '[:lower:]' '[:upper:]')"
+  var="CF_WORKER_DISABLE_PUBLIC_URL_${upper}"
+  val="${!var:-${CF_WORKER_DISABLE_PUBLIC_URL:-}}"
+  case "$(echo "$val" | tr '[:upper:]' '[:lower:]')" in
+    1 | true | yes) echo 1 ;;
+    *) echo '' ;;
+  esac
+}
+
 # Resolve per-scope static CORS origins. Precedence:
 #   CF_ALLOWED_ORIGINS_<SCOPE> > CF_ALLOWED_ORIGINS > LAMBDA_CORS_ORIGINS > '*'.
 allowed_origins_for() {
@@ -100,7 +115,7 @@ deploy_gateway() {
 
   GATEWAY_URLS=()
   local scope worker_name route_prefix custom_domain url
-  local allowed_origins origin_suffixes cors_kv_id config_file
+  local allowed_origins origin_suffixes cors_kv_id config_file disable_public_url
   for scope in system tenant customer; do
     worker_name="${APP_NAME}-${STAGE}-${scope}"
     route_prefix="$(route_prefix_for "$scope")"
@@ -108,23 +123,46 @@ deploy_gateway() {
     allowed_origins="$(allowed_origins_for "$scope")"
     origin_suffixes="$(origin_suffixes_for "$scope")"
     cors_kv_id="$(cors_kv_id_for "$scope")"
+    # A custom domain always needs the worker reachable, so the disable flag is ignored there.
+    disable_public_url=""
+    [[ -z "$custom_domain" ]] && disable_public_url="$(disable_public_url_for "$scope")"
 
     info "Deploying $worker_name (scope=$scope route_prefix=$route_prefix)…"
 
-    # When a CORS KV id is set for this scope (typically customer), deploy with a
-    # temp config that appends a [[kv_namespaces]] binding (CORS_KV) — a binding can't
-    # be set via --var. Otherwise use the shipped config unchanged (KV disabled).
+    # A temp config is needed when either (a) a CORS KV id is set (a binding can't be
+    # set via --var) or (b) the public URL must be disabled (workers_dev/preview_urls are
+    # top-level config keys, not vars, and CF won't disable preview URLs just because
+    # workers.dev is off — both must be set explicitly). Otherwise use the shipped config.
     config_file="$WRANGLER_DIR/wrangler.toml"
-    if [[ -n "$cors_kv_id" ]]; then
+    if [[ -n "$cors_kv_id" || -n "$disable_public_url" ]]; then
       config_file="$(mktemp "${TMPDIR:-/tmp}/wrangler-${scope}.XXXXXX.toml")"
-      cat "$WRANGLER_DIR/wrangler.toml" >"$config_file"
-      {
-        echo ''
-        echo '[[kv_namespaces]]'
-        echo 'binding = "CORS_KV"'
-        echo "id = \"$cors_kv_id\""
-      } >>"$config_file"
-      info "  dynamic CORS: KV binding CORS_KV → $cors_kv_id"
+      if [[ -n "$disable_public_url" ]]; then
+        # Turn off the workers.dev URL *and* the per-version preview URLs in a single
+        # deploy (no REST API round-trip; CF won't drop preview URLs just for workers_dev
+        # being off, so both are set explicitly). These are ROOT keys: they must precede
+        # any [table] header or TOML scopes them under it (e.g. [build]). We drop the
+        # shipped `workers_dev = true` (TOML forbids duplicate keys) and inject both flags
+        # immediately after the first root key (`name = …`), before [build].
+        awk '
+          /^[[:space:]]*workers_dev[[:space:]]*=/ { next }   # drop original (anywhere)
+          { print }
+          !injected && /^[[:space:]]*name[[:space:]]*=/ {
+            print "workers_dev = false"; print "preview_urls = false"; injected = 1
+          }
+        ' "$WRANGLER_DIR/wrangler.toml" >"$config_file"
+        info "  public URL disabled: workers.dev + preview URLs off (Pages-proxy / Service Binding only)"
+      else
+        cat "$WRANGLER_DIR/wrangler.toml" >"$config_file"
+      fi
+      if [[ -n "$cors_kv_id" ]]; then
+        {
+          echo ''
+          echo '[[kv_namespaces]]'
+          echo 'binding = "CORS_KV"'
+          echo "id = \"$cors_kv_id\""
+        } >>"$config_file"
+        info "  dynamic CORS: KV binding CORS_KV → $cors_kv_id"
+      fi
     fi
 
     # Deploy the prebuilt bundle with per-scope vars (flags override the toml).
@@ -144,7 +182,7 @@ deploy_gateway() {
       --var "SERVICE_JWT_ISSUER:$svc_iss" \
       --var "SERVICE_JWT_ALLOWED_ALGORITHMS:$svc_alg" >/dev/null
 
-    # Clean up the temp config (only created when KV was bound).
+    # Clean up the temp config (only created when KV was bound or public URL disabled).
     [[ "$config_file" != "$WRANGLER_DIR/wrangler.toml" ]] && rm -f "$config_file"
 
     # Secrets (piped via stdin).
@@ -158,6 +196,10 @@ deploy_gateway() {
     if [[ -n "$custom_domain" ]]; then
       url="https://$custom_domain"
       info "  custom domain: $custom_domain (configure DNS/route separately)"
+    elif [[ -n "$disable_public_url" ]]; then
+      # workers.dev + preview URLs were turned off in the deploy config above; the worker
+      # is reachable only via its Service Binding (Pages proxy) — no public URL to print.
+      url="(no public URL — reached via Pages proxy / Service Binding)"
     else
       enable_workers_dev "$worker_name"
       if [[ -n "${CF_WORKERS_SUBDOMAIN:-}" ]]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-craft/aws-cf-stack",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Self-contained, versioned distribution of the Auth Craft AWS (DynamoDB + Lambda) + Cloudflare gateway stack. Bundles prebuilt Lambda/worker artifacts + CDK app so consumers deploy without cloning auth-craft.",
   "type": "module",
   "bin": {