@meddleware/nft-gate-gateway 0.0.2 → 0.0.4

package/package.json

@@ -1,6 +1,6 @@
-{
+ {
   "name": "@meddleware/nft-gate-gateway",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "type": "module",
   "description": "Cloudflare Workers implementation of the nft-gate gateway: a wire-identical, drop-in sibling of the Rust gateway that gates any HTTP upstream behind an access_gate NFT.",
   "license": "0BSD",

package/src/chain.ts

@@ -20,6 +20,7 @@ interface CacheEntry {
   expiry: number
 }
 
+/** Production {@link ChainQuery} backed by Sui JSON-RPC, with an optional ownership cache. */
 export class SuiRpc implements ChainQuery {
   private readonly cache = new Map<string, CacheEntry>()
 

package/src/config.ts

@@ -51,9 +51,12 @@ export interface Env {
   CF_ACCOUNT_ID?: string
 }
 
+/** Which nonce/rate-limit backend to use: strongly-consistent Durable Objects or Workers KV. */
 export type NonceBackendKind = 'durable-object' | 'kv'
+/** Nonce shard placement: one shard per region (near users) or a single global shard. */
 export type NonceShardMode = 'region' | 'global'
 
+/** Fully-resolved gateway configuration derived from {@link Env} by {@link loadConfig}. */
 export interface Config {
   upstreamUrl: string
   suiRpcUrl: string
@@ -139,6 +142,7 @@ export function loadConfig(env: Env): Config {
   }
 }
 
+/** Returns `true` if `path` is in the configured public-paths list (proxied without auth). */
 export function isPublicPath(cfg: Config, path: string): boolean {
   return cfg.publicPaths.some((p) => p === path)
 }

package/src/cors.ts

@@ -0,0 +1,38 @@
+/**
+ * CORS utilities for the nft-gate Cloudflare Worker.
+ *
+ * The Worker is accessed from browser origins (e.g. sui-walrus.meddleware.co.uk,
+ * sui.meddleware.co.uk) that differ from the Worker's own hostname. Without
+ * Access-Control-Allow-Origin headers the browser blocks the response even when
+ * the Worker returns 200, and OPTIONS preflights (required before non-simple requests
+ * such as PUT uploads with an Authorization header) receive no preflight grant.
+ */
+
+const CORS_HEADERS: Record<string, string> = {
+  'access-control-allow-origin': '*',
+  'access-control-allow-methods': 'GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS',
+  'access-control-allow-headers': 'authorization, content-type, x-access-proof',
+  'access-control-expose-headers': 'location, upload-offset',
+  'access-control-max-age': '86400',
+}
+
+/**
+ * Clone `res` and add CORS headers. Using `set()` so calling this on an upstream
+ * response that already carries CORS headers just overwrites them consistently.
+ */
+export function withCors(res: Response): Response {
+  const out = new Response(res.body, res)
+  for (const [k, v] of Object.entries(CORS_HEADERS)) {
+    out.headers.set(k, v)
+  }
+  return out
+}
+
+/**
+ * Return a minimal 204 preflight response for OPTIONS requests.
+ * The browser requires this before sending non-simple cross-origin requests
+ * (e.g. PUT/POST with Authorization or Content-Type).
+ */
+export function corsPreflightResponse(): Response {
+  return new Response(null, { status: 204, headers: CORS_HEADERS })
+}

package/src/crypto.ts

@@ -7,16 +7,19 @@
 import { blake2b } from '@noble/hashes/blake2.js'
 import { sha256 as nobleSha256 } from '@noble/hashes/sha2.js'
 
+/** Compute a 32-byte Blake2b-256 digest of `data`. */
 export function blake2b256(data: Uint8Array): Uint8Array {
   return blake2b(data, { dkLen: 32 })
 }
 
+/** Compute a 32-byte SHA-256 digest of `data`. */
 export function sha256(data: Uint8Array): Uint8Array {
   return nobleSha256(data)
 }
 
 const HEX = '0123456789abcdef'
 
+/** Encode `bytes` as a lowercase hex string (no `0x` prefix). */
 export function bytesToHex(bytes: Uint8Array): string {
   let out = ''
   for (let i = 0; i < bytes.length; i++) {
@@ -25,6 +28,11 @@ export function bytesToHex(bytes: Uint8Array): string {
   return out
 }
 
+/**
+ * Decode a hex string (with or without `0x` prefix) to bytes.
+ *
+ * @throws {Error} if `hex` has an odd number of characters.
+ */
 export function hexToBytes(hex: string): Uint8Array {
   const s = hex.startsWith('0x') ? hex.slice(2) : hex
   if (s.length % 2 !== 0) throw new Error('odd-length hex')
@@ -43,6 +51,7 @@ export function base64ToBytes(b64: string): Uint8Array {
   return out
 }
 
+/** Encode `bytes` as standard base64. Uses `btoa` (present in the Workers runtime). */
 export function bytesToBase64(bytes: Uint8Array): string {
   let s = ''
   for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i])
@@ -65,6 +74,7 @@ export function uleb128(v: number): Uint8Array {
   return Uint8Array.from(out)
 }
 
+/** Concatenate multiple `Uint8Array` values into a single contiguous array. */
 export function concatBytes(...parts: Uint8Array[]): Uint8Array {
   let len = 0
   for (const p of parts) len += p.length

package/src/index.ts

@@ -15,6 +15,7 @@ import { SuiRpc } from './chain.js'
 import { verifyAccessRequest, deniedReason } from './verify.js'
 import { forward } from './proxy.js'
 import { runQuotaGuard } from './quota.js'
+import { withCors, corsPreflightResponse } from './cors.js'
 
 export { NonceRateState } from './state/durable_object.js'
 
@@ -124,6 +125,11 @@ async function handle(request: Request, env: Env): Promise<Response> {
 
   if (path === '/healthz') return new Response('ok', { status: 200 })
 
+  // Handle CORS preflight before any auth check. The browser sends OPTIONS before
+  // non-simple cross-origin requests (e.g. PUT/POST with Authorization); responding
+  // here avoids the auth path returning 401 and causing the browser to abort.
+  if (request.method === 'OPTIONS') return corsPreflightResponse()
+
   let state: GatewayState
   try {
     state = await getState(env)
@@ -163,7 +169,7 @@ async function handle(request: Request, env: Env): Promise<Response> {
  */
 export default {
   fetch(request: Request, env: Env): Promise<Response> {
-    return handle(request, env)
+    return handle(request, env).then(withCors)
   },
   async scheduled(_controller: ScheduledController, env: Env): Promise<void> {
     if ((env.QUOTA_GUARD_ENABLED ?? 'false').toLowerCase() === 'true') {

package/src/verify.ts

@@ -30,6 +30,7 @@ export function deriveAddress(flag: number, pk: Uint8Array): string {
   return '0x' + bytesToHex(blake2b256(concatBytes(Uint8Array.from([flag]), pk)))
 }
 
+/** Normalise a Sui address to lowercase, `0x`-prefixed, zero-padded to 64 hex digits. */
 export function normalizeAddress(a: string): string {
   const s = a.trim().replace(/^0x/i, '').toLowerCase()
   return '0x' + s.padStart(64, '0')
@@ -128,6 +129,7 @@ export interface ChainQuery {
   ): Promise<boolean>
 }
 
+/** The reason a request was rejected by {@link verifyAccessRequest}. Mirror of Rust `Denied`. */
 export type Denied =
   | 'BadProof'
   | 'BadSignature'
@@ -136,6 +138,7 @@ export type Denied =
   | 'ConsumeMissing'
   | 'ChainError'
 
+/** A short, client-visible description of why access was denied. */
 export function deniedReason(d: Denied): string {
   switch (d) {
     case 'BadProof':
@@ -153,6 +156,7 @@ export function deniedReason(d: Denied): string {
   }
 }
 
+/** Result of {@link verifyAccessRequest}: the verified address on success, or a {@link Denied} reason. */
 export type VerifyResult = { ok: true; address: string } | { ok: false; denied: Denied }
 
 /**

package/wrangler.toml

@@ -73,10 +73,11 @@ new_sqlite_classes = ["NonceRateState"]
 # id = "<KV_NAMESPACE_ID>"   # create with: wrangler kv namespace create NONCE_KV
 
 # ── route: Worker serves as the public NFT-gated relay endpoint ───────────────────────────────
-# operator: uncomment and fill in after creating the Worker route in the CF dashboard
-# [[routes]]
-# pattern = "nft-gate.example.com/*"
-# zone_name = "example.com"
+# Configured via CF API (route ID 63427e4dbf9b4428ad9c492487953551).
+# wrangler deploy will create/update this automatically.
+[[routes]]
+pattern = "sui-walrus-relay-testnet.meddleware.co.uk/*"
+zone_name = "meddleware.co.uk"
 
 # ── optional quota guard (needs QUOTA_GUARD_ENABLED=true + the secrets above) ────────────────
 # [triggers]