@meddleware/nft-gate-gateway 0.0.3 → 0.0.4

package/package.json

@@ -1,6 +1,6 @@
-{
+ {
   "name": "@meddleware/nft-gate-gateway",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "type": "module",
   "description": "Cloudflare Workers implementation of the nft-gate gateway: a wire-identical, drop-in sibling of the Rust gateway that gates any HTTP upstream behind an access_gate NFT.",
   "license": "0BSD",

package/src/cors.ts

@@ -0,0 +1,38 @@
+/**
+ * CORS utilities for the nft-gate Cloudflare Worker.
+ *
+ * The Worker is accessed from browser origins (e.g. sui-walrus.meddleware.co.uk,
+ * sui.meddleware.co.uk) that differ from the Worker's own hostname. Without
+ * Access-Control-Allow-Origin headers the browser blocks the response even when
+ * the Worker returns 200, and OPTIONS preflights (required before non-simple requests
+ * such as PUT uploads with an Authorization header) receive no preflight grant.
+ */
+
+const CORS_HEADERS: Record<string, string> = {
+  'access-control-allow-origin': '*',
+  'access-control-allow-methods': 'GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS',
+  'access-control-allow-headers': 'authorization, content-type, x-access-proof',
+  'access-control-expose-headers': 'location, upload-offset',
+  'access-control-max-age': '86400',
+}
+
+/**
+ * Clone `res` and add CORS headers. Using `set()` so calling this on an upstream
+ * response that already carries CORS headers just overwrites them consistently.
+ */
+export function withCors(res: Response): Response {
+  const out = new Response(res.body, res)
+  for (const [k, v] of Object.entries(CORS_HEADERS)) {
+    out.headers.set(k, v)
+  }
+  return out
+}
+
+/**
+ * Return a minimal 204 preflight response for OPTIONS requests.
+ * The browser requires this before sending non-simple cross-origin requests
+ * (e.g. PUT/POST with Authorization or Content-Type).
+ */
+export function corsPreflightResponse(): Response {
+  return new Response(null, { status: 204, headers: CORS_HEADERS })
+}

package/src/index.ts

@@ -15,6 +15,7 @@ import { SuiRpc } from './chain.js'
 import { verifyAccessRequest, deniedReason } from './verify.js'
 import { forward } from './proxy.js'
 import { runQuotaGuard } from './quota.js'
+import { withCors, corsPreflightResponse } from './cors.js'
 
 export { NonceRateState } from './state/durable_object.js'
 
@@ -124,6 +125,11 @@ async function handle(request: Request, env: Env): Promise<Response> {
 
   if (path === '/healthz') return new Response('ok', { status: 200 })
 
+  // Handle CORS preflight before any auth check. The browser sends OPTIONS before
+  // non-simple cross-origin requests (e.g. PUT/POST with Authorization); responding
+  // here avoids the auth path returning 401 and causing the browser to abort.
+  if (request.method === 'OPTIONS') return corsPreflightResponse()
+
   let state: GatewayState
   try {
     state = await getState(env)
@@ -163,7 +169,7 @@ async function handle(request: Request, env: Env): Promise<Response> {
  */
 export default {
   fetch(request: Request, env: Env): Promise<Response> {
-    return handle(request, env)
+    return handle(request, env).then(withCors)
   },
   async scheduled(_controller: ScheduledController, env: Env): Promise<void> {
     if ((env.QUOTA_GUARD_ENABLED ?? 'false').toLowerCase() === 'true') {

package/wrangler.toml

@@ -73,10 +73,11 @@ new_sqlite_classes = ["NonceRateState"]
 # id = "<KV_NAMESPACE_ID>"   # create with: wrangler kv namespace create NONCE_KV
 
 # ── route: Worker serves as the public NFT-gated relay endpoint ───────────────────────────────
-# operator: uncomment and fill in after creating the Worker route in the CF dashboard
-# [[routes]]
-# pattern = "nft-gate.example.com/*"
-# zone_name = "example.com"
+# Configured via CF API (route ID 63427e4dbf9b4428ad9c492487953551).
+# wrangler deploy will create/update this automatically.
+[[routes]]
+pattern = "sui-walrus-relay-testnet.meddleware.co.uk/*"
+zone_name = "meddleware.co.uk"
 
 # ── optional quota guard (needs QUOTA_GUARD_ENABLED=true + the secrets above) ────────────────
 # [triggers]