@meddleware/nft-gate-gateway 0.0.3 → 0.0.5

package/package.json

@@ -1,6 +1,6 @@
-{
+ {
   "name": "@meddleware/nft-gate-gateway",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "type": "module",
   "description": "Cloudflare Workers implementation of the nft-gate gateway: a wire-identical, drop-in sibling of the Rust gateway that gates any HTTP upstream behind an access_gate NFT.",
   "license": "0BSD",

package/src/cors.ts

@@ -0,0 +1,38 @@
+/**
+ * CORS utilities for the nft-gate Cloudflare Worker.
+ *
+ * The Worker is accessed from browser origins (e.g. sui-walrus.meddleware.co.uk,
+ * sui.meddleware.co.uk) that differ from the Worker's own hostname. Without
+ * Access-Control-Allow-Origin headers the browser blocks the response even when
+ * the Worker returns 200, and OPTIONS preflights (required before non-simple requests
+ * such as PUT uploads with an Authorization header) receive no preflight grant.
+ */
+
+const CORS_HEADERS: Record<string, string> = {
+  'access-control-allow-origin': '*',
+  'access-control-allow-methods': 'GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS',
+  'access-control-allow-headers': 'authorization, content-type, x-access-proof',
+  'access-control-expose-headers': 'location, upload-offset',
+  'access-control-max-age': '86400',
+}
+
+/**
+ * Clone `res` and add CORS headers. Using `set()` so calling this on an upstream
+ * response that already carries CORS headers just overwrites them consistently.
+ */
+export function withCors(res: Response): Response {
+  const out = new Response(res.body, res)
+  for (const [k, v] of Object.entries(CORS_HEADERS)) {
+    out.headers.set(k, v)
+  }
+  return out
+}
+
+/**
+ * Return a minimal 204 preflight response for OPTIONS requests.
+ * The browser requires this before sending non-simple cross-origin requests
+ * (e.g. PUT/POST with Authorization or Content-Type).
+ */
+export function corsPreflightResponse(): Response {
+  return new Response(null, { status: 204, headers: CORS_HEADERS })
+}

package/src/index.ts

@@ -15,6 +15,7 @@ import { SuiRpc } from './chain.js'
 import { verifyAccessRequest, deniedReason } from './verify.js'
 import { forward } from './proxy.js'
 import { runQuotaGuard } from './quota.js'
+import { withCors, corsPreflightResponse } from './cors.js'
 
 export { NonceRateState } from './state/durable_object.js'
 
@@ -124,6 +125,11 @@ async function handle(request: Request, env: Env): Promise<Response> {
 
   if (path === '/healthz') return new Response('ok', { status: 200 })
 
+  // Handle CORS preflight before any auth check. The browser sends OPTIONS before
+  // non-simple cross-origin requests (e.g. PUT/POST with Authorization); responding
+  // here avoids the auth path returning 401 and causing the browser to abort.
+  if (request.method === 'OPTIONS') return corsPreflightResponse()
+
   let state: GatewayState
   try {
     state = await getState(env)
@@ -163,7 +169,7 @@ async function handle(request: Request, env: Env): Promise<Response> {
  */
 export default {
   fetch(request: Request, env: Env): Promise<Response> {
-    return handle(request, env)
+    return handle(request, env).then(withCors)
   },
   async scheduled(_controller: ScheduledController, env: Env): Promise<void> {
     if ((env.QUOTA_GUARD_ENABLED ?? 'false').toLowerCase() === 'true') {

package/src/proxy.ts

@@ -42,16 +42,19 @@ export async function forward(cfg: Config, request: Request): Promise<Response>
   const pathAndQuery = url.pathname + url.search
   const upstreamUrl = cfg.upstreamUrl + pathAndQuery
 
-  // Read + cap the body (a griefing guard) before forwarding.
-  let body: ArrayBuffer | undefined
+  // Size guard: check Content-Length first (cheap, avoids buffering). Not authoritative
+  // (clients can lie) but protects against accidental oversized sends; the relay enforces
+  // its own hard limit. Stream the body directly — buffering 60+ MB encoded blobs into an
+  // ArrayBuffer would exhaust Worker memory for large Walrus uploads.
   const method = request.method.toUpperCase()
   if (method !== 'GET' && method !== 'HEAD') {
-    const buf = await request.arrayBuffer()
-    if (buf.byteLength > cfg.maxBodyBytes) {
+    const cl = parseInt(request.headers.get('content-length') ?? '', 10)
+    if (Number.isFinite(cl) && cl > cfg.maxBodyBytes) {
       return errorResponse(413, 'request body too large')
     }
-    body = buf
   }
+  const body: ReadableStream | null | undefined =
+    method !== 'GET' && method !== 'HEAD' ? request.body : undefined
 
   const headers = new Headers(request.headers)
   headers.delete('host')
@@ -66,7 +69,13 @@ export async function forward(cfg: Config, request: Request): Promise<Response>
 
   let upstream: Response
   try {
-    upstream = await fetch(upstreamUrl, { method: request.method, headers, body })
+    upstream = await fetch(upstreamUrl, {
+      method: request.method,
+      headers,
+      body: body ?? null,
+      // @ts-expect-error — CF Workers supports streaming body via ReadableStream without 'duplex'
+      duplex: 'half',
+    })
   } catch {
     return errorResponse(502, 'upstream error')
   }

package/wrangler.toml

@@ -49,7 +49,7 @@ GATE_ID = "0x0485c1fa80e4c355c85ab99c0281a328d8fb5c60ac50ab64f10be0f8be792aba"
 SINGLE_USE = "true"
 PUBLIC_PATHS = "/v1/tip-config"
 RATE_LIMIT_PER_MIN = "30"
-MAX_BODY_BYTES = "262144"
+MAX_BODY_BYTES = "104857600"
 CHALLENGE_TTL_SECS = "300"
 OWNERSHIP_CACHE_TTL_MS = "0"
 # Workers-specific:
@@ -73,10 +73,11 @@ new_sqlite_classes = ["NonceRateState"]
 # id = "<KV_NAMESPACE_ID>"   # create with: wrangler kv namespace create NONCE_KV
 
 # ── route: Worker serves as the public NFT-gated relay endpoint ───────────────────────────────
-# operator: uncomment and fill in after creating the Worker route in the CF dashboard
-# [[routes]]
-# pattern = "nft-gate.example.com/*"
-# zone_name = "example.com"
+# Configured via CF API (route ID 63427e4dbf9b4428ad9c492487953551).
+# wrangler deploy will create/update this automatically.
+[[routes]]
+pattern = "sui-walrus-relay-testnet.meddleware.co.uk/*"
+zone_name = "meddleware.co.uk"
 
 # ── optional quota guard (needs QUOTA_GUARD_ENABLED=true + the secrets above) ────────────────
 # [triggers]