@positronic/cloudflare 0.0.57 → 0.0.58

package/dist/src/api/auth-middleware.js

@@ -453,6 +453,15 @@ import { parseRequestSignature } from '@misskey-dev/node-http-message-signatures
                         ];
                     case 11:
                         // No matching key found
+                        // Check if ROOT_PUBLIC_KEY is configured - if not, return specific error
+                        if (!c.env.ROOT_PUBLIC_KEY) {
+                            return [
+                                2,
+                                c.json({
+                                    error: 'ROOT_KEY_NOT_CONFIGURED'
+                                }, 401)
+                            ];
+                        }
                         return [
                             2,
                             c.json({

package/dist/src/api/index.js

@@ -141,12 +141,29 @@ app.get('/status', function(context) {
         });
     })();
 });
-// Apply auth middleware to all routes except /status
+// Auth setup endpoint (no auth required) - returns setup instructions
+app.get('/auth/setup', function(context) {
+    return _async_to_generator(function() {
+        var rootKeyConfigured;
+        return _ts_generator(this, function(_state) {
+            rootKeyConfigured = !!context.env.ROOT_PUBLIC_KEY;
+            return [
+                2,
+                context.json({
+                    backend: 'cloudflare',
+                    rootKeyConfigured: rootKeyConfigured,
+                    instructions: "To configure root authentication:\n1. Run: px auth format-jwk-key\n2. In Cloudflare dashboard, go to Workers & Pages > Your project > Settings > Variables and Secrets\n3. Add a new secret named ROOT_PUBLIC_KEY\n4. Paste the JWK value from step 1"
+                })
+            ];
+        });
+    })();
+});
+// Apply auth middleware to all routes except /status and /auth/setup
 app.use('*', function(c, next) {
     return _async_to_generator(function() {
         return _ts_generator(this, function(_state) {
-            // Skip auth for /status endpoint
-            if (c.req.path === '/status') {
+            // Skip auth for unauthenticated endpoints
+            if (c.req.path === '/status' || c.req.path === '/auth/setup') {
                 return [
                     2,
                     next()

package/dist/src/api/secrets.js

@@ -214,6 +214,8 @@ import { Hono } from 'hono';
     }).apply(this, arguments);
 }
 var secrets = new Hono();
+// Protected secret name that cannot be managed via the API
+var PROTECTED_SECRET = 'ROOT_PUBLIC_KEY';
 // List all secrets (names only, not values)
 secrets.get('/', function(context) {
     return _async_to_generator(function() {
@@ -262,8 +264,11 @@ secrets.get('/', function(context) {
                     }
                     // Transform to match spec format - Cloudflare API doesn't return timestamps
                     // so we use placeholder values
+                    // Filter out ROOT_PUBLIC_KEY from the list for security
                     now = new Date().toISOString();
-                    secretList = data.result.map(function(secret) {
+                    secretList = data.result.filter(function(secret) {
+                        return secret.name !== PROTECTED_SECRET;
+                    }).map(function(secret) {
                         return {
                             name: secret.name,
                             createdAt: now,
@@ -341,6 +346,15 @@ secrets.post('/', function(context) {
                             }, 400)
                         ];
                     }
+                    // Block setting ROOT_PUBLIC_KEY via API - must be set in Cloudflare dashboard
+                    if (name === PROTECTED_SECRET) {
+                        return [
+                            2,
+                            context.json({
+                                error: "Cannot set ".concat(PROTECTED_SECRET, " via API. This secret must be configured directly in the Cloudflare dashboard under Workers & Pages > Settings > Variables and Secrets.")
+                            }, 403)
+                        ];
+                    }
                     return [
                         4,
                         cloudflareSecretsApi(config, '', {
@@ -413,6 +427,15 @@ secrets.delete('/:name', function(context) {
                         ];
                     }
                     name = decodeURIComponent(context.req.param('name'));
+                    // Block deleting ROOT_PUBLIC_KEY via API - must be managed in Cloudflare dashboard
+                    if (name === PROTECTED_SECRET) {
+                        return [
+                            2,
+                            context.json({
+                                error: "Cannot delete ".concat(PROTECTED_SECRET, " via API. This secret must be managed directly in the Cloudflare dashboard under Workers & Pages > Settings > Variables and Secrets.")
+                            }, 403)
+                        ];
+                    }
                     _state.label = 1;
                 case 1:
                     _state.trys.push([
@@ -620,6 +643,13 @@ secrets.post('/bulk', function(context) {
                             9
                         ]; // Skip invalid entries
                     }
+                    // Skip ROOT_PUBLIC_KEY - it cannot be set via API
+                    if (secret.name === PROTECTED_SECRET) {
+                        return [
+                            3,
+                            9
+                        ];
+                    }
                     return [
                         4,
                         cloudflareSecretsApi(config, '', {

package/dist/src/sqlite-adapter.js

@@ -150,6 +150,10 @@ function _ts_generator(thisArg, body) {
         };
     }
 }
+// R2 overflow stores large events (>1MB) in R2 instead of SQLite.
+// This feature is manually tested because vitest-pool-workers has limitations
+// with large data and isolated storage cleanup.
+// See: https://developers.cloudflare.com/workers/testing/vitest-integration/known-issues/#isolated-storage
 // Size threshold for R2 overflow (1MB)
 export var R2_OVERFLOW_THRESHOLD = 1024 * 1024;
 // Define the schema with r2_key column for overflow support

package/dist/types/api/auth-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../../src/api/auth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAO3C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAGD,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,IAAI,EAAE,WAAW,CAAC;KACnB;CACF;AAsGD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,iBAAiB,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAgG1E"}
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../../src/api/auth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAO3C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAGD,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,IAAI,EAAE,WAAW,CAAC;KACnB;CACF;AAsGD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,iBAAiB,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAoG1E"}

package/dist/types/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAU3C,QAAA,MAAM,GAAG;cAAwB,QAAQ;yCAAK,CAAC;AAyB/C,eAAe,GAAG,CAAC;AAGnB,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAU3C,QAAA,MAAM,GAAG;cAAwB,QAAQ;yCAAK,CAAC;AAwC/C,eAAe,GAAG,CAAC;AAGnB,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC"}

package/dist/types/api/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/api/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiD3C,QAAA,MAAM,OAAO;cAAwB,QAAQ;yCAAK,CAAC;AA2QnD,eAAe,OAAO,CAAC"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/api/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiD3C,QAAA,MAAM,OAAO;cAAwB,QAAQ;yCAAK,CAAC;AA0SnD,eAAe,OAAO,CAAC"}

package/dist/types/sqlite-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite-adapter.d.ts","sourceRoot":"","sources":["../../src/sqlite-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAGtE,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAajD,qBAAa,qBAAsB,YAAW,OAAO;IACnD,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,iBAAiB,CAAS;gBAEtB,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM;IAMjE,OAAO,CAAC,gBAAgB;IAOX,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CA+DxD"}
+{"version":3,"file":"sqlite-adapter.d.ts","sourceRoot":"","sources":["../../src/sqlite-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAQtE,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAajD,qBAAa,qBAAsB,YAAW,OAAO;IACnD,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,iBAAiB,CAAS;gBAEtB,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM;IAMjE,OAAO,CAAC,gBAAgB;IAOX,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CA+DxD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@positronic/cloudflare",
-  "version": "0.0.57",
+  "version": "0.0.58",
   "publishConfig": {
     "access": "public"
   },
@@ -32,9 +32,9 @@
   },
   "dependencies": {
     "@misskey-dev/node-http-message-signatures": "^0.0.10",
-    "@positronic/core": "^0.0.57",
-    "@positronic/spec": "^0.0.57",
-    "@positronic/template-new-project": "^0.0.57",
+    "@positronic/core": "^0.0.58",
+    "@positronic/spec": "^0.0.58",
+    "@positronic/template-new-project": "^0.0.58",
     "aws4fetch": "^1.0.18",
     "caz": "^2.0.0",
     "cron-schedule": "^5.0.4",