document-ocr 0.0.0-stage → 3.1.3

package/hosting/deploy/cloudflare/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "document-ocr-cloudflare",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "wrangler dev",
+    "deploy": "bash deploy.sh",
+    "typecheck": "tsc --noEmit",
+    "check": "wrangler deploy --dry-run --containers-rollout=none --outdir .wrangler/dry-run",
+    "types": "wrangler types",
+    "test": "vitest run",
+    "check:image": "wrangler deploy --dry-run --outdir .wrangler/dry-run"
+  },
+  "dependencies": {
+    "@cloudflare/containers": "0.3.7"
+  },
+  "devDependencies": {
+    "@types/node": "26.6.5",
+    "typescript": "7.0.2",
+    "vitest": "5.0.5",
+    "wrangler": "4.152.0"
+  },
+  "engines": {
+    "node": ">=26"
+  },
+  "overrides": {
+    "undici@>=7.0.0 <7.30.1": "7.30.1"
+  }
+}

package/hosting/deploy/cloudflare/src/gateway.ts

@@ -0,0 +1,42 @@
+import { timingSafeEqual } from 'node:crypto'
+
+export async function authorized(request: Request, token: string | undefined): Promise<boolean> {
+  if (!token) return false
+  const encoder = new TextEncoder()
+  const [provided, expected] = await Promise.all([
+    crypto.subtle.digest('SHA-256', encoder.encode(request.headers.get('Authorization') ?? '')),
+    crypto.subtle.digest('SHA-256', encoder.encode(`Bearer ${token}`)),
+  ])
+  return timingSafeEqual(new Uint8Array(provided), new Uint8Array(expected))
+}
+
+export function instanceCount(value: string): number {
+  const count = Number(value)
+  if (!Number.isInteger(count) || count < 1 || count > 100) {
+    throw new Error('CONTAINER_INSTANCES must be an integer from 1 to 100')
+  }
+  return count
+}
+
+/** Keep uploads and results streaming; only the container decodes document bytes. */
+export async function gateway(
+  request: Request,
+  token: string | undefined,
+  forward: (request: Request) => Promise<Response>,
+): Promise<Response> {
+  if (!token) return Response.json({ error: 'AUTH_NOT_CONFIGURED' }, { status: 503 })
+  // The review shell contains no document data and accepts the bearer token in
+  // its UI. Browser navigation cannot supply that header before the UI loads.
+  const reviewShell = request.method === 'GET' && new URL(request.url).pathname === '/review'
+  if (!reviewShell && !await authorized(request, token)) {
+    return Response.json({ error: 'UNAUTHORIZED' }, { status: 401, headers: { 'WWW-Authenticate': 'Bearer' } })
+  }
+  try {
+    const response = await forward(request)
+    const headers = new Headers(response.headers)
+    headers.set('Cache-Control', 'no-store')
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers })
+  } catch {
+    return Response.json({ error: 'OCR_CONTAINER_UNAVAILABLE' }, { status: 503, headers: { 'Cache-Control': 'no-store' } })
+  }
+}

package/hosting/deploy/cloudflare/src/index.ts

@@ -0,0 +1,21 @@
+import { Container, getRandom } from '@cloudflare/containers'
+import { gateway, instanceCount } from './gateway'
+
+export class OcrContainer extends Container<Env> {
+  defaultPort = 8000
+  sleepAfter = this.env.CONTAINER_IDLE_TIMEOUT
+  enableInternet = false
+  envVars = {
+    DOCUMENT_OCR_KYC_LANGS: this.env.DOCUMENT_OCR_KYC_LANGS,
+    API_TOKEN: this.env.API_TOKEN,
+  }
+}
+
+export default {
+  async fetch(request, env) {
+    return gateway(request, env.API_TOKEN, async (incoming) => {
+      const container = await getRandom(env.OCR, instanceCount(env.CONTAINER_INSTANCES))
+      return container.fetch(incoming)
+    })
+  },
+} satisfies ExportedHandler<Env>

package/hosting/deploy/cloudflare/test/gateway.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, it, vi } from 'vitest'
+import { gateway, instanceCount } from '../src/gateway'
+
+describe('OCR gateway', () => {
+  it('loads only the public review shell before a browser supplies its token', async () => {
+    const forward = vi.fn(async () => new Response('<html>Token entry</html>'))
+    const response = await gateway(new Request('https://ocr.test/review'), 'correct', forward)
+    expect(response.status).toBe(200)
+    expect(response.headers.get('Cache-Control')).toBe('no-store')
+    expect(forward).toHaveBeenCalledOnce()
+    for (const [path, method] of [['/review', 'POST'], ['/preview', 'POST'], ['/documents', 'GET'], ['/jobs/id', 'GET']]) {
+      const denied = await gateway(new Request(`https://ocr.test${path}`, { method }), 'correct', forward)
+      expect(denied.status).toBe(401)
+    }
+    expect(forward).toHaveBeenCalledOnce()
+  })
+
+  it('rejects a missing server secret without starting a container', async () => {
+    const forward = vi.fn()
+    const response = await gateway(new Request('https://ocr.test/scan'), undefined, forward)
+    expect(response.status).toBe(503)
+    expect(forward).not.toHaveBeenCalled()
+  })
+
+  it.each([null, 'Bearer wrong', 'Basic correct'])('rejects invalid credentials (%s) before routing', async (authorization) => {
+    const headers = authorization ? { Authorization: authorization } : {}
+    const forward = vi.fn()
+    const response = await gateway(new Request('https://ocr.test/scan', { headers }), 'correct', forward)
+    expect(response.status).toBe(401)
+    expect(forward).not.toHaveBeenCalled()
+  })
+
+  it('forwards authenticated multipart requests and preserves partial-result status', async () => {
+    const form = new FormData()
+    form.append('image', new Blob(['synthetic'], { type: 'image/png' }), 'image.png')
+    const request = new Request('https://ocr.test/scan/document?type=pan', {
+      method: 'POST', headers: { Authorization: 'Bearer correct' }, body: form,
+    })
+    const forward = vi.fn(async (received: Request) => {
+      expect(received).toBe(request)
+      expect((await received.formData()).get('image')).toBeInstanceOf(Blob)
+      return Response.json({ status: 'failure' }, { status: 422 })
+    })
+    const response = await gateway(request, 'correct', forward)
+    expect(response.status).toBe(422)
+    expect(response.headers.get('Cache-Control')).toBe('no-store')
+    expect(await response.json()).toEqual({ status: 'failure' })
+  })
+
+  it('returns a retryable error when container startup fails', async () => {
+    const request = new Request('https://ocr.test/ready', { headers: { Authorization: 'Bearer correct' } })
+    const response = await gateway(request, 'correct', async () => { throw new Error('unavailable') })
+    expect(response.status).toBe(503)
+  })
+
+  it.each(['0', '-1', '1.5', 'NaN', '101'])('rejects invalid pool size %s', (value) => {
+    expect(() => instanceCount(value)).toThrow('CONTAINER_INSTANCES')
+  })
+})

package/hosting/deploy/cloudflare/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "types": ["./worker-configuration.d.ts", "node"]
+  },
+  "include": ["src/**/*.ts", "worker-configuration.d.ts"]
+}