src/portal-app.ts

Functions

Imports

It imports src/dashboard-csp.ts, src/env.ts, src/http.ts, src/portal-auth.ts, src/portal-host.ts. Imported by src/routes.ts.

Source

1import { DASHBOARD_CSP } from "./dashboard-csp";
2import type { Env } from "./env";
3import { PORTAL_PATH, portalGate } from "./portal-auth";
4import { portalBase } from "./portal-host";
5import { textResponse as text } from "./http";
6
7// Capsid Portal's built files, served at /portal/ (capsid/research/design-ops-console.md,
8// moved from /console/app/ by capsid/research/design-portal-unify.md). Every request
9// goes through portalGate first and only then reaches env.ASSETS: the files are the
10// admin's dashboard, and a file served before the gate is a file served to anyone.
11// The router matches /portal/callback and every /portal/api/ path before this handler,
12// so neither can fall back to the app's page.
13//
14// That ordering holds only while the Worker runs before the assets router. The deployed
15// config must set `assets.run_worker_first: true` (docs/portal.md): without it,
16// Cloudflare serves a request that matches a file (the assets directory's own
17// /index.html and /assets/*, at the root of the origin) without invoking this Worker.
18// No test here can prove that setting: the integration pool's SELF is the Worker
19// itself, not the assets router (vitest.config.ts says more), so it is a deploy-config
20// check, not a test.
21
22// The app's page CSP. The string lives in src/dashboard-csp.ts so the app's browser
23// tests serve the same one.
24export { DASHBOARD_CSP };
25
26// Hashed build output, named by content, so a changed file has a new name. Private:
27// the files sit behind a login, so no shared cache keeps a copy.
28export const HASHED_ASSET_CACHE = "private, max-age=31536000, immutable";
29const HASHED_ASSET_PREFIX = "/assets/";
30
31const NOT_DEPLOYED =
32  "Capsid Portal is not deployed: this Worker has no ASSETS binding. The built app (dashboard/dist) is served only when the deploy config declares it.";
33
34/** A navigation, as opposed to a script or fetch asking for a file: the only kind that
35 *  falls back to the app's page, so a client route such as /portal/jobs loads the app
36 *  while a missing script is still a 404. */
37export function isNavigation(request: Request): boolean {
38  if (request.headers.get("Sec-Fetch-Mode") === "navigate") return true;
39  return (request.headers.get("Accept") ?? "").includes("text/html");
40}
41
42/** The path inside the assets directory. The page is asked for as "/", because the
43 *  assets router answers /index.html with a redirect to / under its default html
44 *  handling. */
45export function assetPath(pathname: string): string {
46  const inner = pathname.slice(PORTAL_PATH.length) || "/";
47  return inner === "/index.html" ? "/" : inner;
48}
49
50function fetchAsset(assets: Fetcher, path: string, method: string): Promise<Response> {
51  // The hostname is not meaningful to the binding; only the pathname is matched.
52  return assets.fetch(new Request(new URL(path, "https://assets.invalid"), { method }));
53}
54
55export async function handlePortalApp(request: Request, env: Env, now: Date = new Date()): Promise<Response> {
56  const url = new URL(request.url);
57  const gate = await portalGate(request, env, now, url.pathname);
58  if (!gate.ok) return gate.response;
59  if (!env.ASSETS) return text(NOT_DEPLOYED, 503);
60  if (request.method !== "GET" && request.method !== "HEAD") return text("method not allowed: the Portal's files are read with GET.", 405, { Allow: "GET, HEAD" });
61
62  let path = assetPath(url.pathname);
63  let response = await fetchAsset(env.ASSETS, path, request.method);
64  if (response.status === 404 && isNavigation(request)) {
65    // Behind the gate, like every other answer here: the fallback is the app's page.
66    await response.body?.cancel();
67    path = "/";
68    response = await fetchAsset(env.ASSETS, path, request.method);
69  }
70
71  const headers = new Headers(response.headers);
72  // A redirect from the assets router names a path inside the assets directory; the
73  // browser needs it under the Portal's base on this host (/portal, or the root).
74  const location = headers.get("Location");
75  // A protocol-relative or backslash Location names another host, so it is dropped rather
76  // than forwarded (Grok audit 2026-10-21, CA-8).
77  if (location && (location.startsWith("//") || location.includes("\\"))) headers.delete("Location");
78  else if (location?.startsWith("/")) headers.set("Location", portalBase(url) + location);
79
80  if (response.ok && path === "/") {
81    headers.set("Cache-Control", "no-store");
82    // Referrer-Policy, X-Frame-Options and the rest come from withSecurityHeaders (src/security-headers.ts).
83    headers.set("Content-Security-Policy", DASHBOARD_CSP);
84  } else if (response.ok && path.startsWith(HASHED_ASSET_PREFIX)) {
85    headers.set("Cache-Control", HASHED_ASSET_CACHE);
86  } else {
87    headers.set("Cache-Control", "no-store");
88  }
89  return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
90}