workers/app.ts

Functions

Imports

It imports app/lib/backup-checks.ts, app/lib/backup.server.ts, app/lib/context.ts, app/lib/google/refresh.server.ts, app/lib/health.server.ts, app/lib/inbox-report.server.ts, app/lib/mcp/door.ts, app/lib/mcp/server.ts, app/lib/refresh.server.ts, app/lib/sites.server.ts, app/lib/social/queue.server.ts, workers/csp-report.ts, workers/gate.ts, workers/security-headers.ts. No module of this repo imports it.

Source

1import { createRequestHandler, RouterContextProvider } from "react-router";
2
3import { cloudflareContext, nonceContext, viewerContext } from "~/lib/context";
4import { BACKUP_CRON } from "~/lib/backup-checks";
5import { runBackup } from "~/lib/backup.server";
6import { refreshGoogle } from "~/lib/google/refresh.server";
7import { runHealth } from "~/lib/health.server";
8import { reportInbox } from "~/lib/inbox-report.server";
9import { aiDoor, isMcpHost, mcpOrigin } from "~/lib/mcp/door";
10import { carrelOrigin } from "~/lib/mcp/server";
11import { refreshAllSites } from "~/lib/refresh.server";
12import { siteOrigins } from "~/lib/sites.server";
13import { processSocial } from "~/lib/social/queue.server";
14
15import { cspReport, isCspReport } from "./csp-report";
16import { gate } from "./gate";
17import { newNonce, withDoorSecurityHeaders, withSecurityHeaders } from "./security-headers";
18
19const requestHandler = createRequestHandler(
20  () => import("virtual:react-router/server-build"),
21  import.meta.env.MODE,
22);
23
24export default {
25  async fetch(request, env, ctx) {
26    // Two doors, told apart by the hostname alone. The AI door (carrel-mcp.dustinedwards.info) speaks
27    // OAuth and MCP and nothing else, plus the CSP report sink; the pages are never served there.
28    // Everything else is the browser door, behind Access. Every response on either carries the
29    // security headers (workers/security-headers.ts), refusals and redirects included.
30    if (isMcpHost(request, env)) {
31      const response = isCspReport(request) ? await cspReport(request, carrelOrigin(env)) : await aiDoor(request, env, ctx);
32      return withDoorSecurityHeaders(response, mcpOrigin(env));
33    }
34    const nonce = newNonce();
35    const response = await gate(request, env, async (req, viewer) => {
36      const context = new RouterContextProvider();
37      context.set(cloudflareContext, { env, ctx });
38      context.set(viewerContext, viewer);
39      context.set(nonceContext, nonce);
40      return requestHandler(req, context);
41    });
42    return withSecurityHeaders(response, nonce, { imageOrigins: siteOrigins(env), reportOrigin: mcpOrigin(env) });
43  },
44
45  scheduled(controller, env, ctx) {
46    // The nightly cron runs the dump alone. A failure is logged and left for the health check, whose
47    // backup age keeps growing, to report; it is never swallowed.
48    if (controller.cron === BACKUP_CRON) {
49      ctx.waitUntil(runBackup(env).catch((error) => console.error(JSON.stringify({ backup: "failed", error: String(error) }))));
50      return;
51    }
52    ctx.waitUntil(runHealth(env));
53    ctx.waitUntil(refreshAllSites(env));
54    ctx.waitUntil(refreshGoogle(env));
55    ctx.waitUntil(reportInbox(env));
56    ctx.waitUntil(processSocial(env).catch((error) => console.error(JSON.stringify({ social: "tick-failed", error: String(error) }))));
57  },
58} satisfies ExportedHandler<Env>;