workers/gate.ts

Functions

Imports

It imports app/lib/access.server.ts, app/lib/people.server.ts. Imported by workers/app.ts.

Source

1// The browser door. Nothing renders until Access has vouched for the request and the email it
2// carries belongs to an active person in Carrel. Kept apart from app.ts so tests can drive it without
3// the React Router build.
4//
5// This is the only door on carrel.dustinedwards.info. The AI door is a different hostname,
6// carrel-mcp.dustinedwards.info, served by app/lib/mcp/door.ts and chosen in app.ts by the host
7// alone (design decision 7, corrected 2026-09-27). So a browser session is never treated as AI, and
8// an AI session never reaches the buttons: /mcp here is just a page that does not exist, behind
9// Access like every other.
10
11import type { KeySource } from "@dustinedwards/site-runtime/access-login";
12
13import { verifyAccess } from "~/lib/access.server";
14import { findViewer, type Viewer } from "~/lib/people.server";
15
16export type Render = (request: Request, viewer: Viewer) => Promise<Response>;
17
18// Caching only. The security headers (HSTS, framing, nosniff, Referrer-Policy and the rest) are
19// workers/security-headers.ts's, applied by app.ts to everything this returns, refusals included.
20const PRIVATE_CACHE = "private, no-store";
21
22function withPrivateHeaders(response: Response): Response {
23  const out = new Response(response.body, response);
24  // An HTML page is left as it is: Cloudflare does not touch a response that says no-transform, which
25  // keeps the Web Analytics beacon out of private pages (a dashboard exclusion needs the Pro plan).
26  // Scripts, styles and fonts stay compressible. One Cache-Control header, never two.
27  const html = out.headers.get("Content-Type")?.toLowerCase().startsWith("text/html");
28  out.headers.set("Cache-Control", html ? `${PRIVATE_CACHE}, no-transform` : PRIVATE_CACHE);
29  return out;
30}
31
32/** The same bare 403 for every refusal, so a caller learns nothing about why. The reason is logged. */
33function refuse(reason: string): Response {
34  console.warn(JSON.stringify({ gate: "refused", reason }));
35  return withPrivateHeaders(
36    new Response("Forbidden", { status: 403, headers: { "Content-Type": "text/plain; charset=utf-8" } }),
37  );
38}
39
40export async function gate(
41  request: Request,
42  env: Env,
43  render: Render,
44  keys?: KeySource,
45): Promise<Response> {
46  let viewer: Viewer | null;
47  try {
48    const access = await verifyAccess(request, { teamDomain: env.ACCESS_TEAM_DOMAIN, audience: env.ACCESS_AUD }, keys);
49    if (!access.ok) return refuse(access.reason);
50    viewer = await findViewer(env.DB, access.email);
51  } catch (error) {
52    return refuse(`error: ${error instanceof Error ? error.message : String(error)}`);
53  }
54  if (!viewer) return refuse("unknown-person");
55  // A reviewer is an AI agent, not a person: it has no business at the browser door.
56  if (viewer.isReviewer) return refuse("reviewer-at-browser-door");
57  return withPrivateHeaders(await render(request, viewer));
58}