workers/app.ts

Functions

Imports

It imports app/lib/context.ts, app/lib/https-redirect.mjs, app/lib/negotiate.mjs, app/lib/publications/pdf-redirect.mjs, app/lib/seo.ts, app/lib/theme.ts, app/lib/timing.ts, app/lib/webmention/queue.ts, app/lib/wordpress-redirects.mjs, app/lib/worker-preview.ts, workers/ask-budget.ts, workers/csp.mjs, workers/feed-types.mjs, workers/media-events.ts, workers/security-headers.mjs, workers/webmention-verify.ts. No module of this repo imports it.

Source

1// aislop-ignore-next-line ai-slop/hallucinated-import -- a Workers built-in, not an npm package
2import { WorkerEntrypoint } from "cloudflare:workers";
3import { createRequestHandler, RouterContextProvider } from "react-router";
4
5import { cloudflareContext, documentHandlerContext, nonceContext } from "~/lib/context";
6import { httpsRedirectStatus, httpsRedirectTarget } from "~/lib/https-redirect.mjs";
7import { negotiatesAwayFromHtml } from "~/lib/negotiate.mjs";
8import { EDGE_CACHE_CONTROL, EDGE_CACHE_HEADER, SHARED_CACHE_CONTROL } from "~/lib/seo";
9import { isApexHost, wordpressDisposition, wwwRedirectTarget } from "~/lib/wordpress-redirects.mjs";
10import { paperSlashTarget } from "~/lib/publications/pdf-redirect.mjs";
11import { themeFromRequest } from "~/lib/theme";
12import { serverTiming, timingsContext, type Timings } from "~/lib/timing";
13import {
14  CSP_ENDPOINT_NAME,
15  CSP_REPORT_PATH,
16  contentSecurityPolicy,
17  isPrivatePath,
18} from "./csp.mjs";
19import { isUnpolicedType } from "./feed-types.mjs";
20import { applyHeaderSet } from "@dustinedwards/site-runtime/headers";
21import { reportingEndpoints } from "@dustinedwards/site-runtime/csp";
22import { SECURITY_HEADERS } from "./security-headers.mjs";
23import { handleMediaEvents } from "./media-events";
24import { handleWebmentionVerify } from "./webmention-verify";
25import { WEBMENTION_VERIFY_QUEUE } from "~/lib/webmention/queue";
26import { isWorkerPreview } from "~/lib/worker-preview";
27
28export { AskBudget } from "./ask-budget";
29
30const requestHandler = createRequestHandler(
31  () => import("virtual:react-router/server-build"),
32  import.meta.env.MODE,
33);
34
35// Omitting Cache-Control is not opting out: the platform caches it heuristically and cookies are not
36// in the key, so an authenticated /admin render would be served to anyone.
37const UNCACHED = "private, no-store";
38
39// `Cloudflare-CDN-Cache-Control` outranks `Cache-Control` at the edge, so it is stripped from any
40// response not marked shared, or a private one would become storable.
41function applyEdgePolicy(headers: Headers): void {
42  if (headers.get("cache-control") !== SHARED_CACHE_CONTROL) {
43    headers.delete(EDGE_CACHE_HEADER);
44    return;
45  }
46  if (!headers.has(EDGE_CACHE_HEADER)) headers.set(EDGE_CACHE_HEADER, EDGE_CACHE_CONTROL);
47}
48
49// The path is written into the key because a custom `cf.cacheKey` replaces the platform's path and
50// query rather than extending them. The platform cache is the only cache; do not add `caches.default`.
51export type RendererProps = { theme?: string };
52
53export function cacheDimensions(
54  url: URL,
55  request: Request,
56  theme: string,
57): { cacheKey: string; props: RendererProps } {
58  const themed =
59    request.method === "GET" &&
60    !isPrivatePath(url.pathname) &&
61    !negotiatesAwayFromHtml(request);
62
63  if (!themed) return { cacheKey: `${url.pathname}${url.search}`, props: {} };
64
65  const keyUrl = new URL(url);
66  keyUrl.searchParams.set("theme", theme);
67  return { cacheKey: `${keyUrl.pathname}${keyUrl.search}`, props: { theme } };
68}
69
70// The shared package's apply, authoritative: this site's set wins over anything a route set.
71function applySecurityHeaders(headers: Headers) {
72  applyHeaderSet(headers, SECURITY_HEADERS);
73}
74
75/**
76 * Every header a rendered response leaves with, on both exits of the Renderer: timing, the security
77 * set, the report endpoint, the policy (feeds excepted) and the uncached default.
78 */
79function applyDocumentHeaders(
80  headers: Headers,
81  { timings, reportTo, csp }: { timings: Timings | undefined; reportTo: string; csp: string },
82) {
83  if (timings) headers.set("Server-Timing", serverTiming(timings));
84  applySecurityHeaders(headers);
85  headers.set("Reporting-Endpoints", reportTo);
86  if (!isUnpolicedType(headers.get("content-type"))) {
87    headers.set("Content-Security-Policy", csp);
88  }
89  if (!headers.has("cache-control")) headers.set("cache-control", UNCACHED);
90  applyEdgePolicy(headers);
91}
92
93/**
94 * The cacheable entrypoint; `default` has cache disabled. Document headers belong here, or they are absent from every hit.
95 */
96export class Renderer extends WorkerEntrypoint<Env, RendererProps> {
97  override async fetch(request: Request): Promise<Response> {
98    const env = this.env;
99    const ctx = this.ctx;
100    const url = new URL(request.url);
101
102    const context = new RouterContextProvider();
103    context.set(cloudflareContext, { env, ctx });
104    // For the Carrel preview, which renders a page through the same routes without a second fetch.
105    context.set(documentHandlerContext, requestHandler);
106
107    // The private planes only (/admin, /lab): a public page is edge-cached with its header, so a nonce there would be shared
108    // by every reader; its one inline script is allowed by hash instead (workers/csp.mjs). A static
109    // or derived nonce looks exactly like success: every page renders and the policy is worth
110    // nothing.
111    const adminNonce = isPrivatePath(url.pathname) ? crypto.randomUUID() : undefined;
112    context.set(nonceContext, adminNonce);
113
114    // Stamped here because loaders run concurrently on one shared `timings` array; only after the
115    // handler returns is it complete.
116    const handlerStart = performance.now();
117    const response = await requestHandler(request, context);
118    const timings = context.get(timingsContext).timings;
119    if (timings) {
120      timings.push({ name: "worker_total", ms: performance.now() - handlerStart });
121    }
122
123    // Absolute https (the gateway has already redirected plaintext): `Reporting-Endpoints` ignores anything else.
124    const reportTo = reportingEndpoints(CSP_ENDPOINT_NAME, new URL(CSP_REPORT_PATH, url.origin));
125    // The same pathname React Router reads off this request, so the hashed rules are the rendered ones.
126    const csp = await contentSecurityPolicy(url.pathname, adminNonce);
127
128
129    const document = { timings, reportTo, csp };
130
131    // `Response.redirect()` and friends return immutable headers, so a `set` throws; the catch
132    // rebuilds and applies the same set.
133    try {
134      applyDocumentHeaders(response.headers, document);
135    } catch {
136      const headers = new Headers(response.headers);
137      applyDocumentHeaders(headers, document);
138      return new Response(response.body, {
139        status: response.status,
140        statusText: response.statusText,
141        headers,
142      });
143    }
144
145    return response;
146  }
147}
148
149/**
150 * A gateway redirect: 301 for GET and HEAD, 308 otherwise so a form body survives. `no-store` is
151 * load-bearing: the scheme is not in the cache key, so a stored HTTPS redirect would loop HTTPS
152 * readers, and a stored rename would outlive a change to the map.
153 */
154function redirectTo(request: Request, location: string) {
155  return new Response(null, {
156    status: httpsRedirectStatus(request.method),
157    headers: { Location: location, "Cache-Control": "no-store" },
158  });
159}
160
161/** A fetched response's headers can be immutable, so a refused set rebuilds it around a copy. */
162function withHeader(response: Response, name: string, value: string): Response {
163  try {
164    response.headers.set(name, value);
165    return response;
166  } catch {
167    const headers = new Headers(response.headers);
168    headers.set(name, value);
169    return new Response(response.body, {
170      status: response.status,
171      statusText: response.statusText,
172      headers,
173    });
174  }
175}
176
177type FetchArgs = Parameters<NonNullable<ExportedHandler<Env>["fetch"]>>;
178
179/*
180 * THE GATEWAY. Cache disabled, so it runs on every request (check:urls reads this phrase).
181 * Order is load-bearing: the HTTPS redirect first, because the cache key ignores the scheme.
182 */
183export default {
184  async fetch(request, env, ctx) {
185    const response = await gateway(request, env, ctx);
186    // Every exit, redirects included, which never pass through applyDocumentHeaders. Static assets
187    // are served before the Worker runs, so robots.txt's Disallow is what covers those.
188    // The workers.dev address keeps answering after the cutover (the watchdog, the browser tests and
189    // the sign-in fallback use it), so it is kept out of the index here rather than redirected away.
190    // robots.txt must not disallow it, or a crawler never reads this header.
191    const unindexed = isWorkerPreview(env) || new URL(request.url).hostname.endsWith(".workers.dev");
192    return unindexed ? withHeader(response, "X-Robots-Tag", "noindex") : response;
193  },
194
195  async queue(batch, env) {
196    if (batch.queue === WEBMENTION_VERIFY_QUEUE) await handleWebmentionVerify(batch, env);
197    else await handleMediaEvents(batch, env);
198  },
199
200} satisfies ExportedHandler<Env>;
201
202async function gateway(...[request, , ctx]: FetchArgs): Promise<Response> {
203  // First, so `http://www/x` is one hop to `https://apex/x` and not two.
204  const requested = new URL(request.url);
205  const apex = wwwRedirectTarget(requested.hostname, requested.pathname, requested.search);
206  if (apex !== null) return redirectTo(request, apex);
207
208  const secure = httpsRedirectTarget(request.url);
209  if (secure !== null) return redirectTo(request, secure);
210
211  const url = new URL(request.url);
212
213  // The old WordPress addresses, on the apex host only: the new site's own paths never reach this map.
214  const wordpress = isApexHost(url.hostname) ? wordpressDisposition(url.pathname) : null;
215  if (wordpress?.status === 301) {
216    return redirectTo(request, new URL(wordpress.location, url).toString());
217  }
218
219  // The slash form is canonical: Scholar honors `citation_pdf_url` only in the page's subdirectory.
220  const slashed = paperSlashTarget(url.pathname);
221  if (slashed !== null) return redirectTo(request, new URL(`${slashed}${url.search}`, url).toString());
222
223  // A removed WordPress address renders the Gone page in its place: the address bar keeps the old URL
224  // and the status is 410. Every redirect above was decided first; none of them names a removed path.
225  const gone = wordpress?.status === 410 ? new URL("/gone", url) : null;
226
227  const theme = themeFromRequest(request);
228  const { cacheKey, props } = cacheDimensions(gone ?? url, request, theme);
229
230  const response = await ctx.exports.Renderer({ props }).fetch(gone ? new Request(gone, request) : request, {
231    cf: { cacheKey },
232  });
233
234  // Tells browsers and proxies not to hold a per-reader document. Not in the Renderer, whose
235  // response is the one the platform stores. Any cookie counts, failing closed.
236  const shared = response.headers.get("cache-control") === SHARED_CACHE_CONTROL;
237  const out =
238    shared && request.headers.has("cookie") ? withHeader(response, "cache-control", UNCACHED) : response;
239
240  return out;
241}