Repository navigation
feat(edge): serve the dashboard pages from the Worker #27
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| export interface ShellDependencies { | ||
| /** The prerendered dashboard build, served by Workers Static Assets. */ | ||
| assets: { fetch: (request: Request) => Promise<Response> } | ||
| } | ||
|
|
||
| /** Paths the controller owns. The Worker never answers these from its own build. */ | ||
| function isControllerPath(pathname: string): boolean { | ||
| return pathname === '/health' || pathname === '/api' || pathname.startsWith('/api/') | ||
| } | ||
|
|
||
| const securityHeaders = { | ||
| 'referrer-policy': 'no-referrer', | ||
| 'x-content-type-options': 'nosniff', | ||
| 'x-frame-options': 'DENY', | ||
| } | ||
|
|
||
| /** The controller's own policy, so the page behaves the same behind the Worker. */ | ||
| function contentSecurityPolicy(nonce: string): string { | ||
| return `default-src 'self'; base-uri 'none'; connect-src 'self'; font-src 'self'; frame-ancestors 'none'; img-src 'self' data: https://github.com https://avatars.githubusercontent.com; object-src 'none'; script-src 'self' 'nonce-${nonce}'; style-src 'self' 'unsafe-inline'` | ||
|
There was a problem hiding this comment. 
Fix: Drive the framing headers from the same setting the controller uses: add a Worker variable for the allowed framing origins and emit 🤖 Prompt for AI agents |
||
| } | ||
|
|
||
| function nonce(): string { | ||
| return btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(18)))) | ||
| } | ||
|
|
||
| /** | ||
| * Serves the dashboard's pages and files from the Worker's own build, so the | ||
| * interface loads while the controller is down. Returns null for anything the | ||
| * build does not hold, and for every request the controller must answer. | ||
| * | ||
| * The prerendered pages carry inline scripts, so each page gets a fresh nonce | ||
| * and the same Content-Security-Policy the controller sends. | ||
| */ | ||
| export async function serveShell(request: Request, dependencies: ShellDependencies): Promise<Response | null> { | ||
| if (request.method !== 'GET' && request.method !== 'HEAD') return null | ||
| const url = new URL(request.url) | ||
| if (isControllerPath(url.pathname)) return null | ||
|
|
||
| const asset = await dependencies.assets.fetch(new Request(url, { method: request.method })) | ||
| if (!asset.ok) return null | ||
|
|
||
| const headers = new Headers(asset.headers) | ||
| for (const [name, value] of Object.entries(securityHeaders)) headers.set(name, value) | ||
|
|
||
| const isHtml = (headers.get('content-type') ?? '').startsWith('text/html') | ||
| if (isHtml) { | ||
| const value = nonce() | ||
| headers.set('cache-control', 'no-store') | ||
| headers.set('content-security-policy', contentSecurityPolicy(value)) | ||
| // The page has been rewritten, so the asset's validators no longer describe it. | ||
| headers.delete('etag') | ||
| headers.delete('content-length') | ||
| const html = request.method === 'HEAD' ? null : await asset.text() | ||
| return new Response( | ||
| html === null | ||
| ? null | ||
| : html.replaceAll('<script', `<script nonce="${value}"`).replaceAll('<style', `<style nonce="${value}"`), | ||
| { status: asset.status, headers }, | ||
| ) | ||
| } | ||
|
|
||
| // Build files are named by content hash, and Access keeps shared caches from holding them. | ||
| headers.set( | ||
| 'cache-control', | ||
| url.pathname.startsWith('/_nuxt/') || url.pathname.startsWith('/_fonts/') | ||
| ? 'private, max-age=31536000, immutable' | ||
| : 'no-store', | ||
| ) | ||
| return new Response(asset.body, { status: asset.status, headers }) | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
serveShellserves dashboard pages with no controller password when Access is offWith
ACCESS_TEAM_DOMAINandACCESS_AUDcleared, a documented way to turn the check off,serveShellanswers any GET or HEAD from the prerendered build andproxyDashboardnever runs, so the controller’s dashboard password stops guarding the pages.Fix: Gate the shell on the controller’s password too, or refuse to serve it when
dependencies.accessis null, for example by only callingserveShellwhen Access is configured.🤖 Prompt for AI agents