|
| 1 | +const AUDIT_ROUTE = "/v1/codex-audit"; |
| 2 | +const HEALTH_ROUTE = "/healthz"; |
| 3 | +const JOB_ID_PATTERN = /^[A-Za-z0-9_-]{24,96}$/; |
| 4 | + |
| 5 | +function jsonResponse(status, payload) { |
| 6 | + return new Response(JSON.stringify(payload), { |
| 7 | + status, |
| 8 | + headers: { |
| 9 | + "Content-Type": "application/json; charset=utf-8", |
| 10 | + "Cache-Control": "no-store", |
| 11 | + }, |
| 12 | + }); |
| 13 | +} |
| 14 | + |
| 15 | +function isLocalhost(hostname) { |
| 16 | + return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1"; |
| 17 | +} |
| 18 | + |
| 19 | +function withoutTrailingSlash(pathname) { |
| 20 | + return pathname.replace(/\/+$/, ""); |
| 21 | +} |
| 22 | + |
| 23 | +function isAuditPath(pathname) { |
| 24 | + if (pathname === AUDIT_ROUTE || pathname === `${AUDIT_ROUTE}/jobs`) { |
| 25 | + return true; |
| 26 | + } |
| 27 | + const prefix = `${AUDIT_ROUTE}/jobs/`; |
| 28 | + return pathname.startsWith(prefix) && JOB_ID_PATTERN.test(pathname.slice(prefix.length)); |
| 29 | +} |
| 30 | + |
| 31 | +function methodAllowed(method, pathname) { |
| 32 | + if (pathname === HEALTH_ROUTE) { |
| 33 | + return method === "GET"; |
| 34 | + } |
| 35 | + if (pathname === AUDIT_ROUTE || pathname === `${AUDIT_ROUTE}/jobs`) { |
| 36 | + return method === "POST"; |
| 37 | + } |
| 38 | + if (pathname.startsWith(`${AUDIT_ROUTE}/jobs/`)) { |
| 39 | + return method === "GET"; |
| 40 | + } |
| 41 | + return false; |
| 42 | +} |
| 43 | + |
| 44 | +export function buildOriginUrl(rawOriginUrl, routePath, search = "") { |
| 45 | + if (!rawOriginUrl || !rawOriginUrl.trim()) { |
| 46 | + throw new Error("CODEX_AUDIT_ORIGIN_URL is required"); |
| 47 | + } |
| 48 | + if (!isAuditPath(routePath)) { |
| 49 | + throw new Error("route is not allowed"); |
| 50 | + } |
| 51 | + |
| 52 | + const origin = new URL(rawOriginUrl.trim()); |
| 53 | + if (origin.protocol !== "https:" && !(origin.protocol === "http:" && isLocalhost(origin.hostname))) { |
| 54 | + throw new Error("CODEX_AUDIT_ORIGIN_URL must use HTTPS"); |
| 55 | + } |
| 56 | + |
| 57 | + let basePath = withoutTrailingSlash(origin.pathname); |
| 58 | + if (!basePath.endsWith(AUDIT_ROUTE)) { |
| 59 | + basePath = `${basePath}${AUDIT_ROUTE}`; |
| 60 | + } |
| 61 | + const suffix = routePath.slice(AUDIT_ROUTE.length); |
| 62 | + |
| 63 | + origin.pathname = `${basePath}${suffix}`; |
| 64 | + origin.search = search; |
| 65 | + origin.hash = ""; |
| 66 | + return origin.toString(); |
| 67 | +} |
| 68 | + |
| 69 | +function forwardedHeaders(request, url) { |
| 70 | + const headers = new Headers(request.headers); |
| 71 | + headers.delete("host"); |
| 72 | + headers.delete("content-length"); |
| 73 | + headers.set("X-Forwarded-Host", url.host); |
| 74 | + headers.set("X-Forwarded-Proto", "https"); |
| 75 | + headers.set("X-Codex-Audit-Proxy", "cloudflare-worker"); |
| 76 | + return headers; |
| 77 | +} |
| 78 | + |
| 79 | +async function proxyRequest(request, env) { |
| 80 | + const url = new URL(request.url); |
| 81 | + const originUrl = buildOriginUrl(env.CODEX_AUDIT_ORIGIN_URL, url.pathname, url.search); |
| 82 | + const hasBody = request.method !== "GET" && request.method !== "HEAD"; |
| 83 | + |
| 84 | + return fetch(originUrl, { |
| 85 | + method: request.method, |
| 86 | + headers: forwardedHeaders(request, url), |
| 87 | + body: hasBody ? request.body : undefined, |
| 88 | + redirect: "manual", |
| 89 | + }); |
| 90 | +} |
| 91 | + |
| 92 | +export default { |
| 93 | + async fetch(request, env) { |
| 94 | + const url = new URL(request.url); |
| 95 | + if (url.pathname !== HEALTH_ROUTE && !isAuditPath(url.pathname)) { |
| 96 | + return jsonResponse(404, { status: "error", error: "not found" }); |
| 97 | + } |
| 98 | + if (!methodAllowed(request.method, url.pathname)) { |
| 99 | + return jsonResponse(405, { status: "error", error: "method not allowed" }); |
| 100 | + } |
| 101 | + if (url.pathname === HEALTH_ROUTE) { |
| 102 | + return jsonResponse(200, { status: "ok" }); |
| 103 | + } |
| 104 | + |
| 105 | + try { |
| 106 | + return await proxyRequest(request, env); |
| 107 | + } catch (error) { |
| 108 | + const message = error instanceof Error ? error.message : "origin request failed"; |
| 109 | + if (message.includes("CODEX_AUDIT_ORIGIN_URL") || message.includes("HTTPS")) { |
| 110 | + return jsonResponse(500, { status: "error", error: message }); |
| 111 | + } |
| 112 | + return jsonResponse(502, { status: "error", error: "origin request failed" }); |
| 113 | + } |
| 114 | + }, |
| 115 | +}; |
0 commit comments