feat: add cloudflare workers deployment

src/lib/api/__tests__/auth.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "vitest";
+
+import { requireApiAccess } from "../auth";
+
+describe("requireApiAccess", () => {
+  test("allows local test requests when auth is explicitly disabled", () => {
+    const request = new Request("http://localhost/api/jobs");
+
+    const result = requireApiAccess(request, {
+      apiAccessKey: undefined,
+      authDisabled: true,
+    });
+
+    expect(result.ok).toBe(true);
+  });
+
+  test("rejects requests when the configured key is missing", () => {
+    const request = new Request("http://localhost/api/jobs");
+
+    const result = requireApiAccess(request, {
+      apiAccessKey: "secret",
+      authDisabled: false,
+    });
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.response.status).toBe(401);
+    }
+  });
+
+  test("rejects requests with the wrong key", () => {
+    const request = new Request("http://localhost/api/jobs", {
+      headers: { "x-api-key": "wrong" },
+    });
+
+    const result = requireApiAccess(request, {
+      apiAccessKey: "secret",
+      authDisabled: false,
+    });
+
+    expect(result.ok).toBe(false);
+  });
+
+  test("allows requests with the correct key", () => {
+    const request = new Request("http://localhost/api/jobs", {
+      headers: { "x-api-key": "secret" },
+    });
+
+    const result = requireApiAccess(request, {
+      apiAccessKey: "secret",
+      authDisabled: false,
+    });
+
+    expect(result.ok).toBe(true);
+  });
+});

src/lib/api/auth.ts

@@ -0,0 +1,48 @@
+import { NextResponse } from "next/server";
+
+import { getAppCloudflareEnv } from "../runtime/cloudflare";
+
+interface ApiAccessOptions {
+  apiAccessKey?: string;
+  authDisabled?: boolean;
+}
+
+type ApiAccessResult =
+  | { ok: true }
+  | { ok: false; response: NextResponse<{ error: string }> };
+
+export function requireApiAccess(
+  request: Request,
+  options: ApiAccessOptions = {
+    apiAccessKey: getConfiguredApiAccessKey(),
+    authDisabled: process.env.API_AUTH_DISABLED === "true",
+  },
+): ApiAccessResult {
+  if (options.authDisabled) {
+    return { ok: true };
+  }
+
+  if (!options.apiAccessKey) {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        { error: "API access key is not configured" },
+        { status: 401 },
+      ),
+    };
+  }
+
+  const provided = request.headers.get("x-api-key");
+  if (provided !== options.apiAccessKey) {
+    return {
+      ok: false,
+      response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }),
+    };
+  }
+
+  return { ok: true };
+}
+
+function getConfiguredApiAccessKey() {
+  return getAppCloudflareEnv()?.API_ACCESS_KEY ?? process.env.API_ACCESS_KEY;
+}