Skip to content

Harden proxy CORS/error handling and upstream timeouts - #3

Open
patakijv wants to merge 15 commits into
rmsalter:mainfrom
logicallabs:main
Open

Harden proxy CORS/error handling and upstream timeouts#3
patakijv wants to merge 15 commits into
rmsalter:mainfrom
logicallabs:main

Conversation

@patakijv

@patakijv patakijv commented Jun 7, 2026

Copy link
Copy Markdown
Contributor

This PR carries the proxy hardening needed for the WebKit app deployment.

Changes:

  • Add shared CORS headers to all proxy responses, including error paths.
  • Return JSON 502/504 for upstream failures and timeouts instead of allowing browser-masked fetch errors.
  • Add upstream request timeouts for Gemini and OpenAI-compatible routes.

Validation:

  • npm test passes in the aiproxy repo.
  • Direct curl checks from both webapps.numerus.app and webkit.numerus.app return 200 with CORS headers for ghprompt and gemprompt.
  • Error-path probes now return 404/405 with CORS headers.

This should prevent cross-origin failures from surfacing as opaque Failed to fetch errors in the WebKit UI.

patakijv added 15 commits June 6, 2026 21:41
…dapter

- Phase plan doc: DUAL_RUNTIME_PORT_PLAN.md
- src/core/: runtime-agnostic config, http helpers, proxy logic, routes
- src/node/server.js: Node adapter (local + DO App path)
- src/worker/worker.js: Cloudflare Worker adapter
- wrangler.toml: aiproxy-dev config with numerus.app route
- server.cjs: shim delegating to Node adapter
- package.json: worker:dev and worker:deploy scripts
- README: dual-runtime status, Worker setup, test matrix

All tests passing:
  - unit: 11/11
  - live Node local: 4/4
  - live CF workers.dev: 4/4
  - live CF aiproxy-dev.numerus.app: 4/4
…matrix

Phase 3 - wrangler.toml:
- Add [env.production] block: worker name 'aiproxy', route aiproxy-worker.numerus.app
  (aiproxy.numerus.app reserved for DO App; swap route when cutting over to Worker)
- workers_dev=false for production
- Explicit --env flags on all deploy scripts to suppress multi-env ambiguity warning

Phase 4 - README:
- Rewrite Testing section with full matrix table (unit, Node local, Worker local,
  CF dev, CF prod, DO App) all using TEST_BASE_URL override
- Rewrite Cloudflare Worker section: env table, per-env secret setup commands,
  DNS CNAME requirement and cutover note
- Update dual-runtime status block: phases 1-4 complete
- Replace public Worker config with generic placeholders
- Add untracked local config example for account/zone/route details
- Add scripts/worker.sh to restore or deploy dev/prod Workers after wrangler login
- Document local prerequisites and cutover workflow in README
- Keep repository free of Numerus-specific values in committed config
…etup

- Add optional .node.local.env local-only config example
- Add scripts/node.sh with check/start/dev modes for Node startup
- Wire npm run node:check, node:dev, node:start aliases
- Update start.sh to source optional .node.local.env overrides
- Document Node helper prerequisites in README
- Preserve start.sh as the primary path; helper adds prerequisite validation
- Use 'node' from PATH instead of absolute /usr/local/bin/node for portability
- Explain Node.js vs Cloudflare Workers runtime differences
- Detailed comparison table covering all key aspects
- How the codebase achieves dual deployment via shared core + adapters
- Configuration management and secrets best practices
- Deployment procedures for both platforms
- Testing matrix covering all environments
- Decision criteria for choosing each platform
- Operational checklists for setup and deployment
- Deployed aiproxy-staging worker to Cloudflare (live at aiproxy-staging.numerus.workers.dev)
- Deployed aiproxy (production) worker to Cloudflare (live at aiproxy-worker.numerus.workers.dev)
- Uploaded all 4 secrets (GEMINI_API_KEY, GITHUB_TOKEN, OPENROUTER_API_KEY, DEEPSEEK_API_KEY) to both workers
- Fixed scripts/worker.sh mktemp pattern for better collision avoidance
- Fixed trap statement to handle variable scope properly with set +u/set -u
- Both staging and production environments now fully operational
- Branch: feat/dual-runtime-do-worker
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant