gitfor/platform

import { WorkerEntrypoint } from "cloudflare:workers";
import { handleActionsRoutes } from "./http";

const ACTIONS_API_PREFIX = "/api/actions/";

/**
 * The only thing a cloud job's requests to `gitfor.internal` reach. They skip the edge (WAF, edge rate limits,
 * client IP headers), and job code, third-party actions included, can send them, so this exposes nothing but
 * the job API. Every route behind it still authenticates the job token itself.
 */
export class JobApiGateway extends WorkerEntrypoint<Env> {
  override async fetch(request: Request): Promise<Response> {
    const url = new URL(request.url);
    const response = url.pathname.startsWith(ACTIONS_API_PREFIX) ? await handleActionsRoutes(request, url) : null;
    return response ?? Response.json({ error: "not found" }, { status: 404 });
  }
}