import { WorkerEntrypoint } from "cloudflare:workers";
import { handleActionsRoutes } from "./http";
/** The job endpoints a cloud job calls through `gitfor.internal`: the Actions cache, action archives and images. */
const JOB_PATHS = new Set(["/api/actions/cache", "/api/actions/archive", "/api/actions/image"]);
/**
* The only thing a cloud job's requests to `gitfor.internal` reach. They skip the edge (WAF, edge rate limits,
* client IP headers), and job code, third-party actions included, can send them, so this exposes nothing but
* the job API. Every route behind it still authenticates the job token itself.
*/
export class JobApiGateway extends WorkerEntrypoint<Env> {
override async fetch(request: Request): Promise<Response> {
const url = new URL(request.url);
const response = JOB_PATHS.has(url.pathname) ? await handleActionsRoutes(request, url) : null;
return response ?? Response.json({ error: "not found" }, { status: 404 });
}
}