support for 202507 endpoints (#37)

* [auth][api] accept the 20250424.01 client * [2025] unstable * 20250718.0 * correct one this time * stubs * more stubs * more stubs * [lists] add worker * [ai] route stubs * [api] player photo setting * [econ] add roomEconConfig route * [infra] update worker generators * [worker] add cards/moderation/platformnotification workers * [lists] updates to some endpoints * [clubs] stub out announcement endpoint, for now * [econ] stub out season endpoints for now * [chat] apps/chat stub out party endpoint not sure the shape yet * [api] stub out statsig and lockeditems * [doc] new services * [lists] stub the bulk endpoint * [datacollection] add placeholder service until we can kill it * [api] set gifting to lvl5 * update lock * [cdn] enable cache * [match] matchmake v2 * [lists] stub some lists * [ai] stubs * [rooms] new subroom save endpoint * [econ] add bulk purchase endpoint * [discovery] update featured creator to 1 for fun * [api] add photo settings flag * [chat] fixup chat permissions (sorta) * [auth] restrictions endpoint * [rooms] contributed endpoint * [api] fix outfit endpoint * [discovery] attempt to fix store * [chat] privacy endpoints * [api] cheered images * [rooms] add xp endpoint (disbaled) * [rooms] add xp endpoint (disabled) * update images-db for cheers * [rooms] add autocomplete endpoint * [cdn/img] increase cache ttl for statics * [api] bulk route for images * [accounts] add banner image * [api] add misc missing endpoints * [discovery] remove AI tab * [platformnotifications] stub some endpoints * [lists] add some more lists * [rooms] additional endpoints * [chat] stub a few privacy endpoints * [econ] stub some endpoints * misc db fixes * [api] tweak shape for images v6 * [rooms] dont show trending RROs
2026-09-09 15:11:29 -07:00 · 2026-08-18 23:07:24 -04:00
parent 66c09806f9
commit 178d3b5b0e
162 changed files with 114930 additions and 469 deletions
@@ -0,0 +1,37 @@
+import type { Context } from 'hono'
+import type { App } from './context'
+
+/**
+ * The discovery page layouts, one file per page source in `static/`, served through the
+ * ASSETS binding (see wrangler.jsonc). `{type}` IS the filename: it is passed through to
+ * `static/<type>.json` unchanged, so publishing a new page source is dropping in a file —
+ * nothing in this worker enumerates or knows their names.
+ *
+ * Case included: the asset manifest is case-sensitive, so a file must be named exactly as
+ * the client asks for it (`WatchHome.json`, not `watchhome.json`). Nothing here folds the
+ * case, because there is no index to fold it against.
+ */
+
+/**
+ * What may reach the binding as a filename. Deliberately narrow — no dots, no slashes,
+ * nothing that could climb out of `static/` — so a path traversal is a 404 from this
+ * worker rather than a request the asset server has to be trusted to refuse.
+ */
+const SAFE_NAME = /^[A-Za-z0-9_-]+$/
+
+/**
+ * Fetch `static/<type>.json` through the ASSETS binding. `null` when no such file is
+ * published, or when the name isn't one a file could have.
+ *
+ * The asset response is handed back whole rather than parsed and re-serialized: it
+ * already carries the right content type and an etag, so a client that sends
+ * `If-None-Match` gets its 304 for free.
+ */
+export async function fetchPageSource(c: Context<App>, type: string): Promise<Response | null> {
+	if (!SAFE_NAME.test(type)) return null
+
+	// Forwarding the original request keeps its conditional headers, so the binding
+	// answers 304 on a match; only the URL is rewritten to the asset's path.
+	const res = await c.env.ASSETS.fetch(new Request(new URL(`/${type}.json`, c.req.url), c.req.raw))
+	return res.ok || res.status === 304 ? res : null
+}