TheSunIsLeaking/recflare
3
0
Fork 0
mirror of https://github.com/djdevin/recflare.git synced 2026-09-08 14:41:28 -07:00
Code Issues Packages Projects Releases Wiki Activity

[cdn] fix some range issues where delivered images might be corrupt

Browse Source
This commit is contained in:
Devin Zuczek
2026-08-10 13:56:32 -04:00
parent 6c7a634cb6
commit 793b2ad37a
6 changed files with 208 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/cdn/src/cdn.app.ts
+49 -37
View File
@@ -2,7 +2,13 @@ import { Hono } from 'hono'
import { describeRoute, openAPIRouteHandler } from 'hono-openapi'
import { useWorkersLogger } from 'workers-tagged-logger'
import { withCleanSpec, withNotFound, withOnError } from '@repo/hono-helpers'
import {
withCleanSpec,
withDefaultCors,
withNotFound,
withOnError,
writeContentRange,
} from '@repo/hono-helpers'
import loadingScreenTipData from '../static/loading-screen-tip-data.json'
import {
@@ -23,38 +29,41 @@ import type { App, Env } from './context'
* streamed out of the shared `recflare-cdn` R2 bucket, keyed by prefix.
*/
/** Parse a single-range `Range: bytes=start-end` header into an R2 range. */
function parseRange(header: string | undefined): R2Range | undefined {
if (!header) return undefined
const m = /^bytes=(\d*)-(\d*)$/.exec(header.trim())
if (!m) return undefined
const start = m[1]
const end = m[2]
if (start === '' && end !== '') return { suffix: Number(end) } // last N bytes
if (start !== '') {
return end !== ''
? { offset: Number(start), length: Number(end) - Number(start) + 1 }
: { offset: Number(start) }
}
return undefined
}
/**
* Stream a binary asset from the CDN R2 bucket as application/octet-stream,
* honoring Range requests. 404s when the file is missing.
* Supports conditional GET and byte-range requests (206) — large-file
* downloaders fetch in ranges, and a 200 where a 206 is expected corrupts the
* reassembled file (e.g. EAC "Signatures don't match").
*
* This is why `cache.enabled` is false in wrangler.jsonc: Workers Caching strips `Range`
* before the worker is invoked and slices the 206 out of its own cache, which silently
* degrades to a whole-object 200 whenever the response is not cacheable. The range
* answer has to be ours to guarantee.
*/
async function serveAsset(c: Context<App>, key: string) {
if (key.includes('..')) return c.body(null, 400)
const ifNoneMatch = c.req.header('if-none-match')?.replace(/"/g, '')
const range = parseRange(c.req.header('range'))
const object = await (c.env as Env).CDN_ASSETS.get(key, {
...(ifNoneMatch ? { onlyIf: { etagDoesNotMatch: ifNoneMatch } } : {}),
...(range ? { range } : {}),
})
// R2 parses the `Range` header itself when handed the request headers, so there is no
// grammar to reimplement here. It resolves every form (`bytes=a-b`, `bytes=a-`,
// `bytes=-n`) to a concrete offset/length, and anything it cannot parse or satisfy to
// the whole object — see the 206 branch, which is what turns that back into a 200.
// With no `Range` header present this is an ordinary whole-object read.
let object
try {
object = await (c.env as Env).CDN_ASSETS.get(key, {
...(ifNoneMatch ? { onlyIf: { etagDoesNotMatch: ifNoneMatch } } : {}),
range: c.req.raw.headers,
})
} catch (e) {
// Defensive: R2 documents InvalidRange (10039) for a range it can't satisfy, which
// is a 416 rather than the 500 the error handler would otherwise turn it into.
// Locally it never fires — workerd resolves an unsatisfiable range to the whole
// object instead of throwing — so this covers the service behaving as documented.
if (e instanceof Error && e.message.includes('(10039)')) return c.body(null, 416)
throw e
}
if (!object) return c.notFound()
const headers = new Headers()
@@ -67,20 +76,12 @@ async function serveAsset(c: Context<App>, key: string) {
// Precondition matched (If-None-Match) → R2 returns no body.
if (!('body' in object)) return new Response(null, { status: 304, headers })
// Range honored → 206 Partial Content with Content-Range.
if (object.range && c.req.header('range')) {
// R2 hands back the RESOLVED range, and the object it returns carries all three
// keys with the inapplicable ones set to undefined — so `'suffix' in r` is true
// even for an offset/length range and cannot discriminate between the two forms.
// (It read as a suffix range every time, making offset/length NaN and the
// Content-Range header garbage.) Read the values, not the keys. A `bytes=-N`
// request already comes back resolved to a concrete offset/length; the suffix
// fallback below is only there in case that ever stops being true.
const r = object.range as { offset?: number; length?: number; suffix?: number }
const length = r.length ?? r.suffix ?? object.size - (r.offset ?? 0)
const offset = r.offset ?? object.size - length
headers.set('content-length', String(length))
headers.set('content-range', `bytes ${offset}-${offset + length - 1}/${object.size}`)
// A `bytes=` request is ALWAYS answered 206 with a Content-Range naming the bytes
// actually enclosed — never a bare 200 carrying the whole object. That is the one
// answer a chunked downloader cannot survive: it asked for a slice, so it writes
// whatever comes back at that offset, and a whole-object body silently corrupts the
// reassembled file (EAC "Signatures don't match"). See writeContentRange().
if (writeContentRange(headers, c.req.raw.headers, object)) {
return new Response(object.body, { status: 206, headers })
}
@@ -98,6 +99,15 @@ const app = new Hono<App>()
})(c, next)
)
// The website lets a room's owner download their own scene blobs (see the room page
// in `www`), which means a browser reading these bytes from another origin — without
// these headers it can fetch them but not touch the result. `origin: '*'` gives away
// nothing: every route here is already unauthenticated and public to anyone holding
// the key, and nothing on this worker reads a cookie or a token, so there is no
// ambient credential for `*` to expose. The keys are unguessable UUIDs, and that is
// unchanged by who may read a response they already had to name exactly.
.use('*', withDefaultCors())
.onError(withOnError())
.notFound(withNotFound())
@@ -247,7 +257,9 @@ app.get(
'byte ranges (`Range` → 206). The ranges matter: large-file downloaders fetch in',
'chunks, and answering 200 where a 206 is expected corrupts the reassembled file —',
'which surfaces as an anti-cheat “Signatures don’t match” failure, not a download',
'error.',
'error. So a `bytes=` request is never answered with a whole-object 200: the 206',
'always carries a `Content-Range` stating which bytes the body holds, even where',
'that turns out to be all of them.',
].join('\n'),
},
servers: [{ url: 'https://cdn.recflare.net', description: 'Production' }],
apps/cdn/src/openapi.ts
+2 -1
View File
@@ -46,6 +46,7 @@ export function assetResponses(description: string): OpenAPIV3_1.ResponsesObject
304: { description: '`If-None-Match` matched the stored etag (no body)' },
400: { description: 'The key contains `..` (no body)' },
404: { description: 'No such object in the bucket' },
416: { description: 'The `Range` header could not be satisfied (no body)' },
}
}
@@ -56,7 +57,7 @@ export const CONDITIONAL_HEADERS: OpenAPIV3_1.ParameterObject[] = [
in: 'header',
required: false,
description:
'A single byte range (`bytes=start-end`, `bytes=start-`, `bytes=-suffix`). Honoured with a 206; a malformed or multi-range value is ignored and the whole object served.',
'A single byte range (`bytes=start-end`, `bytes=start-`, `bytes=-suffix`), parsed by R2 itself. Any `bytes=` value is answered 206 with a `Content-Range` naming the bytes enclosed — never a bare 200 carrying the whole object, which a chunked downloader would write at the offset it asked for. A multi-range or unsatisfiable value yields the whole object, but says so in the `Content-Range`. A unit other than `bytes` is ignored (200).',
schema: { type: 'string', example: 'bytes=0-1023' },
},
{
apps/cdn/src/test/integration/api.test.ts
+52
View File
@@ -73,6 +73,44 @@ describe('cdn endpoints', () => {
expect(new Uint8Array(await suffix.arrayBuffer())).toEqual(new Uint8Array([14, 15]))
})
// The corrupting answer to a byte-range request is a bare 200 carrying the whole
// object: the downloader asked for a slice, so it writes the body at that offset and
// the reassembled file is wrong (EAC "Signatures don't match"). R2 resolves a value
// it cannot parse or satisfy to the WHOLE object rather than failing, so these are
// exactly the inputs that used to fall through to a 200 — every one of them must
// still come back 206 with a Content-Range stating what the body actually holds.
test('GET /sigs/:sigName never answers a bytes range with a whole-object 200', async () => {
await env.CDN_ASSETS.put('sigs/ranged3', new Uint8Array([10, 11, 12, 13, 14, 15]))
const fetchRange = (range: string) =>
exports.default.fetch(`${ORIGIN}/sigs/ranged3`, { headers: { Range: range } })
for (const range of [
'bytes=100-200', // wholly past the end of a 6-byte object
'bytes=abc', // not the byte-range grammar
'bytes=0-1,3-4', // multi-range, which R2 does not serve
'bytes=0-5', // satisfiable, and covers everything
]) {
const res = await fetchRange(range)
expect(res.status, range).toBe(206)
expect(res.headers.get('content-range'), range).toBe('bytes 0-5/6')
}
// A range that runs off the end but starts inside is a real partial read.
const partial = await fetchRange('bytes=4-99')
expect(partial.status).toBe(206)
expect(partial.headers.get('content-range')).toBe('bytes 4-5/6')
expect(new Uint8Array(await partial.arrayBuffer())).toEqual(new Uint8Array([14, 15]))
// A unit other than bytes must be ignored outright — RFC 9110 — not answered
// with a byte-denominated Content-Range.
const other = await fetchRange('items=0-1')
expect(other.status).toBe(200)
expect(other.headers.get('content-range')).toBeNull()
expect(new Uint8Array(await other.arrayBuffer())).toEqual(
new Uint8Array([10, 11, 12, 13, 14, 15])
)
})
test('GET /room/:dataBlob streams the room blob from R2', async () => {
await env.CDN_ASSETS.put('room/94tp5zjtwz0gppp8xlv1j9l5b.room', new Uint8Array([9, 8, 7]))
const res = await exports.default.fetch(`${ORIGIN}/room/94tp5zjtwz0gppp8xlv1j9l5b.room`)
@@ -86,6 +124,20 @@ describe('cdn endpoints', () => {
expect(res.status).toBe(404)
})
// The website lets a room's owner download their own scene data (the room page in
// `www`), which is a browser reading these bytes from another origin. Without the
// header it can fetch them but not read the result — and the page can't tell that
// apart from the blob being gone.
test('answers CORS so a browser on another origin can read a blob', async () => {
await env.CDN_ASSETS.put('room/2026-08-01/cors-check', new Uint8Array([4, 2]))
const res = await exports.default.fetch(`${ORIGIN}/room/2026-08-01/cors-check`, {
headers: { origin: 'https://www.example.net' },
})
expect(res.status).toBe(200)
expect(res.headers.get('access-control-allow-origin')).toBe('*')
expect(new Uint8Array(await res.arrayBuffer())).toEqual(new Uint8Array([4, 2]))
})
test('GET /invention/:dataBlob streams the invention blob from R2', async () => {
// Date-foldered, `.inv`-suffixed — the name the storage worker generates and the
// api worker hands back as the invention's BlobName.
apps/cdn/wrangler.jsonc
+10 -1
View File
@@ -4,8 +4,17 @@
"main": "src/cdn.app.ts",
"compatibility_date": "2026-06-16",
"compatibility_flags": ["nodejs_compat"],
// Workers Caching is OFF here, and must stay off: it STRIPS the `Range` header before
// invoking the worker, asks for the whole body, and slices the 206 out of its own
// cache. That works only while the response is actually cacheable — on any bypass
// (see the automatic bypass rules) nothing slices, and the client that asked for a
// byte range receives the whole object with a 200. A chunked downloader writes that
// at the offset it asked for and the reassembled file is corrupt (EAC "Signatures
// don't match"). With caching off the `Range` header reaches serveAsset, which
// always answers a `bytes=` request with a 206 and a truthful Content-Range.
// The cost is that every asset read hits R2; correctness on these blobs is worth it.
"cache": {
"enabled": true
"enabled": false
},
// CDN binaries (signature blobs + room build data) are stored as R2 objects
// and streamed back by key. Keys are prefixed `sigs/` and `room/`.