wip web

apps/www/src/upstream.ts

@@ -0,0 +1,33 @@
+import type { Env } from './context'
+
+/**
+ * The www worker is a backend-for-frontend (BFF): the browser only ever talks to
+ * www, and www forwards to the `auth` and `accounts` workers server-side. That
+ * keeps the JWT off other origins and sidesteps CORS (those workers set no CORS
+ * headers). Hosts are derived from the shared base domain (`auth.<DOMAIN>`,
+ * `accounts.<DOMAIN>`), matching how the workers are deployed.
+ */
+
+export const authBase = (env: Env): string => `https://auth.${env.DOMAIN}`
+export const accountsBase = (env: Env): string => `https://accounts.${env.DOMAIN}`
+
+/**
+ * POST a form-urlencoded body to an upstream worker. The auth/accounts endpoints
+ * read their inputs via Hono's `parseBody()`, so they expect form fields (not
+ * JSON). `bearer`, when given, authenticates the caller.
+ */
+export async function postForm(
+	url: string,
+	fields: Record<string, string>,
+	bearer?: string
+): Promise<Response> {
+	const headers: Record<string, string> = {
+		'content-type': 'application/x-www-form-urlencoded',
+	}
+	if (bearer) headers.authorization = `Bearer ${bearer}`
+	return fetch(url, {
+		method: 'POST',
+		headers,
+		body: new URLSearchParams(fields).toString(),
+	})
+}