mirror of https://github.com/djdevin/recflare.git synced 2026-10-25 23:18:51 -07:00

Files

T

Crasho 26270e9c25 [studio] beta studio (#114 )

* rrs stuff

* studio service yay

* rrs whitelist

* moree studiooooooo fellowwww

* rec room studio room loading yay

* fixes yay

* fix 2 because idk  yayuh

* Update cdn.app.ts

* ccontent length fix?

* Preserve content-length and upgrade metadata

Return a real zero-filled byte array for CDN HEAD responses so the runtime preserves Content-Length while still sending no payload. In notify, re-create the Request with its original headers, set OWNER_HEADER from the validated token, and forward that Request to hub.fetch to avoid losing WebSocket upgrade metadata (which could trigger 500s in Durable Objects). These changes ensure the editor's size checks and WebSocket upgrades remain reliable.

* fix x524234

* shirt thing?

* [auth] remove grant table as we already have audit_log for now

* rename table to generic device_grant

* cleanup/lint

---------

Co-authored-by: Devin Zuczek <devin.zuczek@gmail.com>

2026-10-05 14:39:22 -04:00

migrations

[api] add image moderation and v6 endpoint

2026-10-03 13:34:07 -04:00

scripts

[api] quest asset split on unity target (#108 )

2026-09-20 23:40:08 -04:00

src

[studio] beta studio (#114 )

2026-10-05 14:39:22 -04:00

static

[econ] fix missing hairs and other items

2026-09-30 12:09:42 -04:00

env.d.ts

[econ] fighting inflation

2026-09-28 00:03:50 -04:00

package.json

[api] audit fixes: account tests, dependencies and security hardening (#54 )

2026-09-08 23:47:58 -04:00

README.md

[api] fix(security): bound API-owned uploads (#56 )

2026-09-09 17:24:02 -04:00

tsconfig.json

almost into a room

2026-06-09 00:49:11 -04:00

vitest.config.ts

[api] add non-working v3/votekick

2026-09-02 14:54:14 -04:00

worker-configuration.d.ts

updating types

2026-06-30 23:57:29 -04:00

wrangler.jsonc

[all] turn off worker logs for $

2026-09-22 09:41:20 -04:00

README.md

api

Game API Worker served on the api subdomain. A Hono app serving the game's API surface. Database-backed queries and on-disk JSON files are stubbed for now — no real bindings yet.

Behavior

Auth-gated routes validate the Bearer JWT issued by the auth worker (same dev secret, see src/jwt.ts) and 401 when it's missing/invalid.
API-owned uploads enforce RECFLARE_MAX_API_UPLOAD_BYTES per file (64 MiB by default) before copying a parsed file into an ArrayBuffer or writing it to R2.
Static data is served verbatim:
- src/default-avatar-items.ts → GET /api/avatar/v4/items
- src/default-settings.ts → GET /api/settings/v2
DB-backed reads return empty collections / not-found.
File-backed reads return empty placeholders, each marked TODO: hydrate in src/api.app.ts (Workers have no filesystem — these will move to a binding or inline JSON later).

TODO before production

Wire a DB binding (D1/DO) for rooms, avatars, settings, gifts, balances, etc.
Hydrate the TODO: hydrate endpoints with real config/JSON.
Move the JWT secret to a shared secret binding (shared with auth).
Persist uploads from POST /api/images/v4/uploadsaved (e.g. R2).