motorsignal
/
MotorSignal-App
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

hardening: expose verified telemetry download metadata headers

This commit is contained in:
bponders12-cell 2026-09-01 21:20:26 -04:00
parent 267afb46a4
commit b0e53591b5
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cloudflare/motorsignal-r2-worker/src/index.ts
View File

@ -2,7 +2,7 @@ import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';
/**
* MotorSignal — Cloudflare R2 Worker Gateway
* Secure authorization gateway for MotorSignal telemetry bundles on Cloudflare R2.
* Secure authorization gateway for MotorSignal telemetry bundle storage.
* Firebase ID tokens are cryptographically verified before any R2 access.
*/
@ -21,6 +21,7 @@ const CORS_HEADERS = {
'Access-Control-Allow-Origin': '*',
'Access-Control-Allow-Methods': 'GET, POST, PUT, OPTIONS',
'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Remote-Ride-Id, X-Bundle-Sha256, X-App-Version',
'Access-Control-Expose-Headers': 'ETag, Content-Disposition, X-MotorSignal-Ride-Id, X-MotorSignal-Sha256',
};
const FIREBASE_JWKS = new URL('https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com');
@ -126,6 +127,7 @@ async function verifyFirebaseToken(token: string, expectedProjectId: string): Pr
interface OwnedRide { objectKey?: string; }
type RideAuthorizationResult = OwnedRide | 'unauthorized' | 'not-found' | 'invalid';
/** Reads the authenticated user's ride document through Firestore REST. */
async function fetchOwnedRide(projectId: string, uid: string, remoteRideId: string, idToken: string): Promise<RideAuthorizationResult> {
const documentPath = encodeFirestorePath(`users/${uid}/rides/${remoteRideId}`);
const endpoint = `https://firestore.googleapis.com/v1/projects/${encodeURIComponent(projectId)}/databases/(default)/documents/${documentPath}`;