motorsignal
/
MotorSignal-App
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
MotorSignal-App/cloudflare/motorsignal-r2-worker
History
Developer cff4734678 fix(sync): harden R2 cloud confirmation verification, add worker tests, and resolve CI backup gate 
- Enforce positive bundle size, matching SHA-256, user-scoped object keys, and legacyUnverified status for historical bundles in R2UploadService and FirebaseSyncProvider

- Update SyncManager reconciliation to accept legacyUnverified status, mark historical rides as synced without re-upload, and track legacy unverified counts

- Add 18-test vitest suite for Cloudflare Worker /r2/verify endpoint covering CORS, auth, validation, ownership, HEAD/GET, legacy bundles, and errors

- Harden test/disposable_backup_recovery_verification_test.dart with candidate path discovery and CI skip guard
 		2026-10-14 10:34:06 -04:00
..
.wrangler/cache CHECKPOINT: Phase 2 cloud sync production baseline 2026-08-31 02:57:50 -04:00
src fix(sync): harden R2 cloud confirmation verification, add worker tests, and resolve CI backup gate 2026-10-14 10:34:06 -04:00
README.md CHECKPOINT: Phase 2 cloud sync production baseline 2026-08-31 02:57:50 -04:00
package-lock.json fix(sync): harden R2 cloud confirmation verification, add worker tests, and resolve CI backup gate 2026-10-14 10:34:06 -04:00
package.json fix(sync): harden R2 cloud confirmation verification, add worker tests, and resolve CI backup gate 2026-10-14 10:34:06 -04:00
wrangler.toml CHECKPOINT: Phase 2 cloud sync production baseline 2026-08-31 02:57:50 -04:00

README.md

MotorSignal — Cloudflare R2 Worker Gateway

This Cloudflare Worker acts as the secure, authenticated authorization gateway between the MotorSignal mobile application and Cloudflare R2 object storage for large 20Hz forensic telemetry ZIP bundles.

Security Architecture

  1. Zero Client Secrets: The Flutter mobile app contains zero Cloudflare API tokens, R2 access keys, or secrets.
  2. Server-Side Path Derivation: The Worker authenticates the client's Firebase ID token and dynamically derives the object path: 
    users/{authenticatedUid}/rides/{validatedRemoteRideId}/telemetry.zip
    Clients cannot override or spoof target user paths.
  3. Streamed Uploads: The Worker streams binary ZIP payloads directly into R2 using the Cloudflare R2Bucket binding without memory buffering.

Endpoints

1. Direct Binary Upload

  • Method: PUT
  • Path: /r2/upload
  • Headers:
    • Authorization: Bearer <FirebaseIdToken>
    • Content-Type: application/zip
    • X-Remote-Ride-Id: ride_<localRideId>_<timestamp>
    • X-Bundle-Sha256: <sha256-hash>
    • X-App-Version: 1.0.2
  • Body: Raw binary bytes of telemetry.zip.
  • Response: 
    {
  "success": true,
  "objectKey": "users/<uid>/rides/<remoteRideId>/telemetry.zip",
  "size": 348120,
  "etag": "\"8f4b2c1...\"",
  "uploadedAt": "2026-08-31T12:00:00.000Z"
}

2. Upload Request Authorization

  • Method: POST
  • Path: /r2/upload-url
  • Headers:
    • Authorization: Bearer <FirebaseIdToken>
    • Content-Type: application/json
  • Body: 
    {
  "remoteRideId": "ride_14_20260831_080000"
}

3. Telemetry Bundle Download

  • Method: GET
  • Path: /r2/download?rideId=<remoteRideId>
  • Headers:
    • Authorization: Bearer <FirebaseIdToken>
  • Response: Binary stream of telemetry.zip.

Deployment & Setup

1. Prerequisites

Install Wrangler CLI:

npm install -g wrangler
cd cloudflare/motorsignal-r2-worker
npm install

2. Create R2 Bucket

wrangler r2 bucket create motorsignal-telemetry

3. Deploy Worker

wrangler deploy

4. Configure Secrets (if needed)

wrangler secret put FIREBASE_PROJECT_ID