51 lines
2.0 KiB
TypeScript
51 lines
2.0 KiB
TypeScript
import { createCsrfMiddleware, createMiddleware, createStart } from "@tanstack/react-start";
|
|
|
|
const health = createMiddleware().server(({ request, next }) => {
|
|
if (request.method === "GET" && new URL(request.url).pathname === "/health") {
|
|
return Response.json({ status: "ok" }, { headers: { "Cache-Control": "no-store" } });
|
|
}
|
|
return next();
|
|
});
|
|
|
|
// Private MCP clients do not carry a browser session or Tailscale identity.
|
|
// Keep this exact endpoint ahead of browser-only access checks.
|
|
const mcp = createMiddleware().server(async ({ request, next }) => {
|
|
const path = new URL(request.url).pathname;
|
|
// Explicitly report that this private endpoint does not advertise OAuth.
|
|
if (
|
|
["/.well-known/oauth-protected-resource", "/.well-known/oauth-protected-resource/mcp"].includes(
|
|
path,
|
|
)
|
|
)
|
|
return new Response(null, { status: 404 });
|
|
if (path !== "/mcp") return next();
|
|
const { handleMcpRequest } = await import("./features/mcp/http.server");
|
|
return handleMcpRequest(request);
|
|
});
|
|
|
|
const ownerAccess = createMiddleware().server(async ({ request, next }) => {
|
|
const { checkAccess, readAccessConfig } = await import("./features/access/policy.server");
|
|
return checkAccess(request, readAccessConfig()) ?? next();
|
|
});
|
|
|
|
const csrf = createCsrfMiddleware({
|
|
filter: (context) => context.handlerType === "serverFn",
|
|
});
|
|
|
|
const appSession = createMiddleware().server(async ({ request, next }) => {
|
|
const { checkSessionAccess } = await import("./features/auth/gate.server");
|
|
const { setResponseHeader } = await import("@tanstack/react-start/server");
|
|
setResponseHeader("Cache-Control", "no-store");
|
|
return checkSessionAccess(request) ?? next();
|
|
});
|
|
|
|
const storage = createMiddleware().server(async ({ next }) => {
|
|
const { getDatabase } = await import("./features/storage/database.server");
|
|
getDatabase();
|
|
return next();
|
|
});
|
|
|
|
export const startInstance = createStart(() => ({
|
|
requestMiddleware: [health, mcp, ownerAccess, csrf, storage, appSession],
|
|
}));
|