Skip to content

Commit f5c64dc

Browse files
developStormdevelopStorm
committed
feat: rebuild Tail.WTF on a single Cloudflare Worker
Architecture: one Worker serves the SvelteKit static site via Workers Assets and /api/* via Hono, in a pnpm workspace deployed by Workers Builds. Types come from wrangler types; unit tests run in the Workers runtime (vitest + @cloudflare/vitest-pool-workers) and Playwright drives wrangler dev with no mocked responses. Sanitization reports an honest per-link method (rule / expanded / canonical / verified / none): short links are dereferenced with a GET fallback; per-site allowlist rules are fetched from the Rules repo's assembled release at build time; opt-in verification compares page identity metadata across candidates, calibrates against a control page before trusting any verdict, binary-searches the minimal required param set, and retries blind cases against browser-rendered pages. Failures are remembered per path so target sites are not re-probed. Public API: GET/POST /api/sanitize (deep, format=text) shared by the web UI, shortcuts, and clipboard tools; GET /api/verify streams every probe and the verdict over SSE; Telegram (inline, /sanitize, webhook secret) and Matrix adapters reuse the same pipeline. Abuse and privacy: outbound operations are budgeted per actor with a service-wide fuse and per-colo limiter; actors are keyed hashes over a rotating window with IPv6 bucketed by /64, and the hash key rotates on every deploy; nothing logs raw identifiers or URLs and observability stays off. The site ships a header-enforced hashed CSP, robots.txt, and security.txt.
1 parent f8e16d2 commit f5c64dc

84 files changed

Lines changed: 9262 additions & 8165 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
test:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v4
16+
17+
- uses: pnpm/action-setup@v4
18+
19+
- uses: actions/setup-node@v4
20+
with:
21+
node-version: 24
22+
cache: pnpm
23+
24+
- run: pnpm install --frozen-lockfile
25+
26+
- name: Typecheck
27+
run: pnpm run check
28+
29+
- name: Unit tests
30+
run: pnpm test
31+
32+
- name: Lint frontend
33+
run: pnpm --dir frontend run lint
34+
35+
- name: Build
36+
run: pnpm run build
37+
38+
- name: Install Playwright browsers
39+
run: pnpm --dir frontend exec playwright install --with-deps chromium
40+
41+
- name: End-to-end tests
42+
run: pnpm run test:e2e

‎.github/workflows/docker-publish.yml‎

Lines changed: 0 additions & 143 deletions
This file was deleted.

‎.github/workflows/verify.yml‎

Lines changed: 0 additions & 53 deletions
This file was deleted.

‎.gitignore‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,19 @@
11
# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
22

33
# dependencies
4-
/node_modules
4+
node_modules/
55
/.pnp
66
.pnp.js
77

88
# testing
99
/coverage
10+
playwright-report/
11+
test-results/
1012

11-
# next.js
13+
# sveltekit
14+
.svelte-kit/
1215
/.next/
13-
/.swc/
14-
/out/
16+
out/
1517

1618
# production
1719
/build
@@ -35,3 +37,10 @@ yarn-error.log*
3537

3638
# typescript
3739
*.tsbuildinfo
40+
41+
# generated
42+
api/src/rules.generated.json
43+
api/worker-configuration.d.ts
44+
45+
# wrangler dev cache
46+
.wrangler/

‎.prettierignore‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,4 @@
1-
/.next/
1+
/.svelte-kit/
2+
/build/
3+
/out/
4+
/node_modules/

‎Dockerfile‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

0 commit comments

Comments
 (0)