fix(self-host): strip trusted header on public routes, content-type for assets, remove broken batch shim

Author: vekexasia

Caddyfile

@@ -22,19 +22,31 @@
 
   handle /api/* {
     uri strip_prefix /api
-    reverse_proxy backend:8787
+    reverse_proxy backend:8787 {
+      header_up X-Forwarded-Email ""
+      header_up X-Forwarded-Name ""
+    }
   }
 
   handle /chat/* {
     uri strip_prefix /chat
-    reverse_proxy chat:8788
+    reverse_proxy chat:8788 {
+      header_up X-Forwarded-Email ""
+      header_up X-Forwarded-Name ""
+    }
   }
 
   handle /assets/* {
-    reverse_proxy backend:8787
+    reverse_proxy backend:8787 {
+      header_up X-Forwarded-Email ""
+      header_up X-Forwarded-Name ""
+    }
   }
 
   handle {
-    reverse_proxy web:3000
+    reverse_proxy web:3000 {
+      header_up X-Forwarded-Email ""
+      header_up X-Forwarded-Name ""
+    }
   }
 }

backend/src/db/index.ts

@@ -1,22 +1,9 @@
 import { drizzle as drizzleD1 } from 'drizzle-orm/d1';
-import { drizzle as drizzleSqlite } from 'drizzle-orm/better-sqlite3';
 import type { Env } from '../types';
 
 type D1Db = ReturnType<typeof drizzleD1>;
 
-function withBatch(db: object): D1Db {
-  if ('batch' in db) return db as D1Db;
-  return Object.assign(db, {
-    async batch(queries: unknown[]) {
-      const results: unknown[] = [];
-      for (const query of queries) results.push(await (query as { execute: () => Promise<unknown> }).execute());
-      return results;
-    },
-  }) as D1Db;
-}
-
 export function createDb(env: Env): D1Db | null {
-  if (env.SQLITE_DB) return withBatch(drizzleSqlite(env.SQLITE_DB));
   if (env.DB) return drizzleD1(env.DB);
   return null;
 }

backend/src/lib/env.ts

@@ -30,7 +30,7 @@ export function getRuntimeConfig(env: Env): RuntimeConfig {
     serviceName: parsed.SERVICE_NAME,
     commitSha: parsed.COMMIT_SHA,
     orderTimeZone: parsed.ORDER_TIME_ZONE,
-    databaseMode: env.SQLITE_DB ? 'sqlite' : env.DB ? 'd1' : 'unconfigured',
+    databaseMode: env.DB ? 'd1' : 'unconfigured',
     hasPublicMenuBucket: Boolean(env.PUBLIC_MENU_BUCKET),
     auth: {
       issuer: parsed.ACCESS_TEAM_DOMAIN,

backend/src/self-host/fs-bucket.ts

@@ -60,7 +60,9 @@ export function createFsBucket(root: string): R2Bucket {
     async get(key: string) {
       try {
         const data = await readFile(safePath(root, key));
-        return object(root, key, data);
+        const ext = key.slice(key.lastIndexOf('.')).toLowerCase();
+        const contentType = ({ '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.png': 'image/png', '.webp': 'image/webp', '.gif': 'image/gif', '.svg': 'image/svg+xml', '.json': 'application/json', '.pdf': 'application/pdf' } as Record<string, string>)[ext];
+        return object(root, key, data, contentType);
       } catch {
         return null;
       }

backend/src/self-host/server.ts

@@ -22,7 +22,6 @@ const env: Env = {
   COMMIT_SHA: process.env.COMMIT_SHA || 'self-host',
   ORDER_TIME_ZONE: process.env.ORDER_TIME_ZONE || 'UTC',
   SELF_HOST_AUTH_HEADER: process.env.SELF_HOST_AUTH_HEADER || 'x-forwarded-email',
-  SQLITE_DB: sqlite,
   DB: createD1Compat(sqlite),
   PUBLIC_MENU_BUCKET: createFsBucket(bucketDir),
   R2_PUBLIC_URL: process.env.R2_PUBLIC_URL || (process.env.PUBLIC_URL ? `${process.env.PUBLIC_URL.replace(/\/$/, '')}/assets` : ''),

backend/src/types.ts

@@ -1,7 +1,6 @@
 import type { AuthUser } from './middleware/auth';
 import type { StaffSession } from './lib/staff';
 import type { createDb } from './db/index';
-import type { SqliteDatabase } from './self-host/sqlite';
 
 export interface Env {
   APP_ENV?: string;
@@ -11,7 +10,6 @@ export interface Env {
   ALLOWED_ORIGINS?: string;
   ALLOWED_HOST_SUFFIXES?: string;
   DB?: D1Database;
-  SQLITE_DB?: SqliteDatabase;
   PUBLIC_MENU_BUCKET?: R2Bucket;
   R2_PUBLIC_URL?: string;
   ACCESS_TEAM_DOMAIN?: string;