snapshot of https://github.com/tldraw/tldraw.git (main, 2026-09-23; blobs > 131072B omitted)

apps/dotcom/tldrawusercontent-worker/.gitignore

@@ -0,0 +1 @@
+tmp-assets

apps/dotcom/tldrawusercontent-worker/package.json

@@ -0,0 +1,28 @@
+{
+	"name": "dotcom-tldrawusercontent",
+	"description": "A Cloudflare Worker to upload and serve user assets from tldrawusercontent.com",
+	"version": "0.0.0",
+	"private": true,
+	"author": {
+		"name": "tldraw GB Ltd.",
+		"email": "hello@tldraw.com"
+	},
+	"main": "src/index.ts",
+	"scripts": {
+		"dev": "yarn run -T tsx ../../../internal/scripts/workers/dev.ts --inspector-port 9450",
+		"test": "yarn run -T vitest --passWithNoTests",
+		"test-ci": "yarn run -T vitest run --passWithNoTests",
+		"test-coverage": "yarn run -T vitest run --coverage --passWithNoTests",
+		"lint": "yarn run -T tsx ../../../internal/scripts/lint.ts"
+	},
+	"dependencies": {
+		"@tldraw/worker-shared": "workspace:*",
+		"itty-router": "^5.0.18"
+	},
+	"devDependencies": {
+		"@cloudflare/workers-types": "^4.20260302.0",
+		"@types/ws": "^8.18.1",
+		"lazyrepo": "0.0.0-alpha.27",
+		"wrangler": "^4.75.0"
+	}
+}

apps/dotcom/tldrawusercontent-worker/src/types.ts

@@ -0,0 +1,22 @@
+import { R2Bucket, WorkerVersionMetadata } from '@cloudflare/workers-types'
+
+interface SyncWorkerRpc {
+	validateUpload(
+		fileId: string,
+		authorizationHeader: string | null
+	): Promise<{ ok: true; userId: string | null } | { ok: false; error: string }>
+	confirmUpload(objectName: string, fileId: string, userId: string | null): Promise<void>
+}
+
+export interface Environment {
+	// bindings
+	UPLOADS: R2Bucket
+	CF_VERSION_METADATA: WorkerVersionMetadata
+	SYNC_WORKER: SyncWorkerRpc
+
+	// environment variables
+	SENTRY_DSN: string | undefined
+	TLDRAW_ENV: string | undefined
+	IS_LOCAL: string | undefined
+	WORKER_NAME: string | undefined
+}

apps/dotcom/tldrawusercontent-worker/src/worker.ts

@@ -0,0 +1,94 @@
+/// <reference no-default-lib="true"/>
+/// <reference types="@cloudflare/workers-types" />
+
+import {
+	blockUnknownOrigins,
+	createRouter,
+	handleApiRequest,
+	handleUserAssetGet,
+	handleUserAssetUpload,
+	isAllowedOrigin,
+	notFound,
+	retry,
+	TRANSIENT_RETRY_OPTIONS,
+} from '@tldraw/worker-shared'
+import { WorkerEntrypoint } from 'cloudflare:workers'
+import { cors } from 'itty-router'
+import { Environment } from './types'
+
+const { preflight, corsify } = cors({ origin: isAllowedOrigin })
+
+export default class Worker extends WorkerEntrypoint<Environment> {
+	readonly router = createRouter<Environment>()
+		.all('*', preflight)
+		.all('*', blockUnknownOrigins)
+		.get('/:objectName', async (request) => {
+			const objectName = request.params.objectName
+			return handleUserAssetGet({
+				request,
+				bucket: this.env.UPLOADS,
+				objectName,
+				context: this.ctx,
+			})
+		})
+		// Upload flow for app file assets:
+		// 1. validateUpload — "file" = tldraw document record in postgres (not the asset blob).
+		//    Checks the user has write access (owner, shared-edit link, or group member); a missing or
+		//    deleted document is a 403 too, so callers cannot probe for ids.
+		// 2. R2 upload — writes the asset blob to the R2 bucket.
+		// 3. confirmUpload — queues a message to asynchronously insert an `asset` row
+		//    linking the uploaded blob to the document.
+		.post('/:objectName', async (request) => {
+			const objectName = request.params.objectName
+			const fileId = new URL(request.url).searchParams.get('fileId')
+
+			// For app file uploads, validate auth + file access before writing to R2.
+			let userId: string | null = null
+			if (fileId) {
+				const authHeader = request.headers.get('Authorization')
+				const validation = await retry(
+					() => this.env.SYNC_WORKER.validateUpload(fileId, authHeader),
+					TRANSIENT_RETRY_OPTIONS
+				)
+				if (!validation.ok) {
+					return Response.json({ error: validation.error }, { status: 403 })
+				}
+				userId = validation.userId
+			}
+
+			const res = await handleUserAssetUpload({
+				headers: request.headers,
+				body: request.body,
+				bucket: this.env.UPLOADS,
+				objectName,
+			})
+
+			// Queue the DB association after successful upload.
+			// Wrapped in try/catch so a transient sync-worker failure doesn't
+			// turn a successful R2 upload into a 500. maybeAssociateFileAssets
+			// will pick up the association later if this fails.
+			if (res.status === 200 && fileId) {
+				try {
+					await retry(
+						() => this.env.SYNC_WORKER.confirmUpload(objectName, fileId, userId),
+						TRANSIENT_RETRY_OPTIONS
+					)
+				} catch (e) {
+					console.error('Failed to queue asset association', e)
+				}
+			}
+
+			return res
+		})
+		.all('*', notFound)
+
+	override async fetch(request: Request) {
+		return handleApiRequest({
+			router: this.router,
+			request,
+			env: this.env,
+			ctx: this.ctx,
+			after: corsify,
+		})
+	}
+}

apps/dotcom/tldrawusercontent-worker/tsconfig.json

@@ -0,0 +1,7 @@
+{
+	"extends": "../../../internal/config/tsconfig.base.json",
+	"include": ["src"],
+	"exclude": ["node_modules", "dist", ".tsbuild*"],
+	"compilerOptions": { "noEmit": true, "emitDeclarationOnly": false },
+	"references": [{ "path": "../../../packages/worker-shared" }]
+}

apps/dotcom/tldrawusercontent-worker/wrangler.toml

@@ -0,0 +1,88 @@
+main = "src/worker.ts"
+compatibility_date = "2024-06-20"
+
+[dev]
+port = 8789
+
+[[analytics_engine_datasets]]
+binding = "MEASURE"
+
+#################### Environment names ####################
+# dev should never actually get deployed anywhere
+[env.dev]
+name = 'tldrawusercontent-dev'
+services = [{ binding = "SYNC_WORKER", service = "dev-tldraw-multiplayer" }]
+
+# we don't have a hard-coded name for preview. we instead have to generate it at build time and append it to this file.
+
+[env.staging]
+name = "staging-tldrawusercontent"
+services = [{ binding = "SYNC_WORKER", service = "main-tldraw-multiplayer" }]
+
+# production gets the proper name
+[env.production]
+name = "tldrawusercontent"
+services = [{ binding = "SYNC_WORKER", service = "tldraw-multiplayer" }]
+
+#################### Assets R2 bucket ####################
+# in dev, we write to the preview bucket and need a `preview_bucket_name`
+[[env.dev.r2_buckets]]
+binding = 'UPLOADS'
+bucket_name = 'uploads-preview'
+preview_bucket_name = 'uploads-preview'
+
+# in preview and staging we write to the preview bucket
+[[env.preview.r2_buckets]]
+binding = 'UPLOADS'
+bucket_name = 'uploads-preview'
+
+[[env.staging.r2_buckets]]
+binding = 'UPLOADS'
+bucket_name = 'uploads-preview'
+
+# in production, we write to the main bucket
+[[env.production.r2_buckets]]
+binding = "UPLOADS"
+bucket_name = "uploads"
+
+#################### Analytics engine ####################
+# analytics engine has the same configuration in all environments:
+[[env.dev.analytics_engine_datasets]]
+binding = "MEASURE"
+
+[[env.preview.analytics_engine_datasets]]
+binding = "MEASURE"
+
+[[env.staging.analytics_engine_datasets]]
+binding = "MEASURE"
+
+[[env.production.analytics_engine_datasets]]
+binding = "MEASURE"
+
+#################### Routes ####################
+# in production, we use a custom domain. others get a default *.tldraw.workers.dev domain
+[[env.production.routes]]
+pattern = 'tldrawusercontent.com'
+custom_domain = true
+zone_name = 'tldrawusercontent.com'
+
+[[env.staging.routes]]
+pattern = 'staging.tldrawusercontent.com'
+custom_domain = true
+zone_name = 'tldrawusercontent.com'
+
+#################### Version metadata ####################
+[version_metadata]
+binding = "CF_VERSION_METADATA"
+
+[env.dev.version_metadata]
+binding = "CF_VERSION_METADATA"
+
+[env.preview.version_metadata]
+binding = "CF_VERSION_METADATA"
+
+[env.staging.version_metadata]
+binding = "CF_VERSION_METADATA"
+
+[env.production.version_metadata]
+binding = "CF_VERSION_METADATA"