snapshot of https://github.com/tldraw/tldraw.git (main, 2026-09-23; blobs > 131072B omitted)

apps/dotcom/tldrawusercontent-worker/src/types.ts

@@ -0,0 +1,22 @@
+import { R2Bucket, WorkerVersionMetadata } from '@cloudflare/workers-types'
+
+interface SyncWorkerRpc {
+	validateUpload(
+		fileId: string,
+		authorizationHeader: string | null
+	): Promise<{ ok: true; userId: string | null } | { ok: false; error: string }>
+	confirmUpload(objectName: string, fileId: string, userId: string | null): Promise<void>
+}
+
+export interface Environment {
+	// bindings
+	UPLOADS: R2Bucket
+	CF_VERSION_METADATA: WorkerVersionMetadata
+	SYNC_WORKER: SyncWorkerRpc
+
+	// environment variables
+	SENTRY_DSN: string | undefined
+	TLDRAW_ENV: string | undefined
+	IS_LOCAL: string | undefined
+	WORKER_NAME: string | undefined
+}

apps/dotcom/tldrawusercontent-worker/src/worker.ts

@@ -0,0 +1,94 @@
+/// <reference no-default-lib="true"/>
+/// <reference types="@cloudflare/workers-types" />
+
+import {
+	blockUnknownOrigins,
+	createRouter,
+	handleApiRequest,
+	handleUserAssetGet,
+	handleUserAssetUpload,
+	isAllowedOrigin,
+	notFound,
+	retry,
+	TRANSIENT_RETRY_OPTIONS,
+} from '@tldraw/worker-shared'
+import { WorkerEntrypoint } from 'cloudflare:workers'
+import { cors } from 'itty-router'
+import { Environment } from './types'
+
+const { preflight, corsify } = cors({ origin: isAllowedOrigin })
+
+export default class Worker extends WorkerEntrypoint<Environment> {
+	readonly router = createRouter<Environment>()
+		.all('*', preflight)
+		.all('*', blockUnknownOrigins)
+		.get('/:objectName', async (request) => {
+			const objectName = request.params.objectName
+			return handleUserAssetGet({
+				request,
+				bucket: this.env.UPLOADS,
+				objectName,
+				context: this.ctx,
+			})
+		})
+		// Upload flow for app file assets:
+		// 1. validateUpload — "file" = tldraw document record in postgres (not the asset blob).
+		//    Checks the user has write access (owner, shared-edit link, or group member); a missing or
+		//    deleted document is a 403 too, so callers cannot probe for ids.
+		// 2. R2 upload — writes the asset blob to the R2 bucket.
+		// 3. confirmUpload — queues a message to asynchronously insert an `asset` row
+		//    linking the uploaded blob to the document.
+		.post('/:objectName', async (request) => {
+			const objectName = request.params.objectName
+			const fileId = new URL(request.url).searchParams.get('fileId')
+
+			// For app file uploads, validate auth + file access before writing to R2.
+			let userId: string | null = null
+			if (fileId) {
+				const authHeader = request.headers.get('Authorization')
+				const validation = await retry(
+					() => this.env.SYNC_WORKER.validateUpload(fileId, authHeader),
+					TRANSIENT_RETRY_OPTIONS
+				)
+				if (!validation.ok) {
+					return Response.json({ error: validation.error }, { status: 403 })
+				}
+				userId = validation.userId
+			}
+
+			const res = await handleUserAssetUpload({
+				headers: request.headers,
+				body: request.body,
+				bucket: this.env.UPLOADS,
+				objectName,
+			})
+
+			// Queue the DB association after successful upload.
+			// Wrapped in try/catch so a transient sync-worker failure doesn't
+			// turn a successful R2 upload into a 500. maybeAssociateFileAssets
+			// will pick up the association later if this fails.
+			if (res.status === 200 && fileId) {
+				try {
+					await retry(
+						() => this.env.SYNC_WORKER.confirmUpload(objectName, fileId, userId),
+						TRANSIENT_RETRY_OPTIONS
+					)
+				} catch (e) {
+					console.error('Failed to queue asset association', e)
+				}
+			}
+
+			return res
+		})
+		.all('*', notFound)
+
+	override async fetch(request: Request) {
+		return handleApiRequest({
+			router: this.router,
+			request,
+			env: this.env,
+			ctx: this.ctx,
+			after: corsify,
+		})
+	}
+}