Repository navigation
fix(web): remove the unauthenticated provider proxy routes - #229
Merged
Merged
Conversation
🚀 Deploying Preview to Cloudflare 🚀Preview Deployments by commit
|
|
React Doctor found 1 new issue in 1 file · 1 warning · score 89 / 100 (Great) · 1 fixed · vs 1 warning
Reviewed by React Doctor for commit |
a2751012962
force-pushed
the
chore/remove-provider-proxies
branch
from
October 2, 2026 05:54
e574606 to
8859646
Compare
Arcadi4
force-pushed
the
feat/auth
branch
2 times, most recently
from
October 2, 2026 07:04
18c0b76 to
7654d56
Compare
a2751012962
force-pushed
the
chore/remove-provider-proxies
branch
from
October 2, 2026 07:30
8859646 to
b54ea2f
Compare
It was the only caller of the public /api/deepseek proxy, and the feature is no longer wanted.
The provider switch is fixed to DeepSeek, so this was dead code and the only caller of the public /api/gemini proxy.
/api/deepseek, /api/tavily and /api/gemini relayed any caller's request with the Worker's own keys and no auth, and the last two allowed any origin. Nothing in the app calls them any more, since the chat agent calls DeepSeek and Tavily directly, so the routes go along with GOOGLE_API_KEY and the VITE_DEEPSEEK_API_KEY alias that only they read.
The web guide still said the Cloudflare plugin only runs for builds and that `vp dev` proxies `/api/*`, but 507b491 registered it for `serve` too, so dev boots the real Worker with `.dev.vars`. It also described a `vp build` SPA in `dist/` for a CI bundle scan; the scan went with ab9cc30 and both `vp build` and `cf build` now write only `.cloudflare/output/`. `worker/lib/` no longer exists, and nothing reads `LLM_REQUEST_DUMP` since the dev gateways were removed in f466972.
Removing the provider proxy modules left the Worker's URL table importing them and left the entry point no longer building the HTTP app, so every request failed before reaching a handler even though the bundle still built. The entry point builds the app again and the table no longer registers the deleted proxies, which is what the endpoint list now advertises for unknown API paths.
Arcadi4
force-pushed
the
chore/remove-provider-proxies
branch
from
October 3, 2026 07:08
b54ea2f to
5c824db
Compare
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| const isChinese = (text: string) => /[\u4e00-\u9fff]/.test(text) | ||
| const detectLang = (text: string): "zh" | "en" => (isChinese(text) ? "zh" : "en") | ||
|
|
||
| export const DormDetailReviews: React.FC<DormDetailReviewsProps> = ({ |
There was a problem hiding this comment.
React Doctor · react-doctor/no-high-complexity-react-function (warning)
DormDetailReviews has cyclomatic complexity 17, cognitive complexity 23, and maximum nesting depth 4, so its React logic is hard to understand and change. Extract independent branches into components or hooks.
Fix → Extract independent render branches and state logic into focused components or hooks until the control flow is easy to follow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #217.
Why
/api/deepseek,/api/tavilyand/api/geminiwere public relays: each took the caller's request body, attached the Worker's own provider key, and forwarded it. There was no auth and no rate limit./api/tavilyand/api/geminialso answered preflights withAccess-Control-Allow-Origin: *, so any website could call them from a visitor's browser. Anyone could spend the DeepSeek, Tavily and Google quotas throughiguide.chat.None of them is needed. Chat never went through them: the
/api/chatagent callsapi.deepseek.com(worker/agent/loop.ts) andapi.tavily.com(worker/tools/web-search.ts) directly from inside the Worker. The only callers were the review translate button, which is no longer wanted, and a Gemini provider that the fixedproviderKey = "deepseek"made unreachable.What changes
/api/deepseek./api/gemini.GOOGLE_API_KEYsecret binding and the legacyVITE_DEEPSEEK_API_KEYalias..dev.vars.examplenow says chat needsDEEPSEEK_API_KEYand web search needsTAVILY_API_KEY.vp devtoo (since 507b491),vp buildwrites only.cloudflare/output/(nodist/, and the CI bundle scan is gone),worker/lib/does not exist, and nothing readsLLM_REQUEST_DUMP.DEEPSEEK_API_KEYandTAVILY_API_KEYstay, since/api/chatneeds both.Verification
vp lint apps/webexits 0 (only the existing test-file warnings).node --test "worker/**/*.test.ts" "src/**/*.test.ts"inapps/web: 152/154 pass. The 2 failures (loop.test.ts,loop.baseline.test.ts) fail the same way on the base, because plain Node can't import the.txtprompts.vp buildandcf buildsucceed. The built Worker bundle only references/api/chat,/api/healthand/api/integrations, and no client asset references the removed paths.After deploy
The removed paths will return the Worker's 404 JSON. The
GOOGLE_API_KEYWorker secret, andVITE_DEEPSEEK_API_KEYif it was ever set, are no longer read and can be deleted from theuiucWorker.Rebased
Rebased onto the force-pushed
feat/auth(7654d56). The checks above were re-run on the new headb54ea2f:vp check --no-fmt0 errors and the same 221 warnings asmain,node --test152/154 with the same 2 known failures.