chore: heygermany customer project

packages/functions/src/middleware.ts

@@ -0,0 +1,45 @@
+import { addHTTPMiddleware } from "#pikku/pikku-types.gen.js"
+import { authBearer, cors } from '@pikku/core/middleware'
+import { betterAuthStatelessSession } from '@pikku/better-auth'
+
+addHTTPMiddleware('*', [
+  // Stateless: reads the signed session cookie cache (needs session.cookieCache
+  // in auth.wiring) instead of services.auth(), which is tree-shaken off the RPC
+  // bundle on the deployed CF Worker (betterAuthSession 500s there with
+  // "services.auth is not a function").
+  betterAuthStatelessSession({
+    mapSession: ({ user }) => ({
+      userId: user.id,
+      name: user.name,
+      role: user.role,
+      type: user.type,
+    }),
+  }),
+  // External consoles (sandbox/woven-build view) can't carry the session cookie,
+  // so they authenticate with `Authorization: Bearer <PIKKU_CONSOLE_TOKEN>`. The
+  // CLI normally emits this alongside its session middleware, but our own global
+  // session middleware makes it step aside (pikku#754) — so add the console-token
+  // bridge here or console:* RPCs 403 in the sandbox.
+  authBearer({
+    token: {
+      secretId: 'PIKKU_CONSOLE_TOKEN',
+      userSession: { userId: 'pikku-console-token' },
+    },
+  }),
+])
+
+const frontendOrigins = [
+  'http://localhost:3001',
+  'http://127.0.0.1:3001',
+]
+
+if (process.env.DOMAIN) {
+  frontendOrigins.push(`https://${process.env.DOMAIN}`)
+}
+
+addHTTPMiddleware('*', [
+  cors({
+    origin: frontendOrigins,
+    credentials: true,
+  }),
+])