Files

T

LuluandCursor 9a76eaec32 fix(server): trust moeru-ai Cloudflare Workers preview origins (#2513 )

## Summary

- Auth and API origin policy now trusts `*.moeru-ai.workers.dev`.
- The retired `*.kwaa.workers.dev` suffix is removed. Server-dev
stage-web previews on the moeru-ai Cloudflare account can complete OIDC
login.

## Test plan

- [x] `pnpm exec vitest run server/apps/auth/src/tests/auth.test.ts
server/apps/auth/src/tests/origin.test.ts
server/apps/api/src/utils/tests/origin.test.ts`
- [ ] After deploy, sign in from
https://server-dev-moeru-ai-airi.moeru-ai.workers.dev and confirm
`/auth/callback` is accepted.

## Visual changes

No user-visible changes.


Made with [Cursor](https://cursor.com)

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-09-10 20:28:17 +08:00

docs

chore: move the server to an independent folder

2026-08-02 18:43:57 +08:00

drizzle

fix(analytics): remove TS product events table (#2306 )

2026-08-17 10:16:44 +00:00

production/railway

feat(chat-ws): add versioned Eventa protocols (#2308 )

2026-08-20 12:24:47 +08:00

sql

chore: move the server to an independent folder

2026-08-02 18:43:57 +08:00

src

fix(server): trust moeru-ai Cloudflare Workers preview origins (#2513 )

2026-09-10 20:28:17 +08:00

.gitignore

chore: move the server to an independent folder

2026-08-02 18:43:57 +08:00

CLAUDE.md

fix(api): load Drizzle migrations at runtime (#2307 )

2026-08-17 11:19:53 +00:00

Dockerfile

feat(chat-ws): add versioned Eventa protocols (#2308 )

2026-08-20 12:24:47 +08:00

drizzle.config.ts

Revert "style: lint"

2026-08-26 20:13:10 +08:00

instrumentation.ts

chore(deps): bump dependencies

2026-08-26 19:01:04 +08:00

package.json

refactor(analytics): replace PostHog with OpenPanel (#2480 )

2026-09-09 08:26:18 +00:00

railway.toml

feat(chat-ws): add versioned Eventa protocols (#2308 )

2026-08-20 12:24:47 +08:00

README.md

fix(api): load Drizzle migrations at runtime (#2307 )

2026-08-17 11:19:53 +00:00

tsconfig.json

chore: move the server to an independent folder

2026-08-02 18:43:57 +08:00

vitest.config.ts

Revert "style: lint"

2026-08-26 20:13:10 +08:00

README.md

`@proj-airi/api-server`

Project AIRI's resource API. Authentication is a separate workspace app at server/apps/auth; this package does not instantiate Better Auth or expose auth/OIDC routes.

Responsibilities

Hono business APIs and WebSocket endpoints.
Characters, chats, providers, Flux, Stripe, model routing, and billing.
PostgreSQL migration ownership for the currently shared database. Drizzle reads the checked-in drizzle/ journal and SQL files at startup.
Redis cache, configuration KV, and cross-instance Pub/Sub.
Local verification of Auth-issued OIDC JWTs through public JWKS.

Run locally

pnpm -F @proj-airi/api-server dev
pnpm -F @proj-airi/api-server typecheck
pnpm -F @proj-airi/api-server exec vitest run
pnpm -F @proj-airi/api-server build

Run the complete local backend from the repository root:

pnpm dev:backend

For source-level debugging, start @proj-airi/api-server and @proj-airi/auth-server separately instead.

server/docker-compose.yaml exposes the local Caddy gateway at http://localhost:6112 and keeps the API and Auth container ports private.

Service boundaries

AUTH_SERVER_URL is Auth's canonical public issuer origin used for JWKS, issuer, and audience validation. It must exactly equal Auth's PUBLIC_URL.
/internal/auth/* is reachable only on the deployment's trusted private network. The public edge must reject /internal/* and the API service must not have its own public ingress.
AUTH_SERVER_INTERNAL_URL optionally sends JWKS fetches directly to Auth on the private network while issuer and audience remain AUTH_SERVER_URL.
Auth tables and principal types come from @proj-airi/auth-shared; no module under server/apps/auth is imported.

Railway

Deploy this as the Resource API Railway service with Config File Path /server/apps/api/railway.toml; keep the service Root Directory at the repository root because the Dockerfile copies shared workspace packages. The config owns its Dockerfile, start command, /readyz healthcheck, and the watch patterns for every copied build input.

Set AUTH_SERVER_INTERNAL_URL from Auth's Railway private domain. It is only the private JWKS route; AUTH_SERVER_URL remains the public Auth issuer URL. See server/README.md for the complete cross-service variable and migration contract.