Move SAP privilege out of the browser.

const SESSION_TTL_SECONDS = 3600;

export default {
  async fetch(request, env) {
    const url = new URL(request.url);

    if (request.method === "POST" && url.pathname === "/bff/session") {
      return createSession(request, env);
    }

    if (url.pathname.startsWith("/api/")) {
      return proxyAuthorizedRequest(request, env);
    }

    return json({ error: "not_found" }, 404);
  },
};

async function createSession(request, env) {
  // 1. Validate registered login or server-established guest context.
  // 2. Optionally verify Turnstile as an abuse gate.
  // 3. Mint or reuse the SAP token server-side.
  const sessionId = `sess_${crypto.randomUUID()}`;
  const session = {
    customerId: "replace-with-verified-customer-id",
    guestCartIds: [],
    originAccessToken: await getOriginToken(env),
    expiresAt: Date.now() + SESSION_TTL_SECONDS * 1000,
    revoked: false,
  };

  await env.SESSIONS.put(sessionId, JSON.stringify(session), {
    expirationTtl: SESSION_TTL_SECONDS,
  });

  return json({
    access_token: sessionId,
    token_type: "bearer",
    expires_in: SESSION_TTL_SECONDS,
  });
}

async function proxyAuthorizedRequest(request, env) {
  const match = (request.headers.get("authorization") || "")
    .match(/^Bearer\s+(sess_[0-9a-fA-F-]+)$/);
  if (!match) return json({ error: "missing_session" }, 401);

  const stored = await env.SESSIONS.get(match[1], "json");
  if (!stored || stored.revoked || stored.expiresAt <= Date.now()) {
    return json({ error: "invalid_session" }, 401);
  }

  if (!isAllowed(request, new URL(request.url), stored)) {
    return json({ error: "forbidden" }, 403);
  }

  const headers = new Headers(request.headers);
  headers.set("authorization", `Bearer ${stored.originAccessToken}`);
  headers.delete("cookie");

  return env.ORIGIN.fetch(new Request(request.url, {
    method: request.method,
    headers,
    body: request.body,
  }));
}

function isAllowed(request, url, session) {
  // Replace with Kao's ownership policy.
  // Registered example: /api/users/{customerId}/...
  const userMatch = url.pathname.match(/^\/api\/users\/([^/]+)/);
  if (userMatch && decodeURIComponent(userMatch[1]) !== session.customerId) {
    return false;
  }

  // Guest example: allow only cart IDs established for this guest session.
  const cartMatch = url.pathname.match(/^\/api\/carts\/([^/]+)/);
  if (cartMatch && !session.guestCartIds.includes(decodeURIComponent(cartMatch[1]))) {
    return false;
  }

  return true;
}

name = "kao-sap-bff"
main = "src/worker.js"
compatibility_date = "2026-10-06"

routes = [
  { pattern = "api.example.com/*", zone_name = "example.com" }
]

[[kv_namespaces]]
binding = "SESSIONS"
id = ""

[[services]]
binding = "ORIGIN"
service = ""

# Set secrets outside source control:
#   wrangler secret put SAP_CLIENT_ID
#   wrangler secret put SAP_CLIENT_SECRET
#   wrangler secret put TURNSTILE_SECRET