Repository navigation
Harden for public release and rename to sub2api - #6
Merged
Merged
Conversation
The guard that refuses API calls while CPA has no keys cached CPA's answer per Worker isolate, so after the last key was removed other isolates kept forwarding for up to 15 seconds, which CPA lets through. Requests now run in the single Durable Object in front of the container, and no cached answer is trusted for a window after any dashboard write. Sign-in attempts are limited to 5 a minute per client IP.
Short, keyword-led README with the one-click deploy up front; the security model and a private reporting channel move to SECURITY.md. Adds repository metadata to package.json.
The Worker, R2 bucket, package, login page and docs now use sub2api, and the README introduces it as a Cloudflare-based LLM gateway and proxy server that deploys CPA.
devbymak
changed the title
Move the key check to the Durable Object in the diagram, state the secret rules, add OpenAI client env vars, an Update section, the bucket and login steps for wrangler deploys, and how to recover a lost management key.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gets the repo ready for other people to deploy and reuse.
Security fixes
CpaDurable Object, so oneKeyGuardsees every dashboard change. After any dashboard write, no cached answer is trusted for 15s, in case CPA applies the change late.POST /loginnow allows 5 attempts a minute per IP (the Workers Rate Limiting bindingLOGIN_LIMIT), and returns 429 after that.Audit
.dev.varsand.wrangler/are gitignored and were never committed.Docs
SECURITY.md: the security model, plus private vulnerability reporting.package.jsongains repository, homepage, license and keyword metadata.Rename to sub2api
sub2api. The default URL becomessub2api.<subdomain>.workers.dev.llm-gatewaydeploy is not touched. Deploying this creates a new Worker and an empty bucket, so providers need signing in again.Tested
npm run verify: 55 tests pass, including new tests for the cache window and the rate limit.wrangler deploy --dry-runbuilds and shows theLOGIN_LIMITbinding.wrangler devwith the real container:🤖 Generated with Claude Code