import { WorkerEntrypoint } from "cloudflare:workers";
import { handleActionsRoutes } from "./http";

/** The job endpoints a cloud job calls through `gitfor.internal`: the Actions cache, action archives and images. */
const JOB_PATHS = new Set(["/api/actions/cache", "/api/actions/archive", "/api/actions/image"]);

/**
 * The only thing a cloud job's requests to `gitfor.internal` reach. They skip the edge (WAF, edge rate limits,
 * client IP headers), and job code, third-party actions included, can send them, so this exposes nothing but
 * the job API. Every route behind it still authenticates the job token itself.
 */
export class JobApiGateway extends WorkerEntrypoint<Env> {
  override async fetch(request: Request): Promise<Response> {
    const url = new URL(request.url);
    const response = JOB_PATHS.has(url.pathname) ? await handleActionsRoutes(request, url) : null;
    return response ?? Response.json({ error: "not found" }, { status: 404 });
  }
}