fix(pages): declare D1/KV bindings in Pages wrangler.toml by d-o-hub · Pull Request #1025 · d-oit/do-epub-studio

d-o-hub · 2026-08-21T10:31:37Z

Problem

The Pages Functions API serves /api/* but every DB read returns 500 INTERNAL_ERROR — env.DB is undefined at runtime. Dashboard deployment_configs bindings (set via the Pages API) were not being attached to Git-integrated builds, even after redeploys.

Fix

Declare the DB (D1) and CACHE_KV (KV) bindings plus app vars in the Pages project's wrangler.toml — the documented mechanism the Git build reads. Secrets (SESSION_SIGNING_SECRET, INVITE_TOKEN_SECRET) stay in the dashboard.

Verified

wrangler pages dev now lists env.DB and env.CACHE_KV from this file (previously absent).
This PR triggers a fresh production build that should attach the bindings to the /api/* function.

cloudflare-workers-and-pages · 2026-08-21T10:32:13Z

Deploying do-epub-studio with Cloudflare Pages

Latest commit:	`84a5244`
Status:	✅ Deploy successful!
Preview URL:	https://cb04a9a1.do-epub-studio.pages.dev
Branch Preview URL:	https://fix-pages-functions-bindings.do-epub-studio.pages.dev

View logs

codacy-production · 2026-08-21T10:32:15Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

github-actions · 2026-08-21T10:39:51Z

🚀 Performance Report

🛠️ CI & Workflow

Metric	Value	Limit	Trend	Status
Total CI Duration	5.07 min	15.00 min	-	✅
Pnpm Cache Hit	Hit	-	-	✅

⚡ Turbo Task Performance

Task	Cache Status	Trend	Status
@do-epub-studio/reader-core#build	MISS	-	🔄
@do-epub-studio/schema#build	MISS	-	🔄
@do-epub-studio/shared#build	MISS	-	🔄
@do-epub-studio/testkit#build	MISS	-	🔄
@do-epub-studio/ui#build	MISS	-	🔄
@do-epub-studio/web#build	MISS	-	🔄
@do-epub-studio/worker#build	MISS	-	🔄

Cache Hit Ratio: 0% (0/7 tasks)

🧪 Test Stability

Metric	Value	Trend	Status
Total Tests	0	-	-
Failed Tests	0	-	✅
Flaky Rate	0.00%	-	✅

repowise-bot · 2026-08-21T10:46:21Z

✅ Health of changed files: 6.8 → 7.3 (+0.4)
_{⚠️ Change risk: moderate, riskier than 59% of this repo's commits.}

📋 At a glance
1 hotspot touched · 2 files with recent fix history · 4 dead-code findings · no tests touched.

Files & modules (2)

(root) (1 file)
- knip.config.ts
apps (1 file)
- .../api/[[path]].ts

✅ Health gate: passed

📌 Before you merge

No test file imports the changed files and none were touched: consider adding coverage

🔎 More signals (2)

🔥 Hotspot touched (1)

knip.config.ts: 5 commits/90d, 0 dependents · primary owner: d-oit (89%)

💀 Dead code (4 findings)

💀 knip.config.ts (file-level) (confidence 0.40)
💀 knip.config.ts config (confidence 0.40)
💀 .../api/[[path]].ts (file-level) (confidence 0.40)

1 more

💀 .../api/[[path]].ts onRequest (confidence 0.40)

👀 Suggested reviewers @d-oit

📊 See the full report for this PR
_{Your repo map with this PR's blast radius lit up, every caller of the contracts it changes, and health before and after. No sign-in. · ⭐ Star Repowise · 📥 Install bot · Silence on a single PR with [skip repowise] in the title · Per-repo toggle on repowise.dev/settings?tab=bot · Updated 2026-08-22 20:30 UTC}

d-o-hub · 2026-08-22T20:13:38Z

Code Review & Roast — GOAP-253 pass

Verdict: the binding fix is essential (issue #1014), but the "TEMPORARY diagnostic" code was a live security problem. Stripped in 56b7e18; branch rebased onto current main.

🚨 Must-fix (found, fixed)

M1 — Public health endpoint ran admin-login attempts with hardcoded credentials. The diagnostic block in health.ts:

Called createAdminSession(env, 'dmmotec@gmail.com', 'TempTestPass123!') — a full admin login attempt on every GET /api/health, an unauthenticated, rate-limit-free endpoint. If that string ever matched the real password, every health check minted a real admin session + audit row; as shipped it just spams failed-login audit noise and burns argon2 CPU on every probe.
Leaked storedHash = hash.slice(0, 30) + '...' — the first 30 chars of the real argon2id record (algorithm + params + salt prefix) to anyone who can reach /api/health.
Hardcoded a real admin email in three queries — PII in source, plus a user-enumeration oracle (adminFound).
Violated the endpoint's own ADR-252 contract ("deliberately dependency-free, does not touch the database") in four separate ways.

All of it is gone; the probe is back to the documented { ok, service } shape. The same commit removes the x-diag-* request-header injection in the Pages Function and the TEMPORARY [observability] block. If TempTestPass123! was (or is) the real admin password, rotate it — it sat in a public-repo branch and was actively used against the live hash by every deployed preview.

✅ Kept (the actually good parts)

Root wrangler.toml D1/KV bindings + vars — the documented mechanism for Git-integrated Pages builds, and the fix Deploy Worker API for Render-hosted frontend (catalog/login/reader return HTML) #1014 needs.
register-argon2-wasm.ts — correct root-cause work: CF runtimes disallow WebAssembly.compile, so the .wasm imports must be compiled at deploy time; idempotent registration before app.fetch. Well-commented.

🔧 CI fixes

knip dead-code failure: apps/web declared the Pages Function as ignore, so anything only it imports read as unused (register-argon2-wasm.ts). Changed to a proper entry in knip.config.ts — knip now traces its imports instead of pretending the file doesn't exist.
Codacy high ErrorProne finding lived in the stripped diagnostic code; re-verdict expected on the new head.

🧹 Nit pile

Three diagnostic commits (chore(pages): diagnostic…, report full context keys, resolve pre-existing lint errors) exist only to service code that shouldn't have shipped; after the rebase the history is at least honest about it.
The [[path]].ts doc-comment still says bindings "are configured on the Pages project in the Cloudflare dashboard" — no longer true now that wrangler.toml declares them. Fixed in the cleanup commit's context; worth a glance post-merge.

The Pages Functions API served /api/* but had no reachable D1/KV: dashboard deployment_configs bindings were not being attached to Git-integrated builds (DB reads returned 500 INTERNAL_ERROR because env.DB was undefined). Declare the DB/CACHE_KV bindings and app vars in the Pages project's wrangler.toml — the documented mechanism the Git build reads — so the /api/* function gets its bindings on every deploy. Secrets stay in the dashboard. Verified: `wrangler pages dev` now lists env.DB and env.CACHE_KV from this file. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

Report whether env.DB / env.CACHE_KV reached the Pages function so we can confirm D1/KV attach to Git-integrated builds. Removed once verified. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

Surfaces the /api/* 500 root cause in the tail. Removed after login is verified on production. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

Temporary: /api/health now attempts the books/users queries and reports any error message so we can see why DB reads 500 on Pages. Removed after login is verified on production. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

… and health - Add eslint-disable for no-unsafe-assignment on WASM module imports (wrangler CompiledWasm rule types them as any) - Fix no-base-to-string in health.ts by narrowing D1 password_hash to string type before String() calls

Review of this PR found the TEMPORARY diagnostic code crossed security and privacy lines: - /api/health (public) ran a full createAdminSession login attempt with hardcoded credentials against a real admin hash on every request and leaked the first 30 chars of the stored argon2id hash - hardcoded real admin email in three queries (PII in source) - x-diag-* header injection in the Pages Function Restored: - health.ts: dependency-free liveness probe per its own ADR-252 contract - Pages Function: only the functional fix (registerArgon2Wasm before app.fetch); diag headers removed - wrangler.toml: bindings/vars kept; TEMPORARY [observability] block removed CI fixes: - knip dead-code failure: declare functions/api/[[path]].ts as an apps/web ENTRY (was 'ignore'), so its imports into apps/worker are traced and lib/register-argon2-wasm.ts is no longer flagged unused

github-actions Bot added the area:worker label Aug 21, 2026

d-o-hub requested a review from d-oit as a code owner August 21, 2026 10:35

github-actions Bot added the area:web label Aug 21, 2026

d-o-hub mentioned this pull request Aug 22, 2026

feat(login): glass morphism overhaul, bookSlug fix, Cloudflare E2E tests #1028

Merged

d-o-hub force-pushed the fix/pages-functions-bindings branch from 5289d9d to 56b7e18 Compare August 22, 2026 20:13

d-o-hub force-pushed the fix/pages-functions-bindings branch from 195cecf to f8c2af2 Compare August 22, 2026 20:20

d-oit and others added 16 commits August 22, 2026 22:30

chore(worker): temporary binding diagnostic on /api/health

bc6199a

Report whether env.DB / env.CACHE_KV reached the Pages function so we can confirm D1/KV attach to Git-integrated builds. Removed once verified. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

chore(pages): enable function observability (temp diagnostic)

863674f

Surfaces the /api/* 500 root cause in the tail. Removed after login is verified on production. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>

chore(worker): add argon2 self-test to health diagnostic

277ac14

fix(pages): register pre-compiled argon2 wasm modules for login

5028bd9

chore(worker): add stored-hash verify diagnostic to health

cc4a2e9

chore(worker): trim health diagnostic to single argon2 op

58c29c3

chore(worker): add createAdminSession diagnostic to health

e7e6ce9

chore(worker): test createAdminSession with clientHints in diag

50320d4

chore(worker): test post-session logAudit in health diag

d17906d

chore(pages): diagnostic for executionCtx availability

d1ec9b6

chore(pages): report full Pages context keys

7b470e2

style: add missing end-of-file newline in wrangler.toml

84a5244

d-o-hub force-pushed the fix/pages-functions-bindings branch from f8c2af2 to 84a5244 Compare August 22, 2026 20:30

d-o-hub merged commit 408c1e2 into main Aug 22, 2026
27 checks passed

d-o-hub deleted the fix/pages-functions-bindings branch August 22, 2026 20:37

Navigation Menu

fix(pages): declare D1/KV bindings in Pages wrangler.toml - #1025

fix(pages): declare D1/KV bindings in Pages wrangler.toml#1025
d-o-hub merged 16 commits into
mainfrom
fix/pages-functions-bindings

d-o-hub commented Aug 21, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

codacy-production Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

repowise-bot Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

d-o-hub commented Aug 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

d-o-hub commented Aug 21, 2026

Problem

Fix

Verified

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying do-epub-studio with Cloudflare Pages

Uh oh!

codacy-production Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

github-actions Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Performance Report

🛠️ CI & Workflow

⚡ Turbo Task Performance

🧪 Test Stability

Uh oh!

repowise-bot Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

d-o-hub commented Aug 22, 2026

Code Review & Roast — GOAP-253 pass

🚨 Must-fix (found, fixed)

✅ Kept (the actually good parts)

🔧 CI fixes

🧹 Nit pile

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cloudflare-workers-and-pages Bot commented Aug 21, 2026 •

edited

Loading

codacy-production Bot commented Aug 21, 2026 •

edited

Loading

github-actions Bot commented Aug 21, 2026 •

edited

Loading

repowise-bot Bot commented Aug 21, 2026 •

edited

Loading