wrangler.preview.toml

compatibility_date = "2026-03-17"
main = "build/worker/shim.mjs"
workers_dev = true

[vars]
LOG_LEVEL = "DEBUG"
SOURCE_API_URL = "https://staging.source.coop"

# Sign the proxy's on-behalf-of API token (and AWS federation assertion) as the
# canonical staging proxy, not this ephemeral preview hostname: staging's API and
# AWS IAM trust only issuer https://data.staging.source.coop + kid data-proxy-1
# and fetch its JWKS from that host (never the pr-*.workers.dev origin). Signing
# as anything else fails JWKS verification (ERR_JWKS_NO_MATCHING_KEY), so the call
# falls back to anonymous → 403 on restricted products. Requires the `preview`
# environment's OIDC_PROVIDER_KEY to be the staging signing key.
OIDC_PROVIDER_ISSUER = "https://data.staging.source.coop"
OIDC_PROVIDER_KID = "data-proxy-1"

# Preview is staging-equivalent (shares staging analytics + log stream), so
# trust the staging Ory issuer and accept the staging frontend + CLI client_ids.
# AUTH_AUDIENCE must be set or person-token exchange at /.sts fail-closes with 501.
AUTH_ISSUER = "https://auth.staging.source.coop"
AUTH_AUDIENCE = "1123dfa8-469f-44fe-b9f4-9b76f06fd325,a79c9537-be78-454a-9ea1-b96a1be811cc"  # staging frontend + source-coop-cli client_ids
# Staging's platform issuers too: a GitHub Actions workflow calling a preview
# mints its token for the staging proxy's origin, since a preview's own
# hostname differs per PR.
PLATFORM_ISSUERS = '{"https://token.actions.githubusercontent.com": ["https://data.staging.source.coop"]}'

[build]
command = "cargo install -q worker-build@0.7.5 && worker-build --release"

[observability]
enabled = true
head_sampling_rate = 1
# Presigned URLs carry X-Amz-Signature in the query string (ADR-015).
redact_query_string = true

# Off: the M1 Issues alert is account-wide and would page on previews (ADR-015).
[observability.issues]
enabled = false

[observability.logs]
enabled = true
head_sampling_rate = 1
invocation_logs = true
persist = true

[observability.traces]
enabled = true
head_sampling_rate = 1
persist = true

[[analytics_engine_datasets]]
binding = "ANALYTICS"
dataset = "source_data_proxy_staging"

[[services]]
binding = "PUBLIC_LOG_STREAM"
service = "public-log-stream-staging"

# Limit on /.sts exchanges that may cost a Source API call, per client IP; see
# wrangler.toml.
[[ratelimits]]
name = "STS_EXCHANGE_LIMIT"
namespace_id = "1003"
simple = { limit = 100, period = 60 }