Storage Transfer Worker

A Cloudflare Worker for transferring files from URL to R2 storage with streaming support and Ed25519 signature verification.

Features

• Stream upload (no memory buffering)
• Auto content-type detection
• Ed25519 signature verification (secure, no secrets transmitted)
• Timestamp-based replay protection (5 minute window)

Setup

1. Create R2 Bucket

wrangler r2 bucket create your-bucket-name

2. Configure wrangler.toml

name = "storage-transfer"
main = "src/index.ts"
compatibility_date = "2024-01-01"

[[r2_buckets]]
binding = "BUCKET"
bucket_name = "your-bucket-name"

3. Configure wrangler.toml Variables

Variable	Default	Description
PLATFORM_PUBLIC_KEY	0uvFzFZYIqivaU6y4qvuHSb+Axj+Mj5aCP/49dekSIM=	API Grip 公钥，一般无需修改
PUBLIC_URL	https://oss.apigrip.com	替换为你自己的公开访问域名

4. Deploy

pnpm install
pnpm run deploy

How It Works

1. API Grip server signs request body (including timestamp) with Ed25519 private key
2. Worker receives request with X-Signature header
3. Worker verifies signature using platform public key
4. If valid and timestamp within 5 minutes, processes the transfer

Request Format

curl -X POST https://your-worker.workers.dev \
  -H "X-Signature: BASE64_SIGNATURE" \
  -H "Content-Type: application/json" \
  -d '{
    "sourceUrl": "https://example.com/video.mp4",
    "timestamp": 1234567890123
  }'

Response

Success:

{
  "success": true,
  "url": "https://cdn.example.com/path/to/file.mp4",
  "size": 1234567,
  "contentType": "video/mp4"
}

Error:

{
  "success": false,
  "error": "Error message"
}

Error Codes

Status	Error
400	Invalid JSON / Missing fields
401	Invalid signature / Expired request
405	Method not allowed
500	Internal server error
502	Source fetch failed

License

MIT