Skip to content

Setup IaC for staging environment #1059

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Sep 24, 2025
Merged

Setup IaC for staging environment #1059

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
81f0815
vercel function oidc
Brendonovich Sep 23, 2025
2c21d12
use vercel oidc
Brendonovich Sep 23, 2025
f115332
make aws endpoint optional
Brendonovich Sep 23, 2025
068f623
handle VERCEL_AWS_ROLE_ARN
Brendonovich Sep 23, 2025
897e99b
use get range=0-0 instead of head
Brendonovich Sep 23, 2025
e66fcd8
optional secret keys
Brendonovich Sep 23, 2025
c16116d
stanging env vars
Brendonovich Sep 23, 2025
ae1ce00
Merge branch 'main' into staging
Brendonovich Sep 24, 2025
271ae30
format
Brendonovich Sep 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion apps/web/app/s/[videoId]/_components/CapVideoPlayer.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,10 @@ export function CapVideoPlayer({
? `${videoSrc}&_t=${timestamp}`
: `${videoSrc}?_t=${timestamp}`;

const response = await fetch(urlWithTimestamp, { method: "HEAD" });
const response = await fetch(urlWithTimestamp, {
method: "GET",
headers: { range: "bytes=0-0" },
});
Comment on lines +91 to +94
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Avoid CORS preflight regressions: try HEAD first, then GET Range as fallback.

Range header can trigger preflight in browsers; retain HEAD-first to reduce failures.

Apply:

-      const response = await fetch(urlWithTimestamp, {
-        method: "GET",
-        headers: { range: "bytes=0-0" },
-      });
+      let response: Response;
+      try {
+        response = await fetch(urlWithTimestamp, { method: "HEAD" });
+        if (!response.ok) throw new Error("HEAD not ok");
+      } catch {
+        response = await fetch(urlWithTimestamp, {
+          method: "GET",
+          headers: { Range: "bytes=0-0" },
+        });
+      }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
const response = await fetch(urlWithTimestamp, {
method: "GET",
headers: { range: "bytes=0-0" },
});
let response: Response;
try {
response = await fetch(urlWithTimestamp, { method: "HEAD" });
if (!response.ok) throw new Error("HEAD not ok");
} catch {
response = await fetch(urlWithTimestamp, {
method: "GET",
headers: { Range: "bytes=0-0" },
});
}
🤖 Prompt for AI Agents 
In apps/web/app/s/[videoId]/_components/CapVideoPlayer.tsx around lines 91–94,
the code currently issues a GET with a Range header which can trigger CORS
preflight; change it to first perform a HEAD request to the same URL (no Range
header) and treat a successful HEAD (response.ok) as confirmation the resource
is available, and only if HEAD fails or indicates the server doesn't support
HEAD, fall back to a GET with headers { range: "bytes=0-0" }; ensure you catch
network/errors from HEAD and proceed to the GET-range fallback so the behavior
remains resilient.

const finalUrl = response.redirected ? response.url : urlWithTimestamp;

// Check if the resolved URL is from a CORS-incompatible service
Expand Down
5 changes: 4 additions & 1 deletion apps/web/lib/transcribe.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,10 @@ export async function transcribeVideo(

// Check if video file actually exists before transcribing
try {
const headResponse = await fetch(videoUrl, { method: "HEAD" });
const headResponse = await fetch(videoUrl, {
method: "GET",
headers: { range: "bytes=0-0" },
});
if (!headResponse.ok) {
// Video not ready yet - reset to null for retry
await db()
Expand Down
1 change: 1 addition & 0 deletions apps/web/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@
"@tanstack/react-store": "^0.7.7",
"@ts-rest/core": "^3.52.1",
"@uidotdev/usehooks": "^2.4.1",
"@vercel/functions": "^3.1.0",
"@virtual-grid/react": "^2.0.3",
"@workos-inc/node": "^7.34.0",
"aws-sdk": "^2.1530.0",
Expand Down
20 changes: 12 additions & 8 deletions apps/web/utils/s3.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ import type {
RequestPresigningArguments,
StreamingBlobPayloadInputTypes,
} from "@smithy/types";
import { awsCredentialsProvider } from "@vercel/functions/oidc";
import type { InferSelectModel } from "drizzle-orm";

type S3Config = {
Expand All @@ -64,16 +65,19 @@ async function tryDecrypt(

export async function getS3Config(config?: S3Config, internal = false) {
if (!config) {
const env = serverEnv();
return {
endpoint: internal
? (serverEnv().S3_INTERNAL_ENDPOINT ?? serverEnv().CAP_AWS_ENDPOINT)
: (serverEnv().S3_PUBLIC_ENDPOINT ?? serverEnv().CAP_AWS_ENDPOINT),
region: serverEnv().CAP_AWS_REGION,
credentials: {
accessKeyId: serverEnv().CAP_AWS_ACCESS_KEY ?? "",
secretAccessKey: serverEnv().CAP_AWS_SECRET_KEY ?? "",
},
forcePathStyle: serverEnv().S3_PATH_STYLE,
? (env.S3_INTERNAL_ENDPOINT ?? env.CAP_AWS_ENDPOINT)
: (env.S3_PUBLIC_ENDPOINT ?? env.CAP_AWS_ENDPOINT),
region: env.CAP_AWS_REGION,
credentials: env.VERCEL_AWS_ROLE_ARN
? awsCredentialsProvider({ roleArn: env.VERCEL_AWS_ROLE_ARN })
: {
accessKeyId: env.CAP_AWS_ACCESS_KEY ?? "",
secretAccessKey: env.CAP_AWS_SECRET_KEY ?? "",
},
forcePathStyle: env.S3_PATH_STYLE,
};
}

Expand Down
9 changes: 1 addition & 8 deletions infra/sst-env.d.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,14 +5,7 @@

declare module "sst" {
export interface Resource {
DISCORD_BOT_TOKEN: {
type: "sst.sst.Secret";
value: string;
};
DiscordBotScript: {
type: "sst.cloudflare.Worker";
};
GITHUB_APP_PRIVATE_KEY: {
DATABASE_URL: {
type: "sst.sst.Secret";
value: string;
};
Expand Down
Loading
Loading