Fangorn Webworker

A pnpm workspace containing the Cloudflare Workers behind Fangorn's content gating.

Packages

Package	Path	Description
fangorn-access-worker	fangorn-access-worker/	Gates R2 content behind on-chain settlement verification. One worker per R2 bucket.
pinata-url-provider	pinata-url-provider/	Generic on-chain condition gate that mints Pinata presigned upload URLs for callers who prove address ownership and pass a configurable contract check.

See each package's own README.md for details.

Getting started

This repo uses pnpm workspaces.

pnpm install

Common tasks

Run from the repo root:

pnpm dev:r2        # wrangler dev for fangorn-access-worker
pnpm dev:gate      # wrangler dev for pinata-url-provider
pnpm deploy:r2     # deploy fangorn-access-worker
pnpm deploy:gate   # deploy pinata-url-provider
pnpm typecheck     # typecheck every package that defines a typecheck script

Or work inside a package directly, e.g.:

Security

Cloudflare Webworkers are designed with a high-security isolation model. Instead of VMs or containers, they use V8 isolated, providing a lightweight and secure environment. However, they fundamentally require trust in Cloudflare.

• V8 Isolates: Unlike containers that share an OS kernel, V8 Isolates separate code at the memory level. This allows thousands of Workers to run on a single thread while remaining isolated.
• Spectre Mitigation: Cloudflare uses a unique approach to prevent Spectre-style side-channel attacks by removing high-precision timers and implementing memory protection keys that trap unauthorized memory access attempts.
• Automatic Patches: Since Cloudflare manages the runtime, security updates for the V8 engine and the Workers runtime are applied automatically without developer intervention.

Application-Level Security (Developer’s Responsibility)

While the infrastructure is hardened, developers must secure the logic and data flow within their scripts.

Secret Management: Never hardcode sensitive data like API keys. Use Wrangler Secrets to encrypt and store credentials securely.
Authentication & Access: You can implement Cloudflare Access with a single click to protect Worker routes or use the Web Crypto API for custom JWT validation.
Data Protection: Data stored in Workers KV is encrypted at rest using AES-256 and encrypted in transit via TLS.
Security Headers: Workers are frequently used to inject security headers (e.g., CSP, HSTS, X-Frame-Options) into responses to protect against XSS and clickjacking. 

---

Gen keys

openssl rand -hex 32 | npx wrangler secret put WORKER_X25519_SECRET

deploy work

cd ~/fangorn/webworker && npx wrangler deploy # ships the new /upload + DEK-from-R2 /access

run the example

cd ~/fangorn/x402f && npm run client:node # runs the loop (costs Sepolia gas for createResource)