feat: add Web Vault visibility switch

src/index.ts

@@ -5,6 +5,11 @@ import { handleRequest } from './router';
 import { StorageService } from './services/storage';
 import { applyCors, jsonResponse } from './utils/response';
 import { runScheduledBackupIfDue } from './handlers/backup';
+import {
+  isBackendRequestPath,
+  isWebVaultHidden,
+  webVaultNotFoundResponse,
+} from './web-vault-visibility';
 
 let dbInitialized = false;
 let dbInitError: string | null = null;
@@ -19,22 +24,6 @@ function normalizeRequestUrl(request: Request): Request {
   return new Request(url.toString(), request);
 }
 
-function isWorkerHandledPath(path: string): boolean {
-  return (
-    path.startsWith('/api/') ||
-    path.startsWith('/identity/') ||
-    path.startsWith('/icons/') ||
-    path.startsWith('/fill-assist/') ||
-    path.startsWith('/notifications/') ||
-    path.startsWith('/.well-known/') ||
-    path === '/v1/assetlinks:check' ||
-    path === '/web-bootstrap' ||
-    path === '/config' ||
-    path === '/api/config' ||
-    path === '/api/version'
-  );
-}
-
 function addSearchIndexHeaders(request: Request, response: Response): Response {
   const url = new URL(request.url);
   const contentType = String(response.headers.get('Content-Type') || '').toLowerCase();
@@ -58,7 +47,7 @@ async function maybeServeAsset(request: Request, env: Env): Promise<Response | n
   if (!env.ASSETS) return null;
   if (request.method !== 'GET' && request.method !== 'HEAD') return null;
   const url = new URL(request.url);
-  if (isWorkerHandledPath(url.pathname)) return null;
+  if (isBackendRequestPath(url.pathname)) return null;
 
   const response = await env.ASSETS.fetch(request);
   return addSearchIndexHeaders(request, response);
@@ -90,6 +79,12 @@ export default {
   async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
     void ctx;
     const normalizedRequest = normalizeRequestUrl(request);
+    const requestPath = new URL(normalizedRequest.url).pathname;
+
+    if (isWebVaultHidden(env) && !isBackendRequestPath(requestPath)) {
+      return webVaultNotFoundResponse(normalizedRequest);
+    }
+
     const assetResponse = await maybeServeAsset(normalizedRequest, env);
     if (assetResponse) {
       return applyCors(normalizedRequest, assetResponse, env);