StormTrust gateway

stormtrust-gateway is the coarse request policy layer for StormTrust public hostnames. Cloudflare Worker Routes invoke it for the origins listed in its hostname registry. The gateway forwards approved requests through explicit service bindings.

Public request
      ↓
Exact hostname lookup
      ↓
Longest matching path policy
      ↓
Public ───────────────────────────────┐
      or                             │
Session or bearer-token validation   │
      ↓                              │
Active StormTrust principal          │
      ↓                              │
Role and permission lookup in D1     │
      ↓                              │
Sanitized identity context           │
      └──────────────────────────────┤
                                     ↓
                         Fixed service binding
                                     ↓
                            Application Worker

The request cannot select a Worker name. The gateway uses a source-controlled hostname registry. Unknown hostnames return 404.

This design does not use a Workers for Platforms dispatch namespace. Dispatch namespaces target large collections of customer-authored Workers. StormTrust currently routes a small set of first-party services, so fixed bindings keep the trust boundary smaller and easier to audit.

The website, developer documentation, UI workshop, shared assets, and public storm workspace remain public. The /dashboard path requires a verified, active principal with the member, operator, or admin role and the dashboard:read permission. Cookie-authenticated state changes also require an exact same-origin request; bearer-token requests use scoped abilities.

The gateway removes inbound X-StormTrust-* identity headers. It adds trusted identity headers only after successful checks. Origin Workers are responsible for tenant, record, and action authorization.

The authentication service uses authorization code with Proof Key for Code Exchange (PKCE). The gateway validates opaque sessions through a private Worker service binding. Both Workers run in the StormTrust Cloudflare account.

Each protected hostname has source-controlled client configuration. The website uses client stormtrust-web, audience stormtrust.net, and the exact redirect https://stormtrust.net/auth/callback. Protected routes return 503 instead of bypassing policy when auth or authorization state is unavailable.

The gateway implements these host-local endpoints:

Each callback uses an exact issuer, client ID, redirect URI, audience, and one-time state record. Session and transaction cookies use the __Host- prefix, Secure, HttpOnly, and SameSite=Lax attributes.

D1 stores principal status, scoped role assignments, role permissions, and short-lived PKCE transactions. The initial permission mapping is:

After auth returns a verified principal, the gateway creates that principal and assigns the baseline member role once. The one-time marker prevents a removed role from reappearing at the next sign-in. Operator and administrator grants remain explicit.

Terraform owns the gateway Worker identity and authorization D1 database. Wrangler owns code, service bindings, Worker Routes, D1 migrations, deployments, and observability. Origin applications continue to own their Custom Domains.

The trusted workflow applies Terraform and D1 migrations before deploying the gateway. It verifies that the gateway route owns every configured hostname.

Use Run the local application stack for startup, gateway URLs, local sign-in, and verification. The local topology preserves the production binding and authorization boundaries with generated .localhost configuration. Wrangler supervises the processes; Durable Objects retain their application-state role.

Use the shared validation and deployment guides and health evidence by app. For a failed release, follow recovery procedures with this application's state and access boundaries.