Function handleFetch

services/security-auto-analysis/src/index.ts:96–388

(request: Request, env: CloudflareEnv)

      owner,
      findingId: parsedPayload.data.findingId,
    });
    try {
      await env.MANUAL_ANALYSIS_QUEUE.sendBatch([
        { body: { ...parsedPayload.data, commandId: command.id }, contentType: 'json' },
      ]);
    } catch (error) {
      await markSecurityAgentCommandQueueAdmissionFailed(db, command.id, 'Queue admission failed');
      throw error;
    }
    return Response.json({ success: true, accepted: true, commandId: command.id }, { status: 202 });
  }

  if (request.method === 'POST' && url.pathname === '/internal/remediation/start') {
    const internalSecret = await env.INTERNAL_API_SECRET.get();
    const authHeader = request.headers.get('x-internal-api-key');
    if (!authHeader || !internalSecret || !timingSafeEqual(authHeader, internalSecret)) {
      return Response.json({ error: 'Unauthorized' }, { status: 401 });
    }

    let payload: unknown;
    try {
      payload = await request.json();
    } catch {
      return Response.json({ error: 'Invalid JSON body' }, { status: 400 });
    }
    const parsedPayload = ManualRemediationStartRequestSchema.safeParse(payload);
    if (!parsedPayload.success) {
      return Response.json(
        { error: 'Invalid remediation command', issues: parsedPayload.error.issues },
        { status: 400 }
      );
    }

    const result = await startManualRemediation({ env, request: parsedPayload.data });
    if (!result.admitted) {
      return Response.json(
        { success: false, accepted: false, admitted: false, reason: result.reason },
        { status: result.reason === 'finding_not_found' ? 404 : 409 }
      );
    }
    return Response.json(
      {
        success: true,
        accepted: true,
        admitted: true,
        remediationId: result.remediationId,
        attemptId: result.attemptId,
        attemptNumber: result.attemptNumber,
      },
      { status: 202 }
    );
  }

  if (request.method === 'POST' && url.pathname === '/internal/remediation/cancel') {
    const internalSecret = await env.INTERNAL_API_SECRET.get();
    const authHeader = request.headers.get('x-internal-api-key');
    if (!authHeader || !internalSecret || !timingSafeEqual(authHeader, internalSecret)) {
      return Response.json({ error: 'Unauthorized' }, { status: 401 });