403

This endpoint is not accessible via browser.

`,\n { status: 403, headers: { \"Content-Type\": \"text/html\" } },\n );\n }\n\n // 2. CORS preflight\n if (req.method === \"OPTIONS\") {\n if (allowedOrigin && allowedOrigin !== \"*\" && origin !== allowedOrigin) {\n return new Response(null, { status: 403 });\n }\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": allowedOrigin || origin,\n \"Access-Control-Allow-Headers\": \"x-api-key, Content-Type\",\n \"Access-Control-Max-Age\": \"86400\",\n },\n });\n }\n\n // 3. Check Origin header\n if (allowedOrigin && allowedOrigin !== \"*\" && origin !== allowedOrigin) {\n return new Response(\n JSON.stringify({ error: \"Origin not allowed\" }),\n { status: 403, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n // 4. Validate API key\n if (!secret) {\n return new Response(\n JSON.stringify({ error: \"API_SECRET not configured on server\" }),\n { status: 500, headers: corsHeaders(allowedOrigin || origin) },\n );\n }\n if (apiKey !== secret) {\n return new Response(\n JSON.stringify({ error: \"Unauthorised\" }),\n { status: 401, headers: corsHeaders(allowedOrigin || origin) },\n );\n }\n\n // 5. Check GAS URL is configured\n if (!gasUrl) {\n return new Response(\n JSON.stringify({ error: \"GAS_API_URL not configured on server\" }),\n { status: 500, headers: corsHeaders(allowedOrigin || origin) },\n );\n }\n\n // 6. Fetch from Google Sheets\n try {\n const res = await fetch(`${gasUrl}&t=${Date.now()}`, {\n redirect: \"follow\",\n });\n if (!res.ok) throw new Error(`GAS returned HTTP ${res.status}`);\n const json = await res.json();\n return new Response(\n JSON.stringify(json),\n { status: 200, headers: corsHeaders(allowedOrigin || origin) },\n );\n } catch (err) {\n return new Response(\n JSON.stringify({\n error: \"Sheet fetch failed: \" + (err as Error).message,\n }),\n { status: 502, headers: corsHeaders(allowedOrigin || origin) },\n );\n }\n}\n\nfunction corsHeaders(origin: string): Record {\n return {\n \"Access-Control-Allow-Origin\": origin,\n \"Access-Control-Allow-Headers\": \"x-api-key, Content-Type\",\n \"Content-Type\": \"application/json\",\n \"X-Content-Type-Options\": \"nosniff\",\n \"Cache-Control\": \"no-store\",\n };\n}","deleted","label",[102],"permalink","https://www.val.town/x/Afritrack/Afritrack2026reportingplatform/code/main.ts","extension","actionData","errors"]