// BAM Yacht — Proxy Replicate per Val.town (v2 — CORS rafforzato) // Incollare questo codice in https://www.val.town al posto del precedente.
export default async function (req) { const url = new URL(req.url); const
targetUrl = https://api.replicate.com${url.pathname}${url.search};
// Echo dell'origin del richiedente — più robusto di "" const origin = req.headers.get("origin") || "";
// Header che il browser chiede di permettere nel preflight const reqHeaders = req.headers.get("access-control-request-headers") || "authorization,content-type";
// Gestione preflight CORS if (req.method === "OPTIONS") { return new Response(null, { status: 204, headers: { "Access-Control-Allow-Origin": origin, "Access-Control-Allow-Credentials": "true", "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS", "Access-Control-Allow-Headers": reqHeaders, "Access-Control-Max-Age": "86400", "Vary": "Origin", }, }); }
// Inoltra Authorization e Content-Type a Replicate const headers = new Headers(); const auth = req.headers.get("authorization"); if (auth) headers.set("Authorization", auth); headers.set("Content-Type", "application/json");
// Inoltra body se POST/PUT let body = undefined; if (req.method !== "GET" && req.method !== "HEAD") { body = await req.text(); }
// Chiama Replicate const upstream = await fetch(targetUrl, { method: req.method, headers, body, });
// Risposta con CORS aperto verso il client const responseHeaders = new Headers(upstream.headers); responseHeaders.set("Access-Control-Allow-Origin", origin); responseHeaders.set("Access-Control-Allow-Credentials", "true"); responseHeaders.set("Access-Control-Expose-Headers", "*"); responseHeaders.set("Vary", "Origin");
return new Response(upstream.body, { status: upstream.status, headers: responseHeaders, }); }