Astro ISR caching and Optimizely Graph webhooks

// astro.config.mjs
import { defineConfig } from 'astro/config';
import node from '@astrojs/node';
import react from '@astrojs/react';
import tailwindcss from '@tailwindcss/vite';
import { redisCache } from './src/lib/redis-cache-provider.config.ts';

export default defineConfig({
  output: 'server',
  adapter: node({ mode: 'standalone' }),

  // Disable the CSRF origin check. This app has no user-facing forms, and the
  // /hooks/graph endpoint receives server-to-server webhooks (text/plain from
  // Optimizely Graph) that would otherwise be blocked as cross-site form
  // submissions. This setting disables CSRF for the whole app, so it is only
  // safe when there are no user-facing forms. Otherwise, scope it.
  security: { checkOrigin: false },

  integrations: [react()],
  vite: {
    plugins: [tailwindcss()],
  },

  cache: {
    provider: redisCache(),
  },

  // routeRules supply maxAge and swr to the provider's setHeaders, so it knows
  // the TTL. The home page and every content page are on-demand ISR. The API and
  // webhook routes have no rule, so they are never cached.
  routeRules: {
    '/': { maxAge: 600, swr: 1800 },
    '/[...slug]': { maxAge: 600, swr: 1800 },
  },
});

// src/lib/redis-cache-provider.config.ts
import type { CacheProviderConfig } from 'astro';

export function redisCache(): CacheProviderConfig {
  return {
    entrypoint: './src/lib/redis-cache-provider.ts',
    config: {},
  };
}

// src/lib/redis-cache-provider.ts
import type { CacheProviderFactory } from 'astro';
import { createCluster } from 'redis';
import {
  EntraIdCredentialsProviderFactory,
  DEFAULT_TOKEN_MANAGER_CONFIG,
  REDIS_SCOPE_DEFAULT,
} from '@redis/entraid';
import { ManagedIdentityCredential } from '@azure/identity';

const DEPLOYMENT_ID = process.env.OPTIMIZELY_DXP_DEPLOYMENT_ID ?? 'local';
const REDIS_URL = process.env.REDIS_URL;
const AZURE_CLIENT_ID = process.env.AZURE_CLIENT_ID;

interface CachedEntry {
  body: string;
  status: number;
  headers: Record<string, string>;
  /** Unix ms timestamp when the entry was stored, for SWR age calculation. */
  storedAt: number;
}

interface LocalEntry extends CachedEntry {
  expiresAt: number;
}

function buildKey(pathname: string): string {
  // Normalize the trailing slash so /blog/post and /blog/post/ share one cache
  // key, preventing an invalidation for one from leaving the other stale.
  const normalized = pathname.replace(/\/$/, '') || '/';
  return `astro:${DEPLOYMENT_ID}:${normalized}`;
}

function parseCacheControl(cc: string): { maxAge: number; swr: number } {
  const maxAge = parseInt(cc.match(/(?:^|,)\s*max-age=(\d+)/i)?.[1] ?? '0', 10);
  const swr = parseInt(cc.match(/stale-while-revalidate=(\d+)/i)?.[1] ?? '0', 10);
  return { maxAge, swr };
}

class RedisCacheProvider {
  private client: ReturnType<typeof createCluster> | null = null;
  private connectPromise: Promise<ReturnType<typeof createCluster> | null> | null = null;
  private readonly localFallback = new Map<string, LocalEntry>();

  /**
   * Keys currently being refreshed in this process, which prevents a per-replica
   * SWR stampede. Multi-replica deployments may still issue one refresh per
   * replica. A distributed lock (such as Redis SET NX) would be needed to
   * prevent a cross-replica stampede.
   */
  private readonly refreshing = new Set<string>();

  readonly name = 'redis-isr-cache';

  setHeaders(options: { maxAge?: number; swr?: number; tags?: string[] }): Headers {
    const headers = new Headers();
    if (options.maxAge && options.maxAge > 0) {
      let value = `public, max-age=${options.maxAge}`;
      if (options.swr && options.swr > 0) {
        value += `, stale-while-revalidate=${options.swr}`;
      }
      headers.set('Cache-Control', value);
      headers.set('CDN-Cache-Control', value);
    }
    return headers;
  }

  async onRequest(
    context: { request: Request; url: URL; waitUntil?: (promise: Promise<unknown>) => void },
    next: () => Promise<Response>,
  ): Promise<Response> {
    const { pathname } = context.url;
    const key = buildKey(pathname);

    const hit = await this.readEntry(key);
    if (hit) {
      const cc = hit.headers['cache-control'] ?? '';
      const { maxAge, swr } = parseCacheControl(cc);
      if (maxAge === 0) return new Response(hit.body, { status: hit.status, headers: hit.headers });

      const ageSeconds = (Date.now() - hit.storedAt) / 1000;
      const isStale = ageSeconds > maxAge && swr > 0 && ageSeconds <= maxAge + swr;

      if (isStale && !this.refreshing.has(key)) {
        this.refreshing.add(key);
        const refresh = next()
          .then((fresh) => this.storeResponse(key, fresh))
          .finally(() => this.refreshing.delete(key))
          .catch((e) => console.warn('[redis-cache] Background refresh error:', e));

        // context.waitUntil is the Astro 7 API for edge runtimes. When it is
        // absent (Node.js), the promise runs in the event loop unscheduled.
        context.waitUntil?.(refresh);
      }

      return new Response(hit.body, {
        status: hit.status,
        headers: { ...hit.headers, 'X-Astro-Cache': isStale ? 'STALE' : 'HIT' },
      });
    }

    const response = await next();
    const stored = await this.storeResponse(key, response);
    if (!stored) {
      // Not cacheable (binary, non-200, Set-Cookie). Pass it through unchanged.
      return response;
    }

    return new Response(await response.clone().text(), {
      status: response.status,
      headers: { ...Object.fromEntries(response.headers), 'X-Astro-Cache': 'MISS' },
    });
  }

  async invalidate({ path, tags }: { path?: string; tags?: string | string[] }): Promise<void> {
    const paths = path ? [path] : [];
    const redis = await this.redis();

    if (redis) {
      try {
        const keys = paths.map(buildKey);
        if (keys.length) await redis.del(keys);
      } catch (err) {
        console.warn('[redis-cache] Invalidate error:', (err as Error).message);
      }
    } else {
      for (const p of paths) this.localFallback.delete(buildKey(p));
    }

    if (tags) {
      console.warn('[redis-cache] Tag-based invalidation not supported; skipping tags:', tags);
    }
  }

  private redis(): Promise<ReturnType<typeof createCluster> | null> {
    if (!REDIS_URL) return Promise.resolve(null);
    if (this.client) return Promise.resolve(this.client);
    if (!this.connectPromise) this.connectPromise = this.connect();
    return this.connectPromise;
  }

  private async connect(): Promise<ReturnType<typeof createCluster> | null> {
    try {
      const credential = new ManagedIdentityCredential({ clientId: AZURE_CLIENT_ID });
      const credentialsProvider =
        EntraIdCredentialsProviderFactory.createForDefaultAzureCredential({
          credential,
          scopes: REDIS_SCOPE_DEFAULT,
          tokenManagerConfig: DEFAULT_TOKEN_MANAGER_CONFIG,
        });

      const [host, portStr] = REDIS_URL!.replace(/^rediss?:\/\//, '').split(':');
      const port = portStr ? Number(portStr) : 10000;
      const net = await import('node:net');

      // Azure Managed Redis (*.redis.azure.net) is TLS-only on port 10000.
      // Honoring a plain redis:// scheme would set tls:false, and the TLS-only
      // port closes the socket immediately. Force TLS for Azure hosts.
      const isTls = REDIS_URL!.startsWith('rediss://') || /\.redis\.azure\.net$/i.test(host);

      const cluster = createCluster({
        rootNodes: [{ url: `${isTls ? 'rediss' : 'redis'}://${host}:${port}` }],
        defaults: {
          socket: { tls: isTls, connectTimeout: 10_000 },
          credentialsProvider,
        },
        // Azure Cache for Redis advertises its nodes by internal IP in CLUSTER
        // SLOTS. Those addresses are unreachable from the container, and their
        // TLS certificates do not match, so rewrite any advertised IP back to
        // the public host you dialed. Keep hostnames as they are.
        nodeAddressMap: (address) => {
          const [hostOrIp, nodePort] = address.split(':');
          return {
            host: net.isIP(hostOrIp) !== 0 ? host : hostOrIp,
            port: Number(nodePort),
          };
        },
      });

      cluster.on('error', (err) => console.warn('[redis-cache] Cluster error:', err.message));

      // The aggregate "All the root nodes are unavailable" error hides why each
      // node connection failed (DNS, TLS, auth, or timeout). Log them per node.
      cluster.on('node-error', (err: Error, node: { host: string; port: number }) =>
        console.error(`[redis-cache] node-error (${node?.host}:${node?.port}):`, err?.message));

      await cluster.connect();
      this.client = cluster;
      return cluster;
    } catch (err) {
      const e = err as Error & { cause?: unknown; errors?: unknown[] };
      console.warn('[redis-cache] Connection failed, using in-memory fallback:', e.message);
      if (e.cause) console.warn('[redis-cache]   cause:', e.cause instanceof Error ? e.cause.message : e.cause);
      this.connectPromise = null;
      return null;
    }
  }

  private async readEntry(key: string): Promise<CachedEntry | null> {
    const redis = await this.redis();
    if (redis) {
      try {
        const raw = await redis.get(key);
        return raw ? (JSON.parse(raw) as CachedEntry) : null;
      } catch (err) {
        console.warn('[redis-cache] Read error:', (err as Error).message);
        return null;
      }
    }

    const entry = this.localFallback.get(key);
    if (!entry || entry.expiresAt < Date.now()) {
      this.localFallback.delete(key);
      return null;
    }
    return entry;
  }

  /** Returns true if the response was stored, false if it was not cacheable. */
  private async storeResponse(key: string, response: Response): Promise<boolean> {
    if (
      response.status !== 200 ||
      response.headers.has('set-cookie') ||
      !response.headers.get('content-type')?.includes('text/html')
    ) {
      return false;
    }

    const body = await response.clone().text();
    const headers: Record<string, string> = {};
    response.headers.forEach((v, k) => { headers[k] = v; });

    const { maxAge, swr } = parseCacheControl(headers['cache-control'] ?? '');
    if (maxAge === 0) return false; // Route not configured for caching.

    const totalTtl = maxAge + swr;
    const entry: CachedEntry = { body, status: response.status, headers, storedAt: Date.now() };

    const redis = await this.redis();
    if (redis) {
      try {
        await redis.set(key, JSON.stringify(entry), { EX: totalTtl });
      } catch (err) {
        console.warn('[redis-cache] Write error:', (err as Error).message);
      }
    } else {
      this.localFallback.set(key, { ...entry, expiresAt: Date.now() + totalTtl * 1000 });
    }
    return true;
  }
}

// Singleton. Astro's factory call and the webhook's named import both reference
// this instance.
const _provider = new RedisCacheProvider();
const factory: CacheProviderFactory = (_config) => _provider;

export const cacheProvider = _provider;
export default factory;

astro:DEPLOYMENT_ID:PATHNAME

---
// src/pages/[...slug].astro
// Dynamic catch-all content page. Resolves any Optimizely CMS path to its
// content, discovers the content type and fields through introspection, and
// renders them generically.
//
// ISR: on-demand rendered (prerender = false). Cache behavior is declared in
// astro.config.mjs routeRules for '/[...slug]':
//   maxAge: 600  — fresh for 10 minutes in the CDN and Redis origin cache
//   swr:   1800  — serve stale for up to 30 minutes while revalidating

import Layout from '../layouts/Layout.astro';
import PageContent from '../components/PageContent.astro';
import { getPageByPath } from '../lib/graph-queries';

export const prerender = false;

// The catch-all slug param is the full sub-path and may contain "/".
// getPageByPath normalizes the trailing slash before matching the CMS url.default.
const { slug } = Astro.params;
const path = `/${slug ?? ''}`;

const content = await getPageByPath(path).catch((err) => {
  console.error('[[...slug]] Graph fetch error:', err);
  return null;
});

if (!content) {
  return new Response('Not Found', { status: 404 });
}

const title = content._metadata?.displayName || 'Untitled';
---

<Layout title={title}>
  <main class="mx-auto max-w-3xl px-6 py-12">
    <a href="/" class="mb-4 inline-block text-sm text-blue-600 no-underline dark:text-blue-400">
      &larr; Back to home
    </a>
    <PageContent content={content} />
  </main>
</Layout>

// src/middleware.ts
import { defineMiddleware } from 'astro:middleware';
import { createCluster } from 'redis';
import {
  EntraIdCredentialsProviderFactory,
  DEFAULT_TOKEN_MANAGER_CONFIG,
  REDIS_SCOPE_DEFAULT,
} from '@redis/entraid';
import { ManagedIdentityCredential } from '@azure/identity';

const DEPLOYMENT_ID = process.env.OPTIMIZELY_DXP_DEPLOYMENT_ID ?? 'local';
const REDIS_URL = process.env.REDIS_URL;
const AZURE_CLIENT_ID = process.env.AZURE_CLIENT_ID;

interface CachedEntry {
  body: string;
  status: number;
  headers: Record<string, string>;
  /** Unix ms timestamp when the entry was stored, for SWR age calculation. */
  storedAt: number;
}

interface LocalEntry extends CachedEntry {
  expiresAt: number;
}

function buildKey(pathname: string): string {
  const normalized = pathname.replace(/\/$/, '') || '/';
  return `astro:${DEPLOYMENT_ID}:${normalized}`;
}

function parseCacheControl(cc: string): { maxAge: number; swr: number } {
  const maxAge = parseInt(cc.match(/(?:^|,)\s*max-age=(\d+)/i)?.[1] ?? '0', 10);
  const swr = parseInt(cc.match(/stale-while-revalidate=(\d+)/i)?.[1] ?? '0', 10);
  return { maxAge, swr };
}

function cacheControlValue(maxAge: number, swr: number): string {
  let value = `public, max-age=${maxAge}`;
  if (swr > 0) value += `, stale-while-revalidate=${swr}`;
  return value;
}

/**
 * Redis-backed origin cache. A single module-level instance, because Node.js
 * module caching means the middleware and the routes that import `invalidate`
 * share one store.
 */
class RedisOriginCache {
  private client: ReturnType<typeof createCluster> | null = null;
  private connectPromise: Promise<ReturnType<typeof createCluster> | null> | null = null;
  private readonly localFallback = new Map<string, LocalEntry>();

  async invalidate(path: string): Promise<void> {
    const key = buildKey(path);
    const redis = await this.redis();
    if (redis) {
      try {
        await redis.del(key);
      } catch (err) {
        console.warn('[isr-cache] Invalidate error:', (err as Error).message);
      }
    } else {
      this.localFallback.delete(key);
    }
  }

  async readEntry(key: string): Promise<CachedEntry | null> {
    const redis = await this.redis();
    if (redis) {
      try {
        const raw = await redis.get(key);
        return raw ? (JSON.parse(raw) as CachedEntry) : null;
      } catch (err) {
        console.warn('[isr-cache] Read error:', (err as Error).message);
        return null;
      }
    }

    const entry = this.localFallback.get(key);
    if (!entry || entry.expiresAt < Date.now()) {
      this.localFallback.delete(key);
      return null;
    }
    return entry;
  }

  /** Returns true if the response was stored, false if it was not cacheable. */
  async storeResponse(key: string, response: Response): Promise<boolean> {
    if (
      response.status !== 200 ||
      response.headers.has('set-cookie') ||
      !response.headers.get('content-type')?.includes('text/html')
    ) {
      return false;
    }

    const body = await response.clone().text();
    const headers: Record<string, string> = {};
    response.headers.forEach((v, k) => { headers[k] = v; });

    const { maxAge, swr } = parseCacheControl(headers['cache-control'] ?? '');
    if (maxAge === 0) return false; // Route not configured for caching.

    const totalTtl = maxAge + swr;
    const entry: CachedEntry = { body, status: response.status, headers, storedAt: Date.now() };

    const redis = await this.redis();
    if (redis) {
      try {
        await redis.set(key, JSON.stringify(entry), { EX: totalTtl });
      } catch (err) {
        console.warn('[isr-cache] Write error:', (err as Error).message);
      }
    } else {
      this.localFallback.set(key, { ...entry, expiresAt: Date.now() + totalTtl * 1000 });
    }
    return true;
  }

  private redis(): Promise<ReturnType<typeof createCluster> | null> {
    if (!REDIS_URL) return Promise.resolve(null);
    if (this.client) return Promise.resolve(this.client);
    if (!this.connectPromise) this.connectPromise = this.connect();
    return this.connectPromise;
  }

  private async connect(): Promise<ReturnType<typeof createCluster> | null> {
    try {
      const credential = new ManagedIdentityCredential({ clientId: AZURE_CLIENT_ID });
      const credentialsProvider =
        EntraIdCredentialsProviderFactory.createForDefaultAzureCredential({
          credential,
          scopes: REDIS_SCOPE_DEFAULT,
          tokenManagerConfig: DEFAULT_TOKEN_MANAGER_CONFIG,
        });

      const [host, portStr] = REDIS_URL!.replace(/^rediss?:\/\//, '').split(':');
      const port = portStr ? Number(portStr) : 10000;
      const net = await import('node:net');

      // Azure Managed Redis is TLS-only on port 10000, so force TLS for Azure hosts.
      const isTls = REDIS_URL!.startsWith('rediss://') || /\.redis\.azure\.net$/i.test(host);

      const cluster = createCluster({
        rootNodes: [{ url: `${isTls ? 'rediss' : 'redis'}://${host}:${port}` }],
        defaults: {
          socket: { tls: isTls, connectTimeout: 10_000 },
          credentialsProvider,
        },
        // Rewrite advertised internal IPs back to the public host you dialed.
        nodeAddressMap: (address) => {
          const [hostOrIp, nodePort] = address.split(':');
          return {
            host: net.isIP(hostOrIp) !== 0 ? host : hostOrIp,
            port: Number(nodePort),
          };
        },
      });

      cluster.on('error', (err) => console.warn('[isr-cache] Cluster error:', err.message));
      cluster.on('node-error', (err: Error, node: { host: string; port: number }) =>
        console.error(`[isr-cache] node-error (${node?.host}:${node?.port}):`, err?.message));

      await cluster.connect();
      this.client = cluster;
      return cluster;
    } catch (err) {
      const e = err as Error & { cause?: unknown };
      console.warn('[isr-cache] Connection failed, using in-memory fallback:', e.message);
      if (e.cause) console.warn('[isr-cache]   cause:', e.cause instanceof Error ? e.cause.message : e.cause);
      this.connectPromise = null;
      return null;
    }
  }
}

const cache = new RedisOriginCache();

/** Delete a shared cache entry for a request path. Used by the Graph webhook. */
export function invalidate(path: string): Promise<void> {
  return cache.invalidate(path);
}

export const onRequest = defineMiddleware(async (context, next) => {
  const key = buildKey(context.url.pathname);

  // Serve from cache if present. HIT while fresh, STALE within the SWR window.
  const hit = await cache.readEntry(key);
  if (hit) {
    const { maxAge, swr } = parseCacheControl(hit.headers['cache-control'] ?? '');
    const ageSeconds = (Date.now() - hit.storedAt) / 1000;
    const isStale = maxAge > 0 && ageSeconds > maxAge && swr > 0 && ageSeconds <= maxAge + swr;

    return new Response(hit.body, {
      status: hit.status,
      headers: { ...hit.headers, 'X-Astro-Cache': isStale ? 'STALE' : 'HIT' },
    });
  }

  // Miss. Let the page opt into caching through Astro.locals.cache(), then render.
  let ttl: { maxAge: number; swr: number } | null = null;
  context.locals.cache = (maxAge: number, swr = 0) => {
    if (maxAge > 0) ttl = { maxAge, swr };
  };

  const response = await next();

  // If the page opted in, stamp Cache-Control so storeResponse can read the TTL
  // and the CDN gets its directives, store in Redis, and tag the response.
  if (ttl) {
    const value = cacheControlValue(ttl.maxAge, ttl.swr);
    response.headers.set('Cache-Control', value);
    response.headers.set('CDN-Cache-Control', value);

    const stored = await cache.storeResponse(key, response);
    if (stored) {
      return new Response(await response.clone().text(), {
        status: response.status,
        headers: { ...Object.fromEntries(response.headers), 'X-Astro-Cache': 'MISS' },
      });
    }
  }

  return response;
});

---
// src/pages/[...slug].astro
// ISR: on-demand rendered (prerender = false) and opted into the middleware
// origin cache, so the Graph webhook can regenerate it on publish.
//   maxAge: 600  — fresh for 10 minutes in the CDN and Redis origin cache
//   swr:   1800  — the CDN serves stale for up to 30 minutes while revalidating

import Layout from '../layouts/Layout.astro';
import PageContent from '../components/PageContent.astro';
import { getPageByPath } from '../lib/graph-queries';

export const prerender = false;

// Opt this route into the middleware origin cache.
Astro.locals.cache?.(600, 1800);

const { slug } = Astro.params;
const path = `/${slug ?? ''}`;

const content = await getPageByPath(path).catch((err) => {
  console.error('[[...slug]] Graph fetch error:', err);
  return null;
});

if (!content) {
  return new Response('Not Found', { status: 404 });
}

const title = content._metadata?.displayName || 'Untitled';
---

// env.d.ts
/// <reference path=".astro/types.d.ts" />
/// <reference types="astro/client" />

declare namespace App {
  interface Locals {
    /**
     * Opt the current route into the middleware origin cache.
     * Call this in page frontmatter, such as Astro.locals.cache(3600, 86400).
     */
    cache?: (maxAge: number, swr?: number) => void;
  }
}

// astro.config.mjs
import { defineConfig } from 'astro/config';
import node from '@astrojs/node';
import react from '@astrojs/react';
import tailwindcss from '@tailwindcss/vite';

export default defineConfig({
  output: 'server',
  adapter: node({ mode: 'standalone' }),

  // Disable the CSRF origin check. This app has no user-facing forms, and the
  // /hooks/graph endpoint receives server-to-server webhooks (text/plain from
  // Optimizely Graph) that would otherwise be blocked as cross-site form
  // submissions. This setting disables CSRF for the whole app, so it is only
  // safe when there are no user-facing forms. Otherwise, scope it.
  security: { checkOrigin: false },

  integrations: [react()],
  vite: {
    plugins: [tailwindcss()],
  },
});

"start": "node scripts/register-webhook.mjs & exec node ./dist/server/entry.mjs"

// scripts/register-webhook.mjs
// Normalize the gateway URL by stripping a trailing slash and any /content/v2
// suffix, so a webhook registered anywhere else never fires.
const GRAPH_BASE = (process.env.OPTIMIZELY_GRAPH_GATEWAY ?? 'https://cg.optimizely.com')
  .replace(/\/+$/, '')
  .replace(/\/content\/v2$/, '');

await fetch(`${GRAPH_BASE}/api/webhooks`, {
  method: 'POST',
  headers: {
    Authorization: `Basic ${Buffer.from(`${APP_KEY}:${APP_SECRET}`).toString('base64')}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    disabled: false,
    // The callback is a nested `request` object (url, method, headers), not a
    // flat `callback` field.
    request: {
      url: `${SITE_HOSTNAME}/hooks/graph`,
      method: 'POST',
      headers: { 'x-api-key': CALLBACK_APIKEY },
    },
    // topic scopes which subject.action events Graph delivers. Omitting it can
    // register a webhook that receives nothing and never fires a callback.
    // '*.*' means all events, and the filters that follow narrow to Published.
    topic: ['*.*'],
    filters: [{ status: { eq: 'Published' } }],
  }),
});

// src/pages/hooks/graph.ts
// Graph content-publish webhook callback.
// URL: POST /hooks/graph, which matches the registration callback in
// scripts/register-webhook.mjs.
import type { APIRoute } from 'astro';
import { cacheProvider } from '../../lib/redis-cache-provider.ts';
import { purgeCdnCache } from '../../lib/cdn-cache.ts';
import { getGraphClient } from '../../lib/graph-client.ts';
import { RESOLVE_DOC_PATH } from '../../lib/graph-queries.ts';
import { verifyApiKey } from '../../lib/auth/verify-api-key.ts';

export const prerender = false;

const CALLBACK_APIKEY = process.env.OPTIMIZELY_GRAPH_CALLBACK_APIKEY ?? '';

// Normalize to an absolute URL, because the CDN purge API needs a full https://
// URL and OPTIMIZELY_SITE_HOSTNAME may be a bare host.
const rawHostname = process.env.OPTIMIZELY_SITE_HOSTNAME ?? '';
const SITE_HOSTNAME = rawHostname && !/^https?:\/\//i.test(rawHostname)
  ? `https://${rawHostname}`
  : rawHostname;

interface WebhookPayload {
  type?: { subject?: string; action?: string };
  data?: { docId?: string };
}

export const POST: APIRoute = async ({ request }) => {
  if (!verifyApiKey(request.headers.get('x-api-key'), CALLBACK_APIKEY)) {
    console.warn('[graph-webhook] unauthorized request: missing or invalid x-api-key');
    return new Response('Unauthorized', { status: 401 });
  }

  let payload: WebhookPayload;
  try {
    // Read as text first, so both application/json and text/plain are accepted.
    const parsed = JSON.parse(await request.text());
    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
      return new Response('Bad Request: payload must be a JSON object', { status: 400 });
    }
    payload = parsed;
  } catch {
    return new Response('Bad Request: invalid JSON', { status: 400 });
  }

  const docId = payload?.data?.docId;
  if (!docId) {
    return new Response('Bad Request: missing data.docId', { status: 400 });
  }

  // docId format from Graph: "{guid-with-hyphens}_{locale}_{status}", such as
  // "7ac4c306-9085-4be4-975a-8f357c60b154_en_Published". _metadata.key stores
  // the same GUID without hyphens, so strip the suffixes and remove hyphens.
  const contentKey = docId.split('_')[0].replace(/-/g, '');

  // Resolve the content key to a URL path through Graph.
  let path: string | undefined;
  try {
    const result = await getGraphClient().request<{
      _Content: { items: Array<{ _metadata: { url: { default: string } } }> };
    }>(RESOLVE_DOC_PATH, { key: contentKey });
    path = result._Content?.items?.[0]?._metadata?.url?.default;
  } catch (err) {
    console.error('[graph-webhook] Graph query error:', err);
    return new Response('Internal Server Error: Graph query failed', { status: 500 });
  }

  if (!path) {
    console.warn(`[graph-webhook] Graph returned no path for key=${contentKey}.`);
    return new Response('Not Found: could not resolve docId to a path', { status: 404 });
  }

  // The frontend serves every content type at its real CMS path through the
  // catch-all route, so the resolved CMS URL is the request path that the Redis
  // cache and CDN are keyed by. The provider normalizes the trailing slash for
  // the Redis key, but the CDN caches the literal requested URL, so purge both
  // with and without the slash.
  const withSlash = path.endsWith('/') ? path : `${path}/`;
  const withoutSlash = path.replace(/\/+$/, '') || '/';

  // Deduplicate. If the changed page is the home page, do not act on '/' twice.
  const invalidatePaths = [...new Set([path, '/'])];
  const purgeUrls = [...new Set([withoutSlash, withSlash, '/'])].map((p) => `${SITE_HOSTNAME}${p}`);

  // Invalidate Redis and purge the CDN in parallel, and settle both so that one
  // failure does not block the other.
  const [redisResult, cdnResult] = await Promise.allSettled([
    Promise.all(invalidatePaths.map((p) => cacheProvider.invalidate({ path: p }))),
    purgeCdnCache(purgeUrls),
  ]);

  if (redisResult.status === 'rejected') {
    console.error('[graph-webhook] Redis invalidate failed:', redisResult.reason);
  }
  if (cdnResult.status === 'rejected') {
    console.error('[graph-webhook] CDN purge failed:', cdnResult.reason);
  }

  // Return only what the caller needs. Do not reflect untrusted payload fields.
  return new Response(JSON.stringify({ ok: true, path }), {
    status: 200,
    headers: { 'Content-Type': 'application/json' },
  });
};

// src/lib/auth/verify-api-key.ts
import { timingSafeEqual } from 'node:crypto';

/** Timing-safe API key check. Returns false if either argument is empty. */
export function verifyApiKey(provided: string | null, expected: string): boolean {
  if (!provided || !expected || provided.length !== expected.length) return false;
  return timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
}

// src/lib/auth/azure-identity.ts
import { ManagedIdentityCredential, type TokenCredential } from '@azure/identity';

// This sample is deployed to Azure and authenticates exclusively through the
// user-assigned managed identity. AZURE_CLIENT_ID selects which identity to use
// when more than one is assigned to the host.
export function getCredential(): TokenCredential {
  return new ManagedIdentityCredential({ clientId: process.env.AZURE_CLIENT_ID });
}

// src/lib/cdn-cache.ts
import { getCredential } from './auth/azure-identity.ts';

const API_URL = process.env.OPTIMIZELY_CLOUDPLATFORM_API_URL ?? '';
const API_RESOURCE_ID = process.env.OPTIMIZELY_CLOUDPLATFORM_API_RESOURCE_ID ?? '';

// 5-minute token cache, to avoid re-fetching on every webhook or API call.
let tokenCache: { token: string; expiresAt: number } | null = null;

export async function getToken(): Promise<string> {
  if (!API_RESOURCE_ID) {
    throw new Error('[cdn-cache] OPTIMIZELY_CLOUDPLATFORM_API_RESOURCE_ID is not set');
  }
  if (tokenCache && tokenCache.expiresAt > Date.now() + 60_000) {
    return tokenCache.token;
  }

  const credential = getCredential();
  const result = await credential.getToken(`${API_RESOURCE_ID}/.default`);
  tokenCache = { token: result.token, expiresAt: result.expiresOnTimestamp };
  return result.token;
}

export async function purgeCdnCache(urls: string[]): Promise<void> {
  // Fail fast with a clear message rather than letting getToken fail on an
  // empty scope.
  if (!API_URL || !API_RESOURCE_ID) {
    console.warn('[cdn-cache] OPTIMIZELY_CLOUDPLATFORM_API_URL or _RESOURCE_ID not set; purge skipped');
    return;
  }
  if (!urls.length) return;

  const token = await getToken();
  const res = await fetch(`${API_URL}/v1/edge-cache/purge`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${token}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ urls }),
  });

  if (!res.ok) {
    throw new Error(`CDN purge failed ${res.status}: ${await res.text()}`);
  }
}