Skip to content

Add Cloudflare Secrets Store binding support #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Cybersoulja wants to merge 2 commits into
base: dev
Choose a base branch
from
Open

Add Cloudflare Secrets Store binding support #4

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d26919c
Add Cloudflare Secrets Store binding support
claude Apr 18, 2026
5a20f91
Update packages/worker/src/types.d.ts
Cybersoulja Apr 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/add-secrets-store-binding.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"r2-explorer": minor
---

Add support for Cloudflare Workers Secrets Store bindings. The `AppEnv` type now includes `SecretsStoreSecret` alongside `R2Bucket` and `Fetcher`, so workers with `[[secrets_store_secrets]]` bindings in `wrangler.toml` are fully typed. Example configuration added to the template `wrangler.toml`.
5 changes: 5 additions & 0 deletions packages/worker/dev/wrangler.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,8 @@ binding = 'teste'
bucket_name = 'teste'
preview_bucket_name = 'teste'

# [[secrets_store_secrets]]
# binding = "MY_SECRET"
# secret_name = "my-secret-name"
# store_id = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

2 changes: 1 addition & 1 deletion packages/worker/src/types.d.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ export type ShareMetadata = {

export type AppEnv = {
ASSETS: Fetcher;
[key: string]: R2Bucket;
[key: string]: R2Bucket | SecretsStoreSecret | Fetcher;
Comment thread
Cybersoulja marked this conversation as resolved.
Outdated
};
export type AppVariables = {
config: R2ExplorerConfig;
Expand Down
1 change: 1 addition & 0 deletions packages/worker/tests/bindings.d.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ export type Env = AppEnv & {
ASSETS: Fetcher;
MY_TEST_BUCKET_1: R2Bucket;
MY_TEST_BUCKET_2: R2Bucket;
MY_SECRET: SecretsStoreSecret;
};

declare module "cloudflare:test" {
Expand Down
1 change: 1 addition & 0 deletions packages/worker/tests/integration/server.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ describe("Server Endpoints", () => {
expect(body.buckets).not.toEqual(
expect.arrayContaining([
expect.objectContaining({ name: "NON_R2_BINDING" }),
expect.objectContaining({ name: "MY_SECRET" }),
]),
Comment on lines 38 to 40
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Since ASSETS is also a non-R2 binding (a Fetcher), it should be explicitly verified as excluded from the buckets list to ensure the discovery logic correctly filters out all non-bucket bindings, including the ones explicitly defined in AppEnv.

expect.objectContaining({ name: "NON_R2_BINDING" }),
				expect.objectContaining({ name: "MY_SECRET" }),
				expect.objectContaining({ name: "ASSETS" }),

);
// Check for at least the expected buckets (test environment may create additional ones)
Expand Down
1 change: 1 addition & 0 deletions packages/worker/tests/vitest.config.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ export default defineWorkersConfig({
},
bindings: {
NON_R2_BINDING: { type: "var", value: "some_value" }, // For testing non-bucket bindings
MY_SECRET: { type: "var", value: "mock-secret-value" }, // Mock SecretsStoreSecret binding
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The mock for MY_SECRET uses type: "var", which results in a string at runtime in the test environment. However, a real SecretsStoreSecret binding is an object with a get() method. This discrepancy means the test in server.test.ts is verifying that a string is excluded from the bucket list, but it doesn't guarantee that a real object-based secret binding would be excluded if the discovery logic is not robust enough to distinguish between different object types (e.g., checking for R2-specific methods like list or put).

// Add other global bindings if needed by the worker, e.g., KV or D1
// EMAIL_SENDER: { type: "send_email", ... } // if using abstract senders for emails
},
Expand Down
7 changes: 7 additions & 0 deletions template/wrangler.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,10 @@ assets = { directory = "node_modules/r2-explorer/dashboard", binding = "ASSETS",
[[r2_buckets]]
binding = "BUCKET"
bucket_name = "bucket"

# Bind Cloudflare Secrets Store secrets to your worker (optional).
# Docs: https://developers.cloudflare.com/workers/runtime-apis/bindings/secrets-store/
# [[secrets_store_secrets]]
# binding = "MY_SECRET"
# secret_name = "my-secret-name"
# store_id = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
Loading