AI: OpenAI proxy via free Cloudflare Worker (Firebase-token auth) — replaces Blaze-only callable

[notAidven]

Summary

Re-hosts the secure OpenAI proxy on a free-tier Cloudflare Worker instead of a Firebase Cloud Function, so the "Suited" app can use OpenAI without enabling the Blaze plan (this project is on the free Spark plan; Cloud Functions require Blaze). The OpenAI key stays server-side and the client keeps its soft-fail → rule-based fallback.

This replaces the previous approach in this PR (the aiChat Firebase callable). It stacks on #3 (feature/casino-2rooms-preflop) because the AI layer (web/src/lib/ai/*) and Room 2 LLM opponents live on the casino stack, not main.

Default behavior is unchanged: provider selection still defaults to gemini (Firebase AI Logic) → rule-based. The proxy is strictly opt-in.

Worker design (worker/)

A small TypeScript Worker (name = suited-ai-proxy) with zero runtime dependencies (only wrangler / @cloudflare/workers-types / typescript as devDeps).

• POST /chat — accepts { model?, messages, temperature?, max_tokens?, json? }, validates it (roles/content, array size ≤ 50, content ≤ 24k chars, temperature 0–2, positive-int max_tokens capped at 4096), then calls OpenAI Chat Completions (https://api.openai.com/v1/chat/completions). Default model gpt-4o-mini; json: true sets response_format: { type: 'json_object' }. Returns { text, model, finishReason }.
• GET / (or /health) — unauthenticated liveness probe → { "status": "ok" } (handy to confirm a deploy).
• Secret — the key is read from the Worker secret OPENAI_API_KEY (env.OPENAI_API_KEY), set via wrangler secret put. It is never in any file, committed, logged, or returned. Errors are sanitized to clean messages.

Auth gating — Firebase ID token verify (Web Crypto, no deps)

Every /chat call must send Authorization: Bearer <Firebase ID token>. The Worker verifies it itself with Web Crypto (chosen over a library to keep deps minimal and avoid needing a KV namespace on the free tier):

1. Fetches Google's public x509 certs from https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com and caches them per the response's Cache-Control: max-age (in-isolate).
2. Parses the cert DER to extract its SubjectPublicKeyInfo and verifies the JWT's RS256 signature over header.payload.
3. Checks claims: aud === "brilliant-alpha-clone-54be9", iss === "https://securetoken.google.com/brilliant-alpha-clone-54be9", exp not expired (+ light iat/auth_time/sub checks).

Missing/invalid/expired token → 401.

CORS

Allows https://brilliant-alpha-clone-54be9.web.app, https://brilliant-alpha-clone-54be9.firebaseapp.com, and http://localhost:5173/5174/5175; handles OPTIONS preflight and echoes the allowed Origin with proper Access-Control-* headers (Vary: Origin).

Client wiring (web/)

• web/src/lib/ai/providers/openai-proxy.ts rewritten to call the Worker via fetch (POST JSON, Authorization: Bearer <token from auth.currentUser.getIdToken()>) instead of httpsCallable. The Worker URL comes from VITE_AI_PROXY_URL (the client appends /chat; base URL or full .../chat both work).
  • generateText / generateJSON / streamText mapping preserved (streaming = one non-streamed call emitted once).
  • Soft-fail-to-null preserved: unset VITE_AI_PROXY_URL, no sign-in, network/timeout, or non-2xx → null, so Room 2's rule-based fallback (and the coach/table-talk) still work and nothing crashes.
  • Still opt-in via VITE_LLM_PROVIDER=openai-proxy; default (gemini → rule-based) unchanged and never auto-selected.
• web/.env.example documents VITE_AI_PROXY_URL + the deploy/opt-in flow.

Removed (no more Cloud Functions)

• Deleted the functions/ directory (the aiChat callable project).
• Removed the functions block from firebase.json (hosting / firestore / auth config untouched).
• Deleted web/src/lib/firebaseFunctions.ts (only the old provider imported it; confirmed unused after the rewrite).

Verification

From web/:

• npm run build — exit 0
• npx vitest run — 409 passed (5 files)
• node_modules/.bin/tsc -p tsconfig.app.json --noEmit — clean
• node scripts/mvp-logic-check.mjs — all PASS
• npx eslint on the changed provider — clean

From worker/:

• npm install — exit 0 (only devDeps)
• npx tsc --noEmit — clean
• npx wrangler deploy --dry-run --outdir dist — builds OK (~13 KiB, no deploy)
• Auth crypto path proved with an offline round-trip: extracting the SPKI from v1 & v3 self-signed certs + verifying a good RS256 signature (and rejecting a tampered one), and importing all 5 real Google securetoken certs via Web Crypto.

Not exercised (needs the maintainer's key + accounts): real OpenAI completions and a live deployed Worker round-trip.

Deploy steps (maintainer — all free)

1. cd worker && npm install
2. npx wrangler login (free Cloudflare account)
3. npx wrangler secret put OPENAI_API_KEY (paste the sk-... key)
4. npx wrangler deploy → note the Worker URL (https://suited-ai-proxy.<subdomain>.workers.dev)
5. In web/.env.local: VITE_AI_PROXY_URL=<that URL> and VITE_LLM_PROVIDER=openai-proxy
6. cd ../web && npm run build && firebase deploy --only hosting

Notes

• This AI path only goes live once the PR stack Phase 2: AI casino tables (engine, opponents, bankroll, Casino Floor) #1 → Casino: 2 rooms + Playing Preflop lesson (circular table, reacting coach) #3 → AI: OpenAI proxy via free Cloudflare Worker (Firebase-token auth) — replaces Blaze-only callable #4 merges to main and VITE_LLM_PROVIDER=openai-proxy (+ VITE_AI_PROXY_URL) are set. Until then, behavior is the unchanged gemini → rule-based default.
• Please do not auto-merge.
• No key is hardcoded, printed, logged, or committed; no real .env.local is committed (a gitignored dummy was used locally for AI-off builds).

Made with Cursor