AI chat builder (/chat/build)

Signed-in users describe a website; each AI turn becomes a versioned snapshot (ai_site_versions, migration 0016) published as plain static output to R2 SITES and served by the separate sites-worker on <slug>-<id>.devstack.bid (preview) and <slug>.devstack.bid (production, after Promote).

Security model#

• Generated code is untrusted. It is served only by sites-worker on *.devstack.bid, never by the platform apex.
• Preview iframe: cross-origin, sandbox="allow-scripts allow-forms" (no same-origin, no popups, no top navigation).
• Sites worker headers: Content-Security-Policy: frame-ancestors https://devstack.bid, X-Content-Type-Options: nosniff, plus a "Built by a devstack.bid user · Report" badge on every HTML page linking to /report (stored in D1 site_reports).
• Session cookie: __Host-nvx_auth (Secure, Path=/, no Domain) so a user site cannot set or overwrite it; the legacy host-only nvx_auth is still read so nobody is logged out, and is cleared on the next sign-in or logout. No cookie is set with Domain=.devstack.bid.
• Signed-in write APIs (gate) require Origin: https://devstack.bid exactly; *.devstack.bid and requests without an Origin are rejected. sameOrigin no longer accepts Sec-Fetch-Site: same-site.
• Slugs are globally unique (migration 0017) and platform-like labels are reserved (login, auth, admin, www, api, ..., anything containing devstack).
• Quota: atomic per-user daily reservation in D1 (ai_quota, INSERT ... SELECT ... HAVING COUNT(*) < cap) before the model call; KV (nvx-stack-builder-kv) holds only per-minute rate-limit counters.
• AI routing: Cloudflare AI Gateway (CF_ACCOUNT_ID + CF_AI_GATEWAY_ID). In production a direct OpenAI route fails closed (shown as Blocked) unless AISITE_ALLOW_DIRECT=1. The route is shown only to AISITE_ADMIN_LOGINS.

Long-term fix (not implemented)#

User sites are currently same-site with the platform (same registrable domain devstack.bid). The mitigations above (__Host- cookie, strict Origin, SameSite=Lax, frame-ancestors) close the known cookie-tossing and CSRF paths, but the robust fix is to serve user sites from a separate registrable domain (for example devstack-sites.app, listed on the Public Suffix List the way vercel.app and pages.dev are). That makes user sites cross-site to the platform for cookies, SameSite, Sec-Fetch-Site and browser storage partitioning. Plan: buy the domain, add a wildcard DNS record + route for the sites worker, switch PLATFORM_DOMAIN for sites, keep *.devstack.bid as redirects for a deprecation period, then submit the domain to the PSL.