Cloudflare Stream — Marketing Team Ships Video Without Engineering

// CMS/marketing integration — connect your CMS to Cloudflare Stream.
// When marketing publishes a video in the CMS, this Worker webhook
// uploads it to Stream, gets the embed URL, and writes it back.
// Marketing team never touches engineering infrastructure.
// Bindings: STREAM_ACCOUNT_ID, STREAM_API_TOKEN (Cloudflare secrets)

export default {
  async fetch(request, env) {
    const url = new URL(request.url)

    // ── POST /api/video/upload ─────────────────────────────────────────
    // Client sends a video file — Worker proxies to Stream API.
    // Stream auto-encodes at 360p / 720p / 1080p / 4K.
    if (url.pathname === '/api/video/upload' && request.method === 'POST') {
      const formData = await request.formData()
      const file     = formData.get('file')        // Blob from browser

      const upload = await fetch(
        `https://api.cloudflare.com/client/v4/accounts/${env.STREAM_ACCOUNT_ID}/stream`,
        {
          method:  'POST',
          headers: { Authorization: `Bearer ${env.STREAM_API_TOKEN}` },
          body:    file,
        }
      )
      const { result } = await upload.json()

      // result.uid = Stream video ID
      // result.playback.hls = HLS manifest URL (adaptive bitrate)
      // Embed: https://customer-XXX.cloudflarestream.com/{uid}/iframe
      return Response.json({
        uid:      result.uid,
        embedUrl: `https://customer-XXX.cloudflarestream.com/${result.uid}/iframe`,
        hls:      result.playback.hls,
        status:   result.status.state,  // "inprogress" → "ready"
      })
    }

    // ── GET /api/video/:uid/token ──────────────────────────────────────
    // Generate a signed token — gates video to authenticated users only.
    // Expires in 1 hour. Only viewers with this token can watch.
    if (url.pathname.startsWith('/api/video/') && url.pathname.endsWith('/token')) {
      const uid   = url.pathname.split('/')[3]
      const token = await fetch(
        `https://api.cloudflare.com/client/v4/accounts/${env.STREAM_ACCOUNT_ID}/stream/${uid}/token`,
        {
          method:  'POST',
          headers: { Authorization: `Bearer ${env.STREAM_API_TOKEN}` },
          body:    JSON.stringify({ exp: Math.floor(Date.now() / 1000) + 3600 }),
        }
      ).then(r => r.json())

      // Signed embed: /iframe?token={token}  — only works for 1 hour
      return Response.json({ token: token.result.token })
    }

    return fetch(request)
  }
}