Repair Cloudflare Worker Preview Configuration Drift

Introduction

A support team's preview API is reporting live configuration, and its maintenance dry run refuses the preview credential. The live environment still works. Your task is to restore the preview boundary without weakening maintenance authorization or changing live behavior.

This independent challenge supplies a small Worker, two named local environments and synthetic credentials in a fresh VM. Apply the configuration, secret-loading and runtime-testing practices from the guided labs. Success means both local environments meet the contract below, followed by removal of the temporary servers and secret files. The names preview and live describe local test environments here; this challenge needs no Cloudflare login or deployment.

Restore Preview Isolation

Current Situation

The prepared project is /home/labex/project/preview-drift. Node 22.22.0, project-local Wrangler 4.131.1 and the independent testing runtime are installed. Development servers are not running yet. The supplied handler implements public health and a synthetic maintenance dry run; the fault lies in the preview environment's public configuration and credential loading.

Scope

Work with wrangler.jsonc, src/index.js, .dev.vars.preview, .dev.vars.live and .gitignore. Inspect the handler and configuration to find the binding contract. The two dotenv files contain different random, test-only credentials. You can inspect their key names without displaying their values. Keep credentials private to this VM and excluded from Git.

Run the preview Wrangler environment on loopback port 8080 and live on 8081. Give simultaneous runtimes different inspector ports. Use ordinary project-local Wrangler development commands; this challenge creates no remote resources. QUEUE_LABEL is a display string, not a queue service.

Your Goal

Both local environments must expose their intended public identity and allow maintenance only with their own configured credential. Preview must be isolated from live, and the existing public health and safe failure behavior must remain available.

Acceptance Criteria

GET /health returns JSON with status ok. Preview identifies environment preview and queue sandbox; live identifies environment live and queue primary.
Each environment loads its own synthetic credential through the handler's MAINTENANCE_TOKEN binding. Keep the two credential values distinct and outside source code and public Wrangler vars. The local dotenv files remain readable only by the VM user and excluded from Git.
POST /maintenance returns 200 with operation: dry-run and the environment name only for that environment's valid bearer credential. Missing, invalid and other-environment credentials return 401 with error: unauthorized.
A missing configured secret fails closed with 503 and error: maintenance_unconfigured. GET /maintenance remains 405 with error: method_not_allowed; an unknown route remains 404 with error: not_found.
Responses and application logs contain no credential values. Both local servers remain running for this step's two checks. No cloud authorization, deployment, report or copied success marker is required.

Hints

Compare the source of each public value

Read the handler's environment lookups, then compare the named environment objects in wrangler.jsonc. Wrangler environment vars are not inherited automatically. A runtime's selected environment and the values inside that environment are separate things.

Investigate a maintenance-unconfigured response

Distinguish a missing configured binding from a rejected incoming credential. Compare the handler's binding name with the key names in the environment-specific dotenv file. A local file's existence does not guarantee that it defines the binding the handler reads. Recheck the runtime's readiness after configuration changes.

Keep live behavior and the security boundary

Test health and maintenance in both directions. A token valid in one environment must be invalid in the other. The supplied maintenance operation is a dry run, so testing a correctly authorized request changes no application data.

Leave a Clean Workspace

Current Situation

The repaired local environments have passed the functional checks. Their development processes and synthetic credential files are still present in this VM.

Scope

Only this challenge's development jobs on ports 8080 and 8081, its .dev.vars.preview and .dev.vars.live files, and the shell variables holding their values are temporary. Preserve the repaired source, configuration, dependencies and LabEx services.

Your Goal

The repaired project remains available, with no running challenge server or local secret files left behind.

Acceptance Criteria

Neither port 8080 nor 8081 has a listening development server.
No .dev.vars* or .env* secret file remains in the challenge project.
Clear shell variables used for the synthetic credentials. This is a learner cleanup action; the backend cannot inspect the state of your interactive shell.
Preserve unrelated processes and files. There are no cloud resources or Cloudflare credentials to remove in this local-only challenge.

Hints

Target the jobs you started

Use your shell's job list to identify the two Wrangler development processes. Job numbers can change after restarting a server. Functional verification comes before cleanup; removing secrets first would make the earlier checks inconclusive.

Summary

You traced a preview identity mismatch to named environment values and a maintenance failure to the credential binding name. The repair restored preview isolation while keeping live behavior, public health and server-side authorization intact.

Testing missing, invalid, cross-environment and valid credentials established the boundary more thoroughly than a single success response. The final cleanup removed the local processes and synthetic secrets while preserving the repaired project.