cloudflare-full-stack-integration

What this skill does

# Cloudflare Full-Stack Integration Patterns

Production-tested patterns for React + Cloudflare Workers + Hono + Clerk authentication.

## When to Use This Skill

Use this skill when you need to:

- Connect a React frontend to a Cloudflare Worker backend
- Implement authentication with Clerk in a full-stack app
- Set up API calls that automatically include auth tokens
- Fix CORS errors between frontend and backend
- Prevent race conditions with auth loading
- Configure environment variables correctly
- Set up D1 database access from API routes
- Create protected routes that require authentication

## What This Skill Provides

### Templates

**Frontend** (`templates/frontend/`):
- `lib/api-client.ts` - Fetch wrapper with automatic token attachment
- `components/ProtectedRoute.tsx` - Auth gate pattern with loading states

**Backend** (`templates/backend/`):
- `middleware/cors.ts` - CORS configuration for dev and production
- `middleware/auth.ts` - JWT verification with Clerk
- `routes/api.ts` - Example API routes with all patterns integrated

**Config** (`templates/config/`):
- `wrangler.jsonc` - Complete Workers configuration with bindings
- `.dev.vars.example` - Environment variables setup
- `vite.config.ts` - Cloudflare Vite plugin configuration

**References** (`references/`):
- `common-race-conditions.md` - Complete guide to auth loading issues

## Critical Architectural Insights

### 1. @cloudflare/vite-plugin Runs on SAME Port

**Key Insight**: The Worker and frontend run on the SAME port during development.

```typescript
// ✅ CORRECT: Use relative URLs
fetch('/api/data')

// ❌ WRONG: Don't use absolute URLs or proxy
fetch('http://localhost:8787/api/data')
```

**Why**: The Vite plugin runs your Worker using workerd directly in the dev server. No proxy needed!

### 2. CORS Must Be Applied BEFORE Routes

```typescript
// ✅ CORRECT ORDER
app.use('/api/*', cors())
app.post('/api/data', handler)

// ❌ WRONG ORDER - Will cause CORS errors
app.post('/api/data', handler)
app.use('/api/*', cors())
```

### 3. Auth Loading is NOT a Race Condition

Most "race conditions" are actually missing `isLoaded` checks:

```typescript
// ❌ WRONG: Calls API before token ready
useEffect(() => {
  fetch('/api/data') // 401 error!
}, [])

// ✅ CORRECT: Wait for auth to load
const { isLoaded, isSignedIn } = useSession()
useEffect(() => {
  if (!isLoaded || !isSignedIn) return
  fetch('/api/data') // Now token is ready
}, [isLoaded, isSignedIn])
```

### 4. Environment Variables Have Different Rules

**Frontend** (Vite):
- MUST start with `VITE_` prefix
- Defined in `.env` file
- Access: `import.meta.env.VITE_VARIABLE_NAME`

**Backend** (Workers):
- NO prefix required
- Defined in `.dev.vars` file (dev) or wrangler secrets (prod)
- Access: `env.VARIABLE_NAME`

### 5. D1 Bindings Are Always Available

D1 is accessed via bindings - no connection management needed:

```typescript
// ✅ CORRECT: Direct access via binding
const { results } = await env.DB.prepare('SELECT * FROM users').run()

// ❌ WRONG: No need to "connect" first
const connection = await env.DB.connect() // This doesn't exist!
```

## Step-by-Step Integration Guide

### Step 1: Project Setup

```bash
# Create project with Cloudflare Workers + React
npm create cloudflare@latest my-app
cd my-app

# Install dependencies
npm install hono @clerk/clerk-react @clerk/backend
npm install -D @cloudflare/vite-plugin @tailwindcss/vite
```

### Step 2: Configure Vite

Copy `templates/config/vite.config.ts` to your project root.

**Key points**:
- Includes `cloudflare()` plugin
- No proxy configuration needed
- Sets up path aliases for clean imports

### Step 3: Configure Wrangler

Copy `templates/config/wrangler.jsonc` to your project root.

**Update**:
- Replace `name` with your app name
- Add D1/KV/R2 bindings as needed
- Set `run_worker_first: ["/api/*"]` for API routes

### Step 4: Set Up Environment Variables

Create `.dev.vars` (gitignored):
```
CLERK_PUBLISHABLE_KEY=pk_test_xxxxx
CLERK_SECRET_KEY=sk_test_xxxxx
```

Create `.env` for frontend:
```
VITE_CLERK_PUBLISHABLE_KEY=pk_test_xxxxx
```

### Step 5: Add CORS Middleware

Copy `templates/backend/middleware/cors.ts` to your backend.

Apply in your main worker file:
```typescript
import { corsMiddleware } from './middleware/cors'

app.use('/api/*', (c, next) => corsMiddleware(c.env)(c, next))
```

**CRITICAL**: Apply this BEFORE defining routes!

### Step 6: Add Auth Middleware

Copy `templates/backend/middleware/auth.ts` to your backend.

Apply to protected routes:
```typescript
import { jwtAuthMiddleware } from './middleware/auth'

app.use('/api/protected/*', jwtAuthMiddleware(c.env.CLERK_SECRET_KEY))
```

### Step 7: Set Up API Client

Copy `templates/frontend/lib/api-client.ts` to your frontend.

Use in your App component:
```typescript
import { useApiClient } from '@/lib/api-client'

function App() {
  useApiClient() // Set up token access
  return <YourApp />
}
```

### Step 8: Create Protected Routes

Copy `templates/frontend/components/ProtectedRoute.tsx`.

Use to wrap authenticated pages:
```typescript
<ProtectedRoute>
  <Dashboard />
</ProtectedRoute>
```

### Step 9: Create API Routes

Copy `templates/backend/routes/api.ts` as a reference.

Pattern for all routes:
1. Apply CORS first
2. Apply auth middleware to protected routes
3. Extract user ID from JWT payload
4. Access D1/KV/R2 via env bindings
5. Return typed JSON responses

### Step 10: Test Integration

```bash
# Start dev server
npm run dev

# Both frontend and backend run on http://localhost:5173
# API routes: http://localhost:5173/api/*
# Frontend: http://localhost:5173/*
```

## Common Issues and Solutions

### Issue: 401 Unauthorized Errors

**Symptom**: API calls fail with 401 even though user is signed in

**Cause**: API called before Clerk session is loaded

**Fix**: Check `isLoaded` and `isSignedIn` before API calls
```typescript
const { isLoaded, isSignedIn } = useSession()
if (!isLoaded || !isSignedIn) return // Wait for auth
```

See: `references/common-race-conditions.md`

### Issue: CORS Errors

**Symptom**: "No 'Access-Control-Allow-Origin' header" errors

**Causes**:
1. CORS middleware not applied
2. CORS middleware applied after routes (wrong order)
3. Origin not allowed in production

**Fix**:
```typescript
// Apply BEFORE routes
app.use('/api/*', cors())
app.post('/api/data', handler)
```

For production, update `corsProdMiddleware` with your domain.

### Issue: Environment Variables Not Working

**Symptom**: Variables are `undefined` in frontend or backend

**Frontend Fix**:
- Variables MUST start with `VITE_`
- Must be in `.env` file (not `.dev.vars`)
- Access: `import.meta.env.VITE_NAME`

**Backend Fix**:
- Variables in `.dev.vars` for local dev
- Use `wrangler secret put NAME` for production
- Access: `env.NAME`

### Issue: D1 Queries Fail

**Symptom**: Database queries throw errors

**Causes**:
1. Binding not configured in wrangler.jsonc
2. SQL syntax errors
3. Not using parameterized queries

**Fix**:
```typescript
// ✅ CORRECT: Parameterized query
await env.DB.prepare('SELECT * FROM users WHERE id = ?')
  .bind(userId)
  .run()

// ❌ WRONG: SQL injection risk
await env.DB.prepare(`SELECT * FROM users WHERE id = ${userId}`).run()
```

### Issue: Token Not Attached to Requests

**Symptom**: Backend receives requests without Authorization header

**Cause**: Not using `apiClient` or not calling `useApiClient()` hook

**Fix**:
1. Call `useApiClient()` in App component
2. Use `apiClient.get()` instead of raw `fetch()`

```typescript
// In App.tsx
import { useApiClient } from '@/lib/api-client'
function App() {
  useApiClient() // MUST call this
  return <YourApp />
}

// In components
import { apiClient } from '@/lib/api-client'
const data = await apiClient.get('/api/data')
```

## Integration Checklist

Before deployment, verify:

**Frontend**:
- [ ] `useApiClient()` called in App component
- [ ] All protected pages wrapped in `<ProtectedRoute>`
- [ ] Check `isLoaded` befor