Port our electric sql proxy to cloudflare

.github/workflows/deploy-production.yml

@@ -448,6 +448,36 @@ jobs:
           FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
         run: flyctl deploy . --config fly.toml --remote-only
 
+  deploy-electric-proxy:
+    name: Deploy Electric Proxy to Cloudflare
+    runs-on: ubuntu-latest
+    environment: production
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.3
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+
+      - name: Install dependencies
+        run: bun install --frozen
+
+      - name: Deploy Worker
+        working-directory: apps/electric-proxy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: bunx wrangler deploy
+
   deploy-docs:
     name: Deploy Docs to Vercel
     runs-on: ubuntu-latest

.superset/lib/setup/steps.sh

@@ -422,7 +422,7 @@ step_write_env() {
     # Offsets: +0 web, +1 api, +2 marketing, +3 admin, +4 docs,
     #          +5 desktop vite, +6 notifications, +7 streams, +8 streams internal, +9 electric,
     #          +10 caddy (HTTP/2 reverse proxy for API electric endpoint), +11 code inspector,
-    #          +12 desktop automation (CDP)
+    #          +12 desktop automation (CDP), +13 wrangler (electric-proxy worker)
     local BASE=$SUPERSET_PORT_BASE
 
     # App ports (fixed offsets from base)
@@ -439,6 +439,7 @@ step_write_env() {
     local CADDY_ELECTRIC_PORT=$((BASE + 10))
     local CODE_INSPECTOR_PORT=$((BASE + 11))
     local DESKTOP_AUTOMATION_PORT=$((BASE + 12))
+    local WRANGLER_PORT=$((BASE + 13))
 
     echo ""
     echo "# Workspace Ports (allocated from SUPERSET_PORT_BASE=$BASE, range=20)"
@@ -456,6 +457,7 @@ step_write_env() {
     write_env_var "CADDY_ELECTRIC_PORT" "$CADDY_ELECTRIC_PORT"
     write_env_var "CODE_INSPECTOR_PORT" "$CODE_INSPECTOR_PORT"
     write_env_var "DESKTOP_AUTOMATION_PORT" "$DESKTOP_AUTOMATION_PORT"
+    write_env_var "WRANGLER_PORT" "$WRANGLER_PORT"
     echo ""
     echo "# Cross-app URLs (overrides from root .env)"
     write_env_var "NEXT_PUBLIC_API_URL" "http://localhost:$API_PORT"
@@ -510,12 +512,21 @@ step_write_env() {
     { "port": $STREAMS_INTERNAL_PORT, "label": "Streams Internal" },
     { "port": $ELECTRIC_PORT, "label": "Electric" },
     { "port": $CADDY_ELECTRIC_PORT, "label": "Caddy Electric" },
-    { "port": $CODE_INSPECTOR_PORT, "label": "Code Inspector" }
+    { "port": $CODE_INSPECTOR_PORT, "label": "Code Inspector" },
+    { "port": $WRANGLER_PORT, "label": "Electric Proxy (Wrangler)" }
   ]
 }
 PORTSJSON
   success "Port name mapping written to .superset/ports.json"
 
+  cat > apps/electric-proxy/.dev.vars <<DEVVARS
+AUTH_URL=http://localhost:$API_PORT
+ELECTRIC_CLOUD_URL=${ELECTRIC_CLOUD_URL:-https://api.electric-sql.cloud}
+ELECTRIC_SOURCE_ID=${ELECTRIC_SOURCE_ID:-}
+ELECTRIC_SOURCE_SECRET=${ELECTRIC_SOURCE_SECRET:-}
+DEVVARS
+  success "Electric proxy .dev.vars written"
+
   return 0
 }
 

apps/api/src/app/api/electric/[...path]/route.ts

@@ -3,45 +3,50 @@ import { auth } from "@superset/auth/server";
 import { env } from "@/env";
 import { buildWhereClause } from "./utils";
 
+interface AuthInfo {
+	userId: string;
+	organizationIds: string[];
+}
+
+async function authenticate(request: Request): Promise<AuthInfo | null> {
+	const bearer = request.headers.get("Authorization");
+	if (bearer?.startsWith("Bearer ")) {
+		const token = bearer.slice(7);
+		try {
+			const { payload } = await auth.api.verifyJWT({ body: { token } });
+			if (payload?.sub && Array.isArray(payload.organizationIds)) {
+				return {
+					userId: payload.sub,
+					organizationIds: payload.organizationIds as string[],
+				};
+			}
+		} catch {}
+	}
+
+	const sessionData = await auth.api.getSession({ headers: request.headers });
+	if (!sessionData?.user) return null;
+	return {
+		userId: sessionData.user.id,
+		organizationIds: sessionData.session.organizationIds ?? [],
+	};
+}
+
 export async function GET(request: Request): Promise<Response> {
-	const sessionData = await auth.api.getSession({
-		headers: request.headers,
-	});
-	if (!sessionData?.user) {
+	const authInfo = await authenticate(request);
+	if (!authInfo) {
 		return new Response("Unauthorized", { status: 401 });
 	}
 
 	const url = new URL(request.url);
 
-	// Use client-sent organizationId, falling back to session for older clients.
-	// TODO(2026-02-26): Remove activeOrganizationId fallback once all clients send organizationId param.
-	const organizationId =
-		url.searchParams.get("organizationId") ??
-		sessionData.session.activeOrganizationId;
-	const allowedOrgIds = sessionData.session.organizationIds ?? [];
+	const organizationId = url.searchParams.get("organizationId");
 
-	if (organizationId && !allowedOrgIds.includes(organizationId)) {
+	if (organizationId && !authInfo.organizationIds.includes(organizationId)) {
 		return new Response("Not a member of this organization", { status: 403 });
 	}
 
-	const useCloud =
-		env.ELECTRIC_SOURCE_ID &&
-		env.ELECTRIC_SOURCE_SECRET &&
-		(request.headers.get("x-electric-backend") === "cloud" ||
-			sessionData.user.email?.endsWith("@superset.sh"));
-
-	const originUrl = useCloud
-		? new URL("/v1/shape", "https://api.electric-sql.cloud")
-		: new URL(env.ELECTRIC_URL);
-
-	if (useCloud) {
-		// biome-ignore lint/style/noNonNullAssertion: guarded by useCloud check above
-		originUrl.searchParams.set("source_id", env.ELECTRIC_SOURCE_ID!);
-		// biome-ignore lint/style/noNonNullAssertion: guarded by useCloud check above
-		originUrl.searchParams.set("secret", env.ELECTRIC_SOURCE_SECRET!);
-	} else {
-		originUrl.searchParams.set("secret", env.ELECTRIC_SECRET);
-	}
+	const originUrl = new URL(env.ELECTRIC_URL);
+	originUrl.searchParams.set("secret", env.ELECTRIC_SECRET);
 
 	url.searchParams.forEach((value, key) => {
 		if (ELECTRIC_PROTOCOL_QUERY_PARAMS.includes(key)) {
@@ -57,7 +62,7 @@ export async function GET(request: Request): Promise<Response> {
 	const whereClause = await buildWhereClause(
 		tableName,
 		organizationId ?? "",
-		sessionData.user.id,
+		authInfo.userId,
 	);
 	if (!whereClause) {
 		return new Response(`Unknown table: ${tableName}`, { status: 400 });
@@ -86,8 +91,6 @@ export async function GET(request: Request): Promise<Response> {
 	const response = await fetch(originUrl.toString());
 
 	const headers = new Headers(response.headers);
-	headers.append("Vary", "Authorization, X-Electric-Backend");
-
 	if (headers.get("content-encoding")) {
 		headers.delete("content-encoding");
 		headers.delete("content-length");

apps/desktop/electron.vite.config.ts

@@ -167,7 +167,7 @@ export default defineConfig({
 			),
 			"process.env.NEXT_PUBLIC_ELECTRIC_URL": defineEnv(
 				process.env.NEXT_PUBLIC_ELECTRIC_URL,
-				"https://api.superset.sh/api/electric",
+				"https://electric-proxy.avi-6ac.workers.dev",
 			),
 			"process.env.NEXT_PUBLIC_DOCS_URL": defineEnv(
 				process.env.NEXT_PUBLIC_DOCS_URL,

apps/desktop/src/main/env.main.ts

@@ -18,7 +18,7 @@ export const env = createEnv({
 		NEXT_PUBLIC_STREAMS_URL: z.url().default("https://streams.superset.sh"),
 		NEXT_PUBLIC_ELECTRIC_URL: z
 			.url()
-			.default("https://api.superset.sh/api/electric"),
+			.default("https://electric-proxy.avi-6ac.workers.dev"),
 		NEXT_PUBLIC_WEB_URL: z.url().default("https://app.superset.sh"),
 		NEXT_PUBLIC_POSTHOG_KEY: z.string().optional(),
 		NEXT_PUBLIC_POSTHOG_HOST: z.string().default("https://us.i.posthog.com"),

apps/desktop/src/renderer/env.renderer.ts

@@ -19,7 +19,7 @@ const envSchema = z.object({
 	NEXT_PUBLIC_WEB_URL: z.url().default("https://app.superset.sh"),
 	NEXT_PUBLIC_ELECTRIC_URL: z
 		.url()
-		.default("https://api.superset.sh/api/electric"),
+		.default("https://electric-proxy.avi-6ac.workers.dev"),
 	NEXT_PUBLIC_POSTHOG_KEY: z.string().optional(),
 	NEXT_PUBLIC_POSTHOG_HOST: z.string().default("https://us.i.posthog.com"),
 	SENTRY_DSN_DESKTOP: z.string().optional(),

apps/desktop/src/renderer/lib/auth-client.ts

@@ -3,6 +3,7 @@ import type { auth } from "@superset/auth/server";
 import {
 	apiKeyClient,
 	customSessionClient,
+	jwtClient,
 	organizationClient,
 } from "better-auth/client/plugins";
 import { createAuthClient } from "better-auth/react";
@@ -18,6 +19,16 @@ export function getAuthToken(): string | null {
 	return authToken;
 }
 
+let jwt: string | null = null;
+
+export function setJwt(token: string | null) {
+	jwt = token;
+}
+
+export function getJwt(): string | null {
+	return jwt;
+}
+
 /**
  * Better Auth client for Electron desktop app.
  *
@@ -31,6 +42,7 @@ export const authClient = createAuthClient({
 		customSessionClient<typeof auth>(),
 		stripeClient({ subscription: true }),
 		apiKeyClient(),
+		jwtClient(),
 	],
 	fetchOptions: {
 		credentials: "include",
@@ -40,5 +52,11 @@ export const authClient = createAuthClient({
 				context.headers.set("Authorization", `Bearer ${token}`);
 			}
 		},
+		onResponse: async (context) => {
+			const token = context.response.headers.get("set-auth-jwt");
+			if (token) {
+				setJwt(token);
+			}
+		},
 	},
 });

apps/desktop/src/renderer/providers/AuthProvider/AuthProvider.tsx

@@ -1,5 +1,5 @@
 import { type ReactNode, useEffect, useState } from "react";
-import { authClient, setAuthToken } from "renderer/lib/auth-client";
+import { authClient, setAuthToken, setJwt } from "renderer/lib/auth-client";
 import { SupersetLogo } from "renderer/routes/sign-in/components/SupersetLogo/SupersetLogo";
 import { electronTrpc } from "../../lib/electron-trpc";
 
@@ -31,6 +31,17 @@ export function AuthProvider({ children }: { children: ReactNode }) {
 							err,
 						);
 					}
+					try {
+						const res = await authClient.token();
+						if (res.data?.token) {
+							setJwt(res.data.token);
+						}
+					} catch (err) {
+						console.warn(
+							"[AuthProvider] JWT fetch failed during hydration",
+							err,
+						);
+					}
 				}
 			}
 			if (!cancelled) {
@@ -61,6 +72,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
 				setIsHydrated(true);
 			} else if (data === null) {
 				setAuthToken(null);
+				setJwt(null);
 				try {
 					await refetchSession();
 				} catch (err) {
@@ -73,6 +85,26 @@ export function AuthProvider({ children }: { children: ReactNode }) {
 		},
 	});
 
+	useEffect(() => {
+		if (!isHydrated) return;
+
+		const refreshJwt = () =>
+			authClient
+				.token()
+				.then((res) => {
+					if (res.data?.token) {
+						setJwt(res.data.token);
+					}
+				})
+				.catch((err: unknown) => {
+					console.warn("[AuthProvider] JWT refresh failed", err);
+				});
+
+		refreshJwt();
+		const interval = setInterval(refreshJwt, 50 * 60 * 1000);
+		return () => clearInterval(interval);
+	}, [isHydrated]);
+
 	if (!isHydrated) {
 		return (
 			<div className="flex h-screen w-screen items-center justify-center bg-background">

apps/desktop/src/renderer/routes/_authenticated/providers/CollectionsProvider/CollectionsProvider.test.tsx

@@ -2,9 +2,14 @@ import { afterEach, beforeEach, describe, expect, it, mock } from "bun:test";
 
 const preloadCollectionsMock = mock(() => Promise.resolve());
 
+mock.module("posthog-js/react", () => ({
+	useFeatureFlagEnabled: mock(() => false),
+}));
+
 mock.module("./collections", () => ({
 	getCollections: mock(() => ({})),
 	preloadCollections: preloadCollectionsMock,
+	setElectricUrl: mock(),
 }));
 
 const { preloadActiveOrganizationCollections } = await import(

apps/desktop/src/renderer/routes/_authenticated/providers/CollectionsProvider/CollectionsProvider.tsx

@@ -1,3 +1,5 @@
+import { FEATURE_FLAGS } from "@superset/shared/constants";
+import { useFeatureFlagEnabled } from "posthog-js/react";
 import {
 	createContext,
 	type ReactNode,
@@ -10,7 +12,11 @@ import {
 import { env } from "renderer/env.renderer";
 import { authClient } from "renderer/lib/auth-client";
 import { MOCK_ORG_ID } from "shared/constants";
-import { getCollections, preloadCollections } from "./collections";
+import {
+	getCollections,
+	preloadCollections,
+	setElectricUrl,
+} from "./collections";
 
 type CollectionsContextType = ReturnType<typeof getCollections> & {
 	switchOrganization: (organizationId: string) => Promise<void>;
@@ -34,9 +40,16 @@ export function preloadActiveOrganizationCollections(
 
 export function CollectionsProvider({ children }: { children: ReactNode }) {
 	const { data: session, refetch: refetchSession } = authClient.useSession();
+	const useElectricCloud = useFeatureFlagEnabled(FEATURE_FLAGS.ELECTRIC_CLOUD);
 	const activeOrganizationId = env.SKIP_ENV_VALIDATION
 		? MOCK_ORG_ID
 		: session?.session?.activeOrganizationId;
+
+	useEffect(() => {
+		if (useElectricCloud) {
+			setElectricUrl(env.NEXT_PUBLIC_ELECTRIC_URL);
+		}
+	}, [useElectricCloud]);
 	const [isSwitching, setIsSwitching] = useState(false);
 
 	const switchOrganization = useCallback(