This lab provides a ready-to-deploy worker/ directory. Inspect it before making any changes:

ls courses/engagement-platform-labs/labs/lab07-first-worker/worker/
# worker/
# ├── package.json
# ├── wrangler.toml
# └── src/
#     └── index.js

The three files are the complete wrangler project. wrangler.toml is the project manifest; src/index.js is the Worker script; package.json pins the local wrangler version used for this lab.

cd courses/engagement-platform-labs/labs/lab07-first-worker/worker
npm install
# added N packages

This installs a locally pinned wrangler 4.x. The operator console also has a globally installed wrangler, but pinning locally keeps every student on the same version regardless of when they run the lab.

Open worker/wrangler.toml. Key sections:

name = "fleet-gateway"
main = "src/index.js"
compatibility_date = "2024-09-23"

routes = [
    { pattern = "api.YOUR_DOMAIN/v1/*",    zone_name = "YOUR_DOMAIN" },
    { pattern = "api.YOUR_DOMAIN/relay/*", zone_name = "YOUR_DOMAIN" }
]

[vars]
ENVIRONMENT = "development"
WORKER_VERSION = "1.0.0"
RELAY_BACKEND = "https://app.YOUR_DOMAIN"

The routes block tells Cloudflare to intercept any request to api.<DOMAIN>/v1/* (and /relay/*) and send it to this Worker instead of passing it through the tunnel. Paths outside those prefixes still flow through the cloudflared origin.

RELAY_BACKEND is the backend hostname for the Lab 13 redirector relay. Both the routes array and RELAY_BACKEND contain YOUR_DOMAIN placeholders. Both must be substituted before deploying. The sed command below handles both occurrences in one pass.

The D1, KV, and R2 binding sections are present but commented out. You will uncomment them in Labs 09 and 10 when those services are provisioned. Do not remove the comments.

Substitute your domain (and the parent zone) in wrangler.toml:

wrangler.toml ships with two distinct placeholders. YOUR_DOMAIN is your slot’s full hostname (e.g., 0b38904c.eplabs.cloud); YOUR_PARENT_ZONE is the actual Cloudflare zone the route binds against. Under the in-class Option A path the parent zone is eplabs.cloud (not your slot — Cloudflare needs the real zone name on the route binding). Under the take-home BYO-domain path they are usually the same value.

# Run from inside worker/
# In-class (Option A): slot under shared eplabs.cloud
sed -i "s/YOUR_DOMAIN/${DOMAIN}/g; s/YOUR_PARENT_ZONE/eplabs.cloud/g" wrangler.toml

# Take-home (BYO): your own zone is both the slot and the parent
# sed -i "s/YOUR_DOMAIN/${DOMAIN}/g; s/YOUR_PARENT_ZONE/${DOMAIN}/g" wrangler.toml

Verify no placeholders remain:

grep -E "YOUR_DOMAIN|YOUR_PARENT_ZONE" wrangler.toml
# Expected: no output (empty)

Verify your domain appears in three places (two route patterns + RELAY_BACKEND):

grep "${DOMAIN}" wrangler.toml
# Expected: three matches

Why the placeholder ships intentionally. wrangler.toml is committed to the repo and contains no credentials. The YOUR_DOMAIN placeholder requires the student to make a conscious substitution rather than deploying to the wrong domain silently. Delivery notes (Section 1.2) document both occurrences.

Open worker/src/index.js and read through the route dispatcher. The structure follows the reference implementation in docs/technical_specifications.md:

• fetch() handles CORS preflight, then delegates to handleRequest().
• handleRequest() dispatches on pathname; each case calls a handler.
• handleHealth() is fully implemented: returns {ok: true, version, timestamp}.
• handleEnroll(), handleDeviceList(), handleCommand() and the other handlers are either stubs returning HTTP 501 (Lab 07 state) or guard against missing bindings. Each handler carries a comment indicating which lab activates it.

The stub and guard pattern is intentional. Later labs extend this file by replacing stubs with real D1, KV, and R2 calls. The route dispatcher does not change; only the handler bodies grow.

The logAudit() utility at the bottom writes to the D1 audit_log table when env.FLEET_DB is bound. In Lab 07, env.FLEET_DB is not bound, so logAudit() returns immediately (the guard at the top of the function handles this). This is why the health endpoint works before Lab 09 sets up D1.

cd courses/engagement-platform-labs/labs/lab07-first-worker/worker
npx wrangler deploy

Expected output:

Total Upload: N kB / gzip: N kB
Uploaded fleet-gateway (N sec)
Published fleet-gateway (N sec)
  https://fleet-gateway.<YOUR_CF_SUBDOMAIN>.workers.dev
  api.<YOUR_DOMAIN>/v1/*
  api.<YOUR_DOMAIN>/relay/*

The custom domain routes are what matter. The workers.dev subdomain also exists but bypasses CF Access (addressed in Lab 08).

If you see a “route already taken” error, another Worker on your account may have a conflicting route. Check the Cloudflare dashboard under Workers & Pages

fleet-gateway > Triggers > Routes and remove any stale route from earlier testing.

curl -s https://api.${DOMAIN}/v1/health | jq .

Expected response:

{
  "ok": true,
  "version": "1.0.0",
  "timestamp": "2024-09-23T10:00:00.000Z"
}

HTTP status must be 200. The timestamp reflects actual wall-clock time.

If the response is a Cloudflare 522 or 524 error, the Worker route may not have propagated yet. Wait 30 seconds and retry.

# Enroll endpoint (requires CF Access JWT or service token in Lab 08+)
curl -s -o /dev/null -w "%{http_code}" \
    -X POST https://api.${DOMAIN}/v1/devices/enroll
# Expected: 401 (auth required — Lab 08 wires the Access JWT path)

# Device list (same)
curl -s -o /dev/null -w "%{http_code}" \
    https://api.${DOMAIN}/v1/devices
# Expected: 401

# Command (any device id)
curl -s -o /dev/null -w "%{http_code}" \
    -X POST https://api.${DOMAIN}/v1/commands/test-device
# Expected: 400 (missing required body fields) or 401 if the auth gate is hit first

HTTP 401/400 here is correct for Lab 07: the Worker is reachable via your custom domain route, the request was dispatched to the right handler, and the handler refused before doing any D1/KV/R2 work. Lab 08 adds the Cloudflare Access service token that turns the 401 into 200/501-equivalent behavior. A 404 means the request fell through to the default case in handleRequest(); check your curl path for typos.

Behavior note. The worker code is the complete Labs 07–14 implementation. Earlier README versions called this section “stub verification” and expected 501; the actual handlers are wired and the auth/binding guards activate first, so 401/400 is what you see in Lab 07 state.

Open a second terminal in the operator console and start tailing:

cd courses/engagement-platform-labs/labs/lab07-first-worker/worker
npx wrangler tail

In your first terminal, curl the health endpoint:

curl -s https://api.${DOMAIN}/v1/health > /dev/null

A log entry should appear in the wrangler tail window within a second or two. This is your primary debugging surface for all Worker development in later labs.

Press Ctrl+C to stop tailing when done.

The cloudflared tunnel from Lab 06 is still running. The Worker now handles all paths matching api.<DOMAIN>/v1/* and api.<DOMAIN>/relay/*. The Cloudflare edge evaluates Worker routes first; any non-matching path falls through to the tunnel’s DNS record.

The Worker is the API surface; the tunnel is the operator escape hatch for direct access to the operator console during development. Both coexist intentionally.