Update src/api/admin.py

src/api/admin.py

@@ -372,19 +372,24 @@ const CF_TOKEN = "{cf_token}";
 // Two-path analytics fetch. The backend proxy keeps credentials server-side and
 // is tried first; if the backend cannot reach the Worker (a known limitation on
 // some hosts) we retry directly from this browser, which can.
+// Browser-FIRST: this browser reaches the Worker reliably and fast, whereas the
+// host's own egress to workers.dev is unreliable. The server-side proxy is kept
+// as a fallback for environments where the browser is the restricted one.
 async function cfFetch(path){{
-  try{{
-    const r = await fetch('/admin'+path);
-    const d = await r.json();
-    if(r.ok && !d.detail && !d.error) return {{data:d, via:'backend proxy'}};
-  }}catch(e){{ /* fall through to direct */ }}
-  if(!CF_URL) throw new Error('CLOUDFLARE_WORKER_URL not configured');
-  const h = CF_TOKEN ? {{'Authorization':'Bearer '+CF_TOKEN}} : {{}};
-  const r2 = await fetch(CF_URL+path, {{headers:h}});
+  if(CF_URL){{
+    try{{
+      const h = CF_TOKEN ? {{'Authorization':'Bearer '+CF_TOKEN}} : {{}};
+      const r = await fetch(CF_URL+path, {{headers:h}});
+      const d = await r.json();
+      if(r.ok && !d.error) return {{data:d, via:'direct'}};
+      if(d.error) throw new Error(d.error.message||'Worker error');
+    }}catch(e){{ /* fall through to the backend proxy */ }}
+  }}
+  const r2 = await fetch('/admin'+path);
   const d2 = await r2.json();
-  if(!r2.ok) throw new Error('Worker HTTP '+r2.status+' '+(d2.error&&d2.error.message||''));
-  if(d2.error) throw new Error(d2.error.message||'Worker error');
-  return {{data:d2, via:'direct'}};
+  if(!r2.ok||d2.detail) throw new Error('HTTP '+r2.status+' '+(d2.detail||''));
+  if(d2.error) throw new Error(d2.error.message||JSON.stringify(d2.error));
+  return {{data:d2, via:'backend proxy'}};
 }}
 
 async function loadStats(){{
@@ -721,7 +726,7 @@ async def _worker_get(path: str, params: Optional[dict] = None):
     if settings.cloudflare_worker_token:
         headers["Authorization"] = f"Bearer {settings.cloudflare_worker_token}"
     try:
-        async with _mk(timeout=25) as client:
+        async with _mk(timeout=8) as client:
             r = await client.get(f"{worker}{path}", params=params or {}, headers=headers)
             return r.json()
     except HTTPException:
@@ -779,7 +784,7 @@ async def admin_worker_health(request: Request):
         """One probe, its own short timeout, never raises."""
         entry = {"path": path}
         try:
-            async with _mk(timeout=20) as client:
+            async with _mk(timeout=8) as client:
                 r = await client.get(f"{worker}{path}",
                                      headers=headers if use_auth else {})
             entry["status"] = r.status_code
@@ -797,7 +802,23 @@ async def admin_worker_health(request: Request):
         probe("analytics", "/analytics"),
         probe("schema", "/analytics/schema"),
     )
-    out["ipv4_forced"] = True
+    # Optional write probe: ?test_write=1 posts one marker row so a POST can be
+    # compared against the GETs above. It inserts a row tagged 'healthcheck'.
+    if request.query_params.get("test_write") == "1":
+        entry = {"path": "/log", "method": "POST"}
+        try:
+            async with _mk(timeout=10) as client:
+                r = await client.post(
+                    f"{worker}/log", headers=headers,
+                    json={"question": "healthcheck", "tool": "healthcheck:probe",
+                          "model": "n/a", "response_time": 0, "result_count": 0},
+                )
+            entry["status"] = r.status_code
+            entry["body"] = r.text[:200]
+        except Exception as exc:
+            entry["error_type"] = type(exc).__name__
+            entry["error"] = repr(exc)[:200] or type(exc).__name__
+        out["probes"]["log_write"] = entry
 
     # Interpretation
     if "error_type" in ver and "error_type" in out["probes"]["hours"]: