fix: CF Worker must re-POST body on X's api.twitter.com→api.x.com redirect

Root cause: X redirects OAuth-signed POST /oauth/access_token from
api.twitter.com to api.x.com (confirmed by domain=.x.com in error
response cookies vs domain=.twitter.com for unauthenticated requests).
CF Worker redirect:"follow" converts POST→GET per fetch spec, losing the
OAuth-signed body → X receives unsigned GET → returns 500 HTML.

Fix (cloudflare-proxy-setup.py): buffer the request body as ArrayBuffer,
use redirect:"manual", then manually follow 3xx hops re-POSTing the same
body (up to 5 hops). This preserves method + OAuth signature on redirect.

Also add /app/redeploy-cf-worker endpoint to health-server.js: forces
Worker redeploy without a full Space restart by unsetting CLOUDFLARE_PROXY_URL
from subprocess env (bypassing the setup script's short-circuit check).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cloudflare-proxy-setup.py

@@ -147,19 +147,36 @@ async function handleRequest(request) {{
   headers.delete("x-target-host");
   headers.delete("x-proxy-key");
 
-  // Use redirect:"manual" so POST bodies are NOT silently dropped when X
-  // returns a 3xx (fetch spec converts POST→GET on 301/302 redirect, losing
-  // the OAuth-signed body and causing a signature mismatch → 500 from X).
-  // The Node.js client receives the raw 3xx and handles it with body intact.
-  const proxiedRequest = new Request(targetUrl, {{
+  // Buffer the entire request body so we can replay it on redirects.
+  // X redirects api.twitter.com/oauth/access_token → api.x.com with a 3xx.
+  // The default redirect:"follow" converts POST→GET (loses OAuth body → 500).
+  // redirect:"manual" returns a 3xx the Node.js client can't handle.
+  // Solution: buffer body, intercept 3xx manually, re-POST with same body.
+  let bodyBuffer = null;
+  if (request.body) {{
+    try {{ bodyBuffer = await request.arrayBuffer(); }} catch(_) {{}}
+  }}
+
+  const makeReq = (url) => new Request(url, {{
     method: request.method,
     headers,
-    body: request.body,
+    body: bodyBuffer,
     redirect: "manual",
   }});
 
   try {{
-    return await fetch(proxiedRequest);
+    let response = await fetch(makeReq(targetUrl));
+    let hops = 0;
+    // Follow 3xx redirects preserving method + body (max 5 hops).
+    while (hops < 5 && (response.status === 301 || response.status === 302 ||
+                         response.status === 307 || response.status === 308)) {{
+      const location = response.headers.get("location");
+      if (!location) break;
+      hops++;
+      const next = new URL(location, targetUrl).toString();
+      response = await fetch(makeReq(next));
+    }}
+    return response;
   }} catch (error) {{
     return new Response(`Proxy Error: ${{error.message}}`, {{ status: 502 }});
   }}

health-server.js

@@ -1775,6 +1775,35 @@ const server = http.createServer((req, res) => {
     return;
   }
 
+  // ── /app/redeploy-cf-worker — force Cloudflare Worker redeploy ───────────
+  // Strips CLOUDFLARE_PROXY_URL from subprocess env so the setup script
+  // bypasses the short-circuit and deploys the updated Worker template.
+  if (pathname === "/app/redeploy-cf-worker") {
+    const { execFile } = require("child_process");
+    const subEnv = { ...process.env };
+    delete subEnv.CLOUDFLARE_PROXY_URL;
+    delete subEnv.CLOUDFLARE_PROXY_SECRET;
+    execFile("python3", ["/opt/postiz-sync.py", "--version"], { env: subEnv }, () => {}); // no-op warm-up
+    execFile("python3", ["/opt/cloudflare-proxy-setup.py"], { env: subEnv, timeout: 60000 },
+      (err, stdout, stderr) => {
+        const lines = [
+          "Redeploying Cloudflare Worker with updated template...",
+          "",
+          "=== stdout ===",
+          stdout || "(empty)",
+          "=== stderr ===",
+          stderr || "(empty)",
+          err ? "=== exec error ===\n" + err.message : "=== done ===",
+          "",
+          "Worker updated. Try connecting X now.",
+        ];
+        res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
+        res.end(lines.join("\n"));
+      }
+    );
+    return;
+  }
+
   // ── /app/test-twitter — raw connectivity probe to api.twitter.com ────────
   if (pathname === "/app/test-twitter") {
     const https = require("https");