S3 Origin — Unsanitized Before State

PoC only: This origin intentionally returns the unsanitized before state: raw, unsafe synthetic data. In the real flow the S3 capability Worker (hosted at s3.thecompany-lab.com) sanitizes, masks, strips, and re-encrypts these payloads before they reach the client.

Direct hostname: s3-origin.thecompany-lab.com
Capability hostname: s3.thecompany-lab.com

Routes exposed by this origin

Method	Path	Purpose
GET	`/`	This page
POST	`/api/echo`	Echoes received JSON structure (capability proves inbound XSS was sanitized)
GET	`/api/fixture`	Returns unsanitized JSON with XSS, PANs, private IPs, debug objects
GET	`/api/binary?size=<bytes>`	Streams opaque `application/octet-stream` bytes (bypass path)

Fixture field contract

The capability must transform the /api/fixture response as follows:

XSS strings such as user.displayName, user.biography, and user.nested.comment must be sanitized.
payment.primaryPAN (Luhn-valid test PAN 4111111111111111) and audit.deep.pan (5555555555554444) must be masked to ****-****-****-1234 form.
payment.secondaryPAN (4111111111111112) and payment.invalidLuhn must remain unchanged because they are not Luhn-valid.
network.rfc1918Hosts entries (10.0.0.1, 192.168.1.5, 172.16.0.1) must be removed.
network.publicResolver (8.8.8.8) must remain.
Top-level debug, internal, and stack keys must be deleted entirely.

What the capability does for inbound requests

Reads the simulated mTLS identity header (production uses request.cf.tlsClientAuth after API Shield client certificates are enabled).
Decrypts AES-256-GCM fields with the configured kid and AAD.
Sanitizes every string leaf for XSS.
Forwards cleaned JSON to this origin over HTTPS.
On the response, masks Luhn-valid PANs, strips RFC1918 literals, and removes debug/internal objects.

Note: All values are synthetic. No request body is ever logged by this origin.