Trove

Trove is a web client for Cloudflare R2 buckets their owners already have – Phase 0 of a planned document-management product. Connect with a scoped R2 token, then browse, upload, preview, share, delete and switch storage class. Connected mode only: Trove stores no bytes and no object metadata, just encrypted credentials, share intent and an append-only audit trail in D1.

It talks to R2 over the S3 API with SigV4 signing rather than the Workers R2 binding, because a 100,000-object listing spike showed the binding byte-caps responses and silently truncates folder listings, while the S3 API honours max-keys exactly. Upload bytes never pass through the Worker: it mints short-lived presigned URLs and the browser PUTs straight to R2, going multipart above 100 MiB. The presigning spike caught two latent security bugs before any production code existed – aws4fetch drops content-type and content-length from the signed headers unless told otherwise, which makes an upload link an open file drop, and expires is not a constructor option, so every “15 minute” link silently lived a day.

Smoke tests against live R2 showed bucket-scoped tokens cannot call ListBuckets or read a bucket’s CORS policy, so verification falls back to listing the named bucket, and CORS is proven with a real browser-origin upload rather than inferred from a policy.

The UI has a command palette, keyboard navigation, bulk move and delete, infinite scroll, a WCAG 2.2 AA contrast pass and a responsive mobile layout. It runs on Cloudflare Workers at trove.vespra.studio.