# Vercel Proxy Deployment via GitHub Import

Use this approach when:
- User is on mobile (WeChat) and CANNOT run CLI commands
- Cloudflare Workers deployed but `workers.dev` blocked from China
- Need a phone-friendly deployment flow

## Overview

```
Server (API) → GitHub repo (code) → User's phone (Vercel import) → Vercel deploys → Proxy URL
```

The proxy URL is on `*.vercel.app` which IS accessible from China.

## Step 1: Push proxy code to GitHub repo

Use GitHub REST API (works when git protocol is blocked):

```python
import requests, json, base64

headers = {
    "Authorization": "Bearer <github_token>",
    "Accept": "application/vnd.github.v3+json"
}

# File 1: vercel.json
vercel_config = json.dumps({
    "functions": {"api/proxy.js": {"runtime": "@vercel/node@3"}}
})
requests.put(
    "https://api.github.com/repos/<owner>/<repo>/contents/vercel.json",
    headers=headers,
    json={"message": "Add Vercel config", "content": base64.b64encode(vercel_config.encode()).decode()}
)
```

**Important:** Push TWO files:
1. `vercel.json` — tells Vercel this is a Node.js serverless function
2. `api/proxy.js` — the actual proxy function

## Step 2: Phone-friendly proxy code for Vercel

```javascript
// api/proxy.js
export default async function handler(req, res) {
  const { url } = req.query;
  if (!url) return res.status(200).send("OK");
  if (!url.includes("mp.weixin.qq.com")) return res.status(403).send("blocked");

  const targetUrl = Array.isArray(url) ? url[0] : url;
  try {
    const fetchHeaders = {};
    if (req.headers["user-agent"]) fetchHeaders["User-Agent"] = req.headers["user-agent"];
    if (req.headers.cookie) fetchHeaders["Cookie"] = req.headers.cookie;

    const resp = await fetch(targetUrl, { method: req.method, headers: fetchHeaders });
    const body = await resp.text();
    res.status(resp.status).setHeader("Content-Type", "application/json; charset=utf-8");
    res.send(body);
  } catch (e) {
    res.status(502).send("proxy error: " + e.message);
  }
}
```

**Key difference from CF Worker version:** Vercel uses `req.query.url` (Express-style) rather than `new URL(request.url).searchParams`. Also `url` might be an array if multiple query params with same name.

## Step 3: User imports to Vercel

User does this on their phone (all in browser):

1. Go to [vercel.com/new](https://vercel.com/new)
2. "Import Git Repository" → select the GitHub repo
3. Click "Deploy"
4. Gets URL like `https://wechat-proxy-xxx.vercel.app`

## Step 4: Test the proxy

```bash
# Health check
curl https://wechat-proxy-xxx.vercel.app

# Test with WeChat
curl "https://wechat-proxy-xxx.vercel.app/api/proxy?url=https://mp.weixin.qq.com/"
```

## Step 5: Configure we-mp-rss

```bash
# /etc/systemd/system/we-mp-rss.service — add:
Environment=PROXY_ENABLED=True
Environment=PROXY_DENO_URL=https://wechat-proxy-xxx.vercel.app/api/proxy

# Restart
sudo systemctl restart we-mp-rss
```

Note: the proxy URL must include `/api/proxy` path since Vercel routes functions under `/api/`.

## GitHub PAT Pitfalls

**Fine-grained PAT:** Created from github.com/settings/tokens?type=beta. These tokens have granular permissions that default to **no access**. Must explicitly grant:
- `Contents: Read and write` (for pushing files)
- `Administration: Read and write` (for creating repos)
- Resource owner: your account
- Repository access: "All repositories" or specific repo

**Classic PAT:** Created from github.com/settings/tokens (without `?type=beta`). These are broader — just check `repo` scope. Preferred for quick automation tasks.

**Error messages:**
- `"Resource not accessible by personal access token"` → missing Contents permission
- `"Bad credentials"` → expired or malformed token