Previews (pr-<N>-g1t.syntaqx.workers.dev) run against production's data. Cloudflare Access now stands in front of them, with the g1t staff policy (Worker → Access, previews only).
This is the second lock, in the Worker: a request to any *.workers.dev address must carry Access's Cf-Access-Jwt-Assertion token, signed by the team's keys (syntaqx.cloudflareaccess.com), issued by that team, unexpired, and made for the previews' application (its AUD tag, in PREVIEW_ACCESS_AUD). Anything else gets a 403, so a preview stays shut if Access is ever switched off. Without the settings, every preview request is refused.
g1t.sh and the other custom domains never reach the check. The production workers.dev address is turned off, and is refused here too.
apps/web/app/lib/preview-access.ts: the check. The team's keys are kept for an hour and fetched again for an unknown key id.apps/web/app/lib/preview-access.test.ts: valid tokens, missing ones, wrong audience, wrong issuer, expired, unknown key, a changed body, no settings.apps/web/workers/app.ts: runs it before the site.apps/web/wrangler.jsonc: the team and AUD vars.
Checked: the tests, the type check and the web build with its load and deploy checks. Signed out, a preview now redirects to Access's sign-in (302).