Spaces:
Sleeping
Sleeping
| import { NextRequest, NextResponse } from "next/server" | |
| import { isAuthenticatedProxy } from "@/lib/auth/proxy" | |
| // ── Sliding-window rate limiter ─────────────────────────────────────────────── | |
| // Guards /api/fetch-url from being hammered as a public CORS proxy. | |
| // On serverless (Vercel) this is best-effort per-instance; on persistent | |
| // hosts (Render) it is reliable across requests. | |
| const store = new Map<string, number[]>() | |
| function isRateLimited(ip: string, path: string): boolean { | |
| const now = Date.now() | |
| const key = `${ip}:${path}` | |
| const hits = (store.get(key) ?? []).filter(t => now - t < 60_000) | |
| if (hits.length >= 30) return true // 30 URL fetches/min per IP | |
| hits.push(now) | |
| store.set(key, hits) | |
| return false | |
| } | |
| export function proxy(req: NextRequest) { | |
| const { pathname } = req.nextUrl | |
| const publicPaths = new Set(["/login", "/api/auth/login", "/api/auth/logout", "/api/auth/status", "/health", "/api-docs"]) | |
| if (publicPaths.has(pathname)) return NextResponse.next() | |
| if (pathname.startsWith("/api/")) { | |
| // API endpoints handle their own deep authentication via requireAuth. | |
| // The proxy only does a light pass to ensure unauthenticated requests | |
| // don't waste downstream resources, but relies on API route handlers | |
| // to correctly reject unauthorized access. | |
| if (!isAuthenticatedProxy(req)) { | |
| return NextResponse.json({ error: "Unauthorized" }, { status: 401, headers: { "Cache-Control": "no-store" } }) | |
| } | |
| } else if (!isAuthenticatedProxy(req)) { | |
| return NextResponse.redirect(new URL("/login", req.url)) | |
| } | |
| if (!pathname.startsWith("/api/fetch-url")) { | |
| return NextResponse.next({ headers: { "Cache-Control": "private, no-store" } }) | |
| } | |
| // Origin check — block requests from other origins. | |
| // Use strict URL parsing rather than substring matching to prevent | |
| // bypasses like https://evil.com?nodepad.space passing the check. | |
| const origin = req.headers.get("origin") ?? "" | |
| const referer = req.headers.get("referer") ?? "" | |
| const host = (req.headers.get("host") ?? "").split(":")[0] // strip port | |
| function strictHostMatch(headerValue: string): boolean { | |
| try { return new URL(headerValue).hostname === host } catch { return false } | |
| } | |
| const isLocalhost = strictHostMatch(origin || referer) | |
| ? ["localhost", "127.0.0.1"].includes(new URL(origin || referer).hostname) | |
| : (origin + referer).includes("localhost") | |
| const isSameOrigin = strictHostMatch(origin) || strictHostMatch(referer) | |
| if (origin && !isLocalhost && !isSameOrigin) { | |
| return new NextResponse(JSON.stringify({ error: "Forbidden" }), { | |
| status: 403, | |
| headers: { "Content-Type": "application/json" }, | |
| }) | |
| } | |
| const ip = req.headers.get("x-forwarded-for")?.split(",")[0].trim() | |
| ?? req.headers.get("x-real-ip") | |
| ?? "unknown" | |
| if (isRateLimited(ip, pathname)) { | |
| return new NextResponse(JSON.stringify({ error: "Rate limit exceeded." }), { | |
| status: 429, | |
| headers: { "Content-Type": "application/json", "Retry-After": "60" }, | |
| }) | |
| } | |
| return NextResponse.next({ headers: { "Cache-Control": "private, no-store" } }) | |
| } | |
| export const config = { | |
| matcher: ["/((?!_next/static|_next/image|icon.svg|favicon.ico|apple-icon.png).*)"], | |
| } | |