| import Fastify, { LogController, type FastifyInstance } from 'fastify'; |
| import rateLimit from '@fastify/rate-limit'; |
| import fastifyStatic from '@fastify/static'; |
| import { access, stat } from 'node:fs/promises'; |
| import { resolve, sep } from 'node:path'; |
| import { posix } from 'node:path'; |
| import { ApiErrorSchema, CatalogSchema, RunRequestSchema, RunResultSchema } from '@her2/shared'; |
| import { buildCatalog, CLAUDE_MODEL } from './evidence.js'; |
| import { ApiFailure } from './errors.js'; |
| import { runReview, type RunOptions } from './run.js'; |
| import { registerResearchRoutes } from './research-routes.js'; |
| import { registerChatRoutes } from './chat-routes.js'; |
| import { registerTeamRoutes } from './team-routes.js'; |
| import { registerModelRoutes } from './models-routes.js'; |
| import { liveRetrievalEnabled, registerLiveRoutes, sharedLiveRetriever } from './live-routes.js'; |
| import type { ChatOptions } from './chat.js'; |
| import type { McpInferenceOptions } from './model-mcp.js'; |
|
|
| export interface AppOptions extends RunOptions, ChatOptions { |
| inference?: McpInferenceOptions; |
| staticRoot?: string; |
| rateLimitMax?: number; |
| rateLimitWindowMs?: number; |
| } |
| function errorBody(code: string, message: string) { return ApiErrorSchema.parse({ error: { code, message } }); } |
| function apiPath(url: string) { |
| let path: string; |
| try { path = posix.normalize(decodeURIComponent(url.split('?')[0] ?? '/').replaceAll('\\', '/')); } catch { return true; } |
| return path === '/api' || path.startsWith('/api/'); |
| } |
|
|
| export async function createApp(options: AppOptions = {}): Promise<FastifyInstance> { |
| const app = Fastify({ logger: false, logController: new LogController({ disableRequestLogging: true }), bodyLimit: 16_384, requestTimeout: 65_000, trustProxy: false }); |
| const configured = Boolean(options.claude?.apiKey?.trim()); |
| app.addHook('onSend', async (_request, reply, payload) => { |
| reply.header('cache-control', 'no-store'); |
| reply.header('x-content-type-options', 'nosniff'); |
| reply.header('referrer-policy', 'no-referrer'); |
| return payload; |
| }); |
| await app.register(rateLimit, { |
| global: true, max: Math.min(30, Math.max(1, options.rateLimitMax ?? 30)), |
| timeWindow: Math.min(60_000, Math.max(1, options.rateLimitWindowMs ?? 60_000)), |
| errorResponseBuilder: () => Object.assign(new Error('Rate limit exceeded.'), { statusCode: 429 }) |
| }); |
| app.setErrorHandler((error, _request, reply) => { |
| |
| if (error instanceof ApiFailure) return reply.code(error.status).send(errorBody(error.code, error.message)); |
| const code = error && typeof error === 'object' && 'code' in error ? error.code : undefined; |
| const status = error && typeof error === 'object' && 'statusCode' in error ? error.statusCode : undefined; |
| if (code === 'FST_ERR_CTP_BODY_TOO_LARGE') return reply.code(413).send(errorBody('BODY_TOO_LARGE', 'Request body exceeds the allowed size.')); |
| if (status === 429) return reply.code(429).send(errorBody('RATE_LIMITED', 'Request rate limit exceeded. Try again later.')); |
| if (status === 415) return reply.code(415).send(errorBody('UNSUPPORTED_MEDIA_TYPE', 'Use application/json for API requests.')); |
| if (status === 400) return reply.code(400).send(errorBody('INVALID_REQUEST', 'Malformed JSON or invalid request.')); |
| return reply.code(500).send(errorBody('INTERNAL_ERROR', 'The request could not be completed safely. No clinical result was produced.')); |
| }); |
| app.setNotFoundHandler((_request, reply) => reply.code(404).send(errorBody('NOT_FOUND', 'Route not found.'))); |
| app.get('/api/health', async () => ({ status: 'ok', claude_configured: configured, model: CLAUDE_MODEL })); |
| app.get('/api/catalog', async () => CatalogSchema.parse(buildCatalog(configured))); |
| app.post('/api/runs', async (request, reply) => { |
| const parsed = RunRequestSchema.safeParse(request.body); |
| if (!parsed.success) throw new ApiFailure('INVALID_REQUEST', 400); |
| const result = await runReview(parsed.data, options); |
| RunResultSchema.parse(result); |
| return reply.code(200).send(result); |
| }); |
|
|
| const live = options.live !== undefined ? options.live : liveRetrievalEnabled() ? sharedLiveRetriever() : null; |
| registerResearchRoutes(app, options); |
| registerChatRoutes(app, { ...options, live }); |
| registerTeamRoutes(app, { ...options, live }); |
| registerModelRoutes(app, options.inference); |
| registerLiveRoutes(app, { enabled: Boolean(live), ...(live ? { retriever: live } : {}) }); |
|
|
| if (options.staticRoot) { |
| const root = resolve(options.staticRoot); |
| let exists = false; |
| try { await access(resolve(root, 'index.html')); exists = true; } catch { } |
| if (exists) { |
| |
| |
| await app.register(fastifyStatic, { root, serve: false }); |
| app.get('/*', async (request, reply) => { |
| if (apiPath(request.url)) return reply.code(404).send(errorBody('NOT_FOUND', 'API route not found.')); |
| let decoded: string; |
| try { decoded = decodeURIComponent(request.url.split('?')[0] ?? '/'); } catch { return reply.code(400).send(errorBody('INVALID_REQUEST', 'Invalid path.')); } |
| const target = resolve(root, `.${decoded}`); |
| if (!target.startsWith(`${root}${sep}`) && target !== root) return reply.code(404).send(errorBody('NOT_FOUND', 'Route not found.')); |
| let fileExists = false; |
| try { fileExists = (await stat(target)).isFile(); } catch { } |
| if (fileExists) return reply.sendFile(decoded.replace(/^\/+/, '')); |
| if (decoded.startsWith('/assets/') || decoded.includes('.')) return reply.code(404).send(errorBody('NOT_FOUND', 'File not found.')); |
| return reply.sendFile('index.html'); |
| }); |
| } |
| } |
| await app.ready(); |
| return app; |
| } |
|
|
