Spaces:
Sleeping
Sleeping
| /** | |
| * HTTP Security Middleware | |
| * CORS allow-list, admin token gate, Firebase ID token verification and rate limiting. | |
| * All behavior is driven by environment variables so deployments opt in explicitly. | |
| */ | |
| import crypto from "crypto"; | |
| import type { NextFunction, Request, Response } from "express"; | |
| import type { CorsOptions } from "cors"; | |
| import rateLimit from "express-rate-limit"; | |
| import { createRemoteJWKSet, jwtVerify } from "jose"; | |
| const FIREBASE_JWKS_URL = new URL( | |
| "https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com" | |
| ); | |
| export const CORS_ALLOWED_HEADERS = [ | |
| "Content-Type", | |
| "Authorization", | |
| "X-Admin-Token", | |
| "X-LLM-API-Key", | |
| "X-LLM-Provider", | |
| "X-Unsloth-Key", | |
| "X-HF-Token", | |
| "X-GNews-Key", | |
| "X-AGNews-Key", | |
| "X-NewsAPI-Key", | |
| ]; | |
| export function parseAllowedOrigins(raw: string | undefined): string[] { | |
| return (raw || "") | |
| .split(",") | |
| .map((o) => o.trim().replace(/\/$/, "")) | |
| .filter(Boolean); | |
| } | |
| /** | |
| * Cross-origin access is denied unless the origin is listed in ALLOWED_ORIGINS. | |
| * Same-origin requests (the bundled web UI) never need CORS headers. | |
| */ | |
| export function buildCorsOptions(allowedOrigins: string[]): CorsOptions { | |
| return { | |
| origin: (origin, callback) => { | |
| if (!origin) return callback(null, false); | |
| callback(null, allowedOrigins.includes("*") || allowedOrigins.includes(origin)); | |
| }, | |
| methods: ["GET", "POST", "OPTIONS"], | |
| allowedHeaders: CORS_ALLOWED_HEADERS, | |
| }; | |
| } | |
| export function safeEqual(a: string, b: string): boolean { | |
| const bufA = Buffer.from(a); | |
| const bufB = Buffer.from(b); | |
| if (bufA.length !== bufB.length) return false; | |
| return crypto.timingSafeEqual(bufA, bufB); | |
| } | |
| /** | |
| * Gates administrative endpoints behind ADMIN_TOKEN (sent as `X-Admin-Token`). | |
| * When ADMIN_TOKEN is unset the endpoints are disabled entirely. | |
| */ | |
| export function requireAdmin(adminToken: string | undefined) { | |
| const expected = (adminToken || "").trim(); | |
| return (req: Request, res: Response, next: NextFunction) => { | |
| if (!expected) { | |
| res.status(403).json({ | |
| error: "Admin endpoints are disabled. Set the ADMIN_TOKEN environment variable on the server to enable them.", | |
| }); | |
| return; | |
| } | |
| const provided = String(req.headers["x-admin-token"] || "").trim(); | |
| if (!provided || !safeEqual(provided, expected)) { | |
| res.status(401).json({ error: "Invalid or missing X-Admin-Token header." }); | |
| return; | |
| } | |
| next(); | |
| }; | |
| } | |
| export interface FirebaseAuthConfig { | |
| projectId?: string; | |
| requireAuth: boolean; | |
| } | |
| /** | |
| * Verifies Firebase ID tokens sent as `Authorization: Bearer <token>`. | |
| * - A token that is present but invalid is always rejected. | |
| * - A missing token is rejected only when REQUIRE_AUTH=true. | |
| * - REQUIRE_AUTH=true without FIREBASE_PROJECT_ID fails closed. | |
| */ | |
| export function firebaseAuth(config: FirebaseAuthConfig) { | |
| const projectId = (config.projectId || "").trim(); | |
| const jwks = projectId ? createRemoteJWKSet(FIREBASE_JWKS_URL) : null; | |
| return async (req: Request, res: Response, next: NextFunction) => { | |
| const header = String(req.headers.authorization || ""); | |
| const token = header.startsWith("Bearer ") ? header.slice(7).trim() : ""; | |
| if (!token) { | |
| if (config.requireAuth) { | |
| res.status(401).json({ error: "Authentication required. Sign in to run this request." }); | |
| return; | |
| } | |
| next(); | |
| return; | |
| } | |
| if (!jwks) { | |
| if (config.requireAuth) { | |
| res.status(503).json({ error: "Server misconfigured: REQUIRE_AUTH is set but FIREBASE_PROJECT_ID is missing." }); | |
| return; | |
| } | |
| // Verification is not configured; treat the request as anonymous. | |
| next(); | |
| return; | |
| } | |
| try { | |
| const { payload } = await jwtVerify(token, jwks, { | |
| issuer: `https://securetoken.google.com/${projectId}`, | |
| audience: projectId, | |
| }); | |
| res.locals.userId = payload.sub; | |
| next(); | |
| } catch { | |
| res.status(401).json({ error: "Invalid or expired authentication token." }); | |
| } | |
| }; | |
| } | |
| function readPositiveInt(raw: string | undefined, fallback: number): number { | |
| const num = Number(raw); | |
| return Number.isInteger(num) && num > 0 ? num : fallback; | |
| } | |
| export function buildRateLimiters(env: NodeJS.ProcessEnv) { | |
| const general = rateLimit({ | |
| windowMs: 60 * 1000, | |
| limit: readPositiveInt(env.API_RATE_LIMIT_PER_MINUTE, 120), | |
| standardHeaders: "draft-7", | |
| legacyHeaders: false, | |
| message: { error: "Too many requests. Please slow down." }, | |
| }); | |
| const forecast = rateLimit({ | |
| windowMs: 15 * 60 * 1000, | |
| limit: readPositiveInt(env.FORECAST_RATE_LIMIT_PER_15_MIN, 15), | |
| standardHeaders: "draft-7", | |
| legacyHeaders: false, | |
| message: { error: "Forecast rate limit reached. Please try again in a few minutes." }, | |
| }); | |
| return { general, forecast }; | |
| } | |