Archipelago — open-source initial import

2026-08-12 10:55:50 +00:00
commit b67e1527a2
2068 changed files with 472303 additions and 0 deletions
@@ -0,0 +1,84 @@
+/**
+ * Shared dev server authentication and rate limiting middleware.
+ * Validates Bearer token on all /api/* requests.
+ * Token is auto-generated in scripts/dev.sh and injected via VITE_DEV_API_TOKEN.
+ */
+import type { IncomingMessage, ServerResponse } from 'http'
+
+/** Validate Authorization header. Returns true if authorized, false if rejected (response already sent). */
+export function validateDevAuth(req: IncomingMessage, res: ServerResponse): boolean {
+  const token = process.env.VITE_DEV_API_TOKEN ?? ''
+  if (!token) return true // No token configured, skip auth
+  const auth = req.headers.authorization
+  if (auth === `Bearer ${token}`) return true
+  res.writeHead(401, { 'Content-Type': 'application/json' })
+  res.end(JSON.stringify({ error: 'Unauthorized' }))
+  return false
+}
+
+const ALLOWED_ORIGIN = 'http://localhost:5173'
+
+/** Set CORS headers with explicit localhost origin instead of wildcard. */
+export function setCorsHeaders(res: ServerResponse): void {
+  res.setHeader('Access-Control-Allow-Origin', ALLOWED_ORIGIN)
+}
+
+/** Write CORS preflight response. */
+export function handleCorsOptions(res: ServerResponse): void {
+  res.writeHead(204, {
+    'Access-Control-Allow-Origin': ALLOWED_ORIGIN,
+    'Access-Control-Allow-Methods': 'GET, POST, PUT, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+  })
+  res.end()
+}
+
+// ─── Rate Limiting ──────────────────────────────────────────
+
+const WINDOW_MS = 60_000 // 1 minute window
+const READ_LIMIT = 60 // 60 requests per minute for reads
+const WRITE_LIMIT = 10 // 10 requests per minute for writes
+
+interface RateBucket {
+  count: number
+  resetAt: number
+}
+
+const rateBuckets = new Map<string, RateBucket>()
+
+// Clean up stale buckets every 5 minutes
+setInterval(() => {
+  const now = Date.now()
+  for (const [key, bucket] of rateBuckets) {
+    if (now > bucket.resetAt) rateBuckets.delete(key)
+  }
+}, 5 * 60_000)
+
+function getClientIp(req: IncomingMessage): string {
+  return req.socket.remoteAddress ?? 'unknown'
+}
+
+/**
+ * Check rate limit for a request. Returns true if allowed, false if rejected (response already sent).
+ * @param isWrite - Set to true for write operations (POST/PUT/DELETE) which have a lower limit.
+ */
+export function checkRateLimit(req: IncomingMessage, res: ServerResponse, isWrite = false): boolean {
+  const ip = getClientIp(req)
+  const limit = isWrite ? WRITE_LIMIT : READ_LIMIT
+  const key = `${ip}:${isWrite ? 'w' : 'r'}`
+  const now = Date.now()
+
+  let bucket = rateBuckets.get(key)
+  if (!bucket || now > bucket.resetAt) {
+    bucket = { count: 0, resetAt: now + WINDOW_MS }
+    rateBuckets.set(key, bucket)
+  }
+
+  bucket.count++
+  if (bucket.count > limit) {
+    res.writeHead(429, { 'Content-Type': 'application/json', 'Retry-After': '60' })
+    res.end(JSON.stringify({ error: 'Too many requests' }))
+    return false
+  }
+  return true
+}