lyon
545 lines
24 KiB
TypeScript
545 lines
24 KiB
TypeScript
import { randomUUID } from "node:crypto";
|
|
|
|
const CONTRACT_VERSION = "provider-profile-management-v1";
|
|
const DEFAULT_AGENTRUN_MGR_URL = "http://agentrun-mgr.agentrun-v01.svc.cluster.local:8080";
|
|
const AGENTRUN_MANAGER_HOST_PATTERN = /^agentrun-mgr\.[a-z0-9]([-a-z0-9]*[a-z0-9])?\.svc\.cluster\.local$/u;
|
|
const DEFAULT_TIMEOUT_MS = 30000;
|
|
|
|
const PROVIDER_PROFILE_ALIASES = Object.freeze({ codex: "codex-api" });
|
|
const PROVIDER_PROFILE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/u;
|
|
const RESERVED_PROVIDER_PROFILES = new Set(["runtime-default"]);
|
|
|
|
export async function handleProviderProfileCatalogHttp(request, response, options = {}) {
|
|
try {
|
|
const auth = await authenticateActor(request, options);
|
|
if (!auth.ok) return sendJson(response, numericStatus(auth.status) ?? numericStatus(auth.statusCode) ?? 401, auth);
|
|
|
|
const requestId = requestIdFor(request);
|
|
const env = options.env ?? process.env;
|
|
const managerUrl = resolveAgentRunManagerUrl(env);
|
|
const agentRunApiKey = resolveAgentRunApiKey(env);
|
|
const fetchImpl = options.fetchImpl ?? fetch;
|
|
const timeoutMs = positiveInteger(env.HWLAB_PROVIDER_PROFILE_AGENTRUN_HTTP_TIMEOUT_MS, positiveInteger(env.HWLAB_CODE_AGENT_AGENTRUN_HTTP_TIMEOUT_MS, DEFAULT_TIMEOUT_MS));
|
|
const delegated = await agentRunJson(fetchImpl, managerUrl, "/api/v1/provider-profiles", { method: "GET", requestId, timeoutMs, apiKey: agentRunApiKey });
|
|
const data = normalizeCatalogData(delegated.data);
|
|
const status = delegated.ok ? delegated.httpStatus || 200 : delegated.httpStatus || 502;
|
|
const base = {
|
|
ok: delegated.ok,
|
|
status: delegated.ok ? "ok" : "failed",
|
|
contractVersion: CONTRACT_VERSION,
|
|
actor: actorSummary(auth.actor),
|
|
valuesPrinted: false
|
|
};
|
|
if (delegated.ok) {
|
|
return sendJson(response, status, { ...base, items: data.items, count: data.count, data });
|
|
}
|
|
return sendJson(response, status, {
|
|
...base,
|
|
error: delegatedError(delegated),
|
|
data: null
|
|
});
|
|
} catch (error) {
|
|
return sendError(response, error.httpStatus ?? 500, error.code ?? "provider_profile_catalog_failed", error.message ?? "Provider profile catalog failed", error.details);
|
|
}
|
|
}
|
|
|
|
export async function handleProviderProfilesHttp(request, response, url, options = {}) {
|
|
try {
|
|
const auth = await authenticateAdmin(request, options);
|
|
if (!auth.ok) return sendJson(response, numericStatus(auth.status) ?? numericStatus(auth.statusCode) ?? 401, auth);
|
|
|
|
const requestId = requestIdFor(request);
|
|
const route = parseProviderProfileRoute(url.pathname, request.method);
|
|
const env = options.env ?? process.env;
|
|
const managerUrl = resolveAgentRunManagerUrl(env);
|
|
const agentRunApiKey = resolveAgentRunApiKey(env);
|
|
const fetchImpl = options.fetchImpl ?? fetch;
|
|
const timeoutMs = positiveInteger(env.HWLAB_PROVIDER_PROFILE_AGENTRUN_HTTP_TIMEOUT_MS, positiveInteger(env.HWLAB_CODE_AGENT_AGENTRUN_HTTP_TIMEOUT_MS, DEFAULT_TIMEOUT_MS));
|
|
|
|
if (route.kind === "list") {
|
|
const delegated = await agentRunJson(fetchImpl, managerUrl, "/api/v1/provider-profiles", { method: "GET", requestId, timeoutMs, apiKey: agentRunApiKey });
|
|
return sendDelegated(response, delegated, auth, route, managerUrl, requestId, normalizeListData(delegated.data));
|
|
}
|
|
|
|
if (route.kind === "remove") {
|
|
const delegated = await agentRunJson(fetchImpl, managerUrl, `/api/v1/provider-profiles/${encodeURIComponent(route.agentRunProfile)}`, { method: "DELETE", requestId, timeoutMs, apiKey: agentRunApiKey });
|
|
return sendDelegated(response, delegated, auth, route, managerUrl, requestId, normalizeProfileData(delegated.data));
|
|
}
|
|
|
|
if (route.kind === "credential") {
|
|
const body = await readJsonObject(request, options.bodyLimitBytes);
|
|
const credentialApiKey = text(body.apiKey);
|
|
const authJson = typeof body.authJson === "string" ? body.authJson : "";
|
|
if (credentialApiKey.length < 8 && !authJson.trim()) return sendError(response, 400, "credential_required", "apiKey or authJson is required and must not be empty");
|
|
const delegatedBody = {
|
|
...(authJson.trim() ? { authJson } : { apiKey: credentialApiKey }),
|
|
...(body.config && typeof body.config === "object" ? { config: body.config } : {}),
|
|
delegatedBy: delegatedBy(auth, requestId),
|
|
reason: text(body.reason) || "hwlab-provider-management"
|
|
};
|
|
const delegated = await agentRunJson(fetchImpl, managerUrl, `/api/v1/provider-profiles/${encodeURIComponent(route.agentRunProfile)}/credential`, { method: "PUT", body: delegatedBody, requestId, timeoutMs, apiKey: agentRunApiKey });
|
|
return sendDelegated(response, delegated, auth, route, managerUrl, requestId, normalizeProfileData(delegated.data));
|
|
}
|
|
|
|
if (route.kind === "config") {
|
|
if (route.method === "GET") {
|
|
const delegated = await agentRunJson(fetchImpl, managerUrl, `/api/v1/provider-profiles/${encodeURIComponent(route.agentRunProfile)}/config`, { method: "GET", requestId, timeoutMs, apiKey: agentRunApiKey });
|
|
return sendDelegated(response, delegated, auth, route, managerUrl, requestId, normalizeConfigData(delegated.data), { allowConfigToml: true });
|
|
}
|
|
const body = await readJsonObject(request, options.bodyLimitBytes);
|
|
const configToml = typeof body.configToml === "string" ? body.configToml : "";
|
|
if (!configToml.trim()) return sendError(response, 400, "config_toml_required", "configToml is required and must not be empty");
|
|
const delegatedBody = {
|
|
configToml,
|
|
delegatedBy: delegatedBy(auth, requestId),
|
|
reason: text(body.reason) || "hwlab-provider-management"
|
|
};
|
|
const delegated = await agentRunJson(fetchImpl, managerUrl, `/api/v1/provider-profiles/${encodeURIComponent(route.agentRunProfile)}/config`, { method: "PUT", body: delegatedBody, requestId, timeoutMs, apiKey: agentRunApiKey });
|
|
return sendDelegated(response, delegated, auth, route, managerUrl, requestId, normalizeConfigData(delegated.data));
|
|
}
|
|
|
|
if (route.kind === "validate") {
|
|
const body = await readOptionalJsonObject(request, options.bodyLimitBytes);
|
|
const delegatedBody = {
|
|
...(text(body.prompt) ? { prompt: text(body.prompt) } : {}),
|
|
delegatedBy: delegatedBy(auth, requestId),
|
|
reason: text(body.reason) || "hwlab-provider-management"
|
|
};
|
|
const delegated = await agentRunJson(fetchImpl, managerUrl, `/api/v1/provider-profiles/${encodeURIComponent(route.agentRunProfile)}/validate`, { method: "POST", body: delegatedBody, requestId, timeoutMs, apiKey: agentRunApiKey });
|
|
return sendDelegated(response, delegated, auth, route, managerUrl, requestId, normalizeValidationData(delegated.data, route.publicProfile));
|
|
}
|
|
|
|
if (route.kind === "validation") {
|
|
const delegated = await agentRunJson(fetchImpl, managerUrl, `/api/v1/provider-profiles/${encodeURIComponent(route.agentRunProfile)}/validations/${encodeURIComponent(route.validationId)}`, { method: "GET", requestId, timeoutMs, apiKey: agentRunApiKey });
|
|
return sendDelegated(response, delegated, auth, route, managerUrl, requestId, normalizeValidationData(delegated.data, route.publicProfile));
|
|
}
|
|
|
|
return sendError(response, 404, "not_found", "Provider profile route is not implemented");
|
|
} catch (error) {
|
|
return sendError(response, error.httpStatus ?? 500, error.code ?? "provider_profile_management_failed", error.message ?? "Provider profile management failed", error.details);
|
|
}
|
|
}
|
|
|
|
async function authenticateAdmin(request, options) {
|
|
const auth = await authenticateActor(request, options);
|
|
if (!auth.ok) return auth;
|
|
if (auth.actor?.role !== "admin") return errorPayload("admin_required", "Only admin users can manage provider profiles", 403);
|
|
return auth;
|
|
}
|
|
|
|
async function authenticateActor(request, options) {
|
|
const controller = options.accessController;
|
|
if (!controller || typeof controller.authenticate !== "function") {
|
|
return errorPayload("access_controller_unavailable", "HWLAB access controller is not available", 503);
|
|
}
|
|
const auth = await controller.authenticate(request, { required: true });
|
|
if (!auth.ok) return auth;
|
|
return auth;
|
|
}
|
|
|
|
function parseProviderProfileRoute(pathname, method) {
|
|
if (pathname === "/v1/admin/provider-profiles") {
|
|
if (method !== "GET") throw routeError(405, "method_not_allowed", "Provider profiles collection only supports GET");
|
|
return { kind: "list", publicProfile: null, agentRunProfile: null };
|
|
}
|
|
const match = pathname.match(/^\/v1\/admin\/provider-profiles\/([^/]+)(?:\/(credential|config|validate|validations\/([^/]+)))?$/u);
|
|
if (!match) throw routeError(404, "not_found", "Provider profile route is not implemented");
|
|
const profile = normalizeProfile(decodeURIComponent(match[1]));
|
|
const suffix = match[2] ?? "";
|
|
if (suffix === "credential") {
|
|
if (method !== "PUT") throw routeError(405, "method_not_allowed", "Provider profile credential only supports PUT");
|
|
return { kind: "credential", ...profile };
|
|
}
|
|
if (!suffix) {
|
|
if (method !== "DELETE") throw routeError(405, "method_not_allowed", "Provider profile root only supports DELETE");
|
|
return { kind: "remove", ...profile };
|
|
}
|
|
if (suffix === "config") {
|
|
if (method !== "GET" && method !== "PUT") throw routeError(405, "method_not_allowed", "Provider profile config only supports GET and PUT");
|
|
return { kind: "config", method, ...profile };
|
|
}
|
|
if (suffix === "validate") {
|
|
if (method !== "POST") throw routeError(405, "method_not_allowed", "Provider profile validation only supports POST");
|
|
return { kind: "validate", ...profile };
|
|
}
|
|
if (suffix.startsWith("validations/")) {
|
|
if (method !== "GET") throw routeError(405, "method_not_allowed", "Provider profile validation lookup only supports GET");
|
|
return { kind: "validation", ...profile, validationId: decodeURIComponent(match[3] ?? "") };
|
|
}
|
|
throw routeError(404, "not_found", "Provider profile route is not implemented");
|
|
}
|
|
|
|
function normalizeProfile(value) {
|
|
const input = text(value).toLowerCase();
|
|
const publicProfile = PROVIDER_PROFILE_ALIASES[input] ?? input;
|
|
if (!publicProfile || RESERVED_PROVIDER_PROFILES.has(publicProfile) || !PROVIDER_PROFILE_ID_PATTERN.test(publicProfile)) {
|
|
throw routeError(400, "invalid_provider_profile", "Provider profile must be a lowercase slug such as deepseek, minimax-m3, dsflash-go, or codex-api", {
|
|
profile: input,
|
|
alias: "codex -> codex-api",
|
|
pattern: String(PROVIDER_PROFILE_ID_PATTERN)
|
|
});
|
|
}
|
|
return { publicProfile, agentRunProfile: publicProfile === "codex-api" ? "codex" : publicProfile };
|
|
}
|
|
|
|
async function agentRunJson(fetchImpl, managerUrl, path, { method = "GET", body, requestId, timeoutMs, apiKey }) {
|
|
const startedAt = Date.now();
|
|
const targetUrl = `${managerUrl}${path}`;
|
|
const controller = new AbortController();
|
|
const timer = setTimeout(() => controller.abort(), timeoutMs);
|
|
try {
|
|
const headers: Record<string, string> = {
|
|
accept: "application/json",
|
|
"content-type": "application/json",
|
|
"x-request-id": requestId,
|
|
"x-source-service-id": "hwlab-cloud-api",
|
|
"x-hwlab-delegation": "provider-profile-management-v1"
|
|
};
|
|
if (apiKey) headers.authorization = `Bearer ${apiKey}`;
|
|
const response = await fetchImpl(targetUrl, {
|
|
method,
|
|
headers,
|
|
body: body === undefined ? undefined : JSON.stringify(body),
|
|
signal: controller.signal
|
|
});
|
|
const textBody = await response.text();
|
|
const payload = parseJson(textBody);
|
|
const ok = response.ok && payload?.ok !== false;
|
|
return {
|
|
ok,
|
|
httpStatus: response.status,
|
|
data: payload?.data ?? payload,
|
|
payload,
|
|
traceId: text(payload?.traceId),
|
|
elapsedMs: Date.now() - startedAt,
|
|
method,
|
|
path
|
|
};
|
|
} catch (error) {
|
|
const timedOut = controller.signal.aborted || error?.name === "AbortError";
|
|
return {
|
|
ok: false,
|
|
httpStatus: 0,
|
|
data: null,
|
|
payload: { ok: false, error: { code: timedOut ? "agentrun_timeout" : "agentrun_request_failed", message: error?.message ?? String(error) } },
|
|
traceId: "",
|
|
elapsedMs: Date.now() - startedAt,
|
|
method,
|
|
path,
|
|
transportError: { code: timedOut ? "agentrun_timeout" : "agentrun_request_failed", message: error?.message ?? String(error), valuesPrinted: false }
|
|
};
|
|
} finally {
|
|
clearTimeout(timer);
|
|
}
|
|
}
|
|
|
|
function sendDelegated(response, delegated, auth, route, managerUrl, requestId, data, options = {}) {
|
|
const mutation = route.kind === "remove" || route.kind === "credential" || (route.kind === "config" && route.method === "PUT");
|
|
const status = delegated.ok ? (mutation ? 200 : delegated.httpStatus || 200) : delegated.httpStatus || 502;
|
|
const base = {
|
|
ok: delegated.ok,
|
|
status: delegated.ok ? (route.kind === "remove" ? "removed" : mutation ? "updated" : "ok") : "failed",
|
|
contractVersion: CONTRACT_VERSION,
|
|
actor: actorSummary(auth.actor),
|
|
profile: route.publicProfile ?? undefined,
|
|
delegation: delegationSummary(managerUrl, delegated, requestId),
|
|
valuesPrinted: false
|
|
};
|
|
if (delegated.ok) return sendJson(response, status, { ...base, ...listAliases(data), data }, options);
|
|
return sendJson(response, status, {
|
|
...base,
|
|
error: delegatedError(delegated),
|
|
data: null
|
|
});
|
|
}
|
|
|
|
function normalizeListData(data) {
|
|
const sourceItems = Array.isArray(data?.items) ? data.items : [];
|
|
const items = sourceItems.map(normalizeProfileData);
|
|
return { ...redactObject(data), items, count: items.length, valuesPrinted: false };
|
|
}
|
|
|
|
function normalizeCatalogData(data) {
|
|
const sourceItems = Array.isArray(data?.items) ? data.items : [];
|
|
const items = sourceItems.map(normalizeCatalogProfileData);
|
|
return { items, count: items.length, valuesPrinted: false };
|
|
}
|
|
|
|
function normalizeProfileData(item) {
|
|
if (!item || typeof item !== "object") return item;
|
|
const copy = redactObject(item);
|
|
if (copy.profile === "codex") {
|
|
copy.backendProfile = "codex";
|
|
copy.profile = "codex-api";
|
|
}
|
|
if (copy.profile === "deepseek") copy.bridge = deepseekBridgeSummary();
|
|
if (text(copy.configSummary?.model ?? copy.model) === "deepseek-v4-flash") copy.bridge = opencodeZenGoBridgeSummary();
|
|
copy.valuesPrinted = false;
|
|
return copy;
|
|
}
|
|
|
|
function normalizeCatalogProfileData(item) {
|
|
const normalized = normalizeProfileData(item);
|
|
if (!normalized || typeof normalized !== "object") return normalized;
|
|
return {
|
|
profile: normalized.profile,
|
|
backendProfile: normalized.backendProfile,
|
|
backendKind: normalized.backendKind,
|
|
configured: normalized.configured,
|
|
failureKind: normalized.failureKind ?? null,
|
|
bridge: normalized.bridge,
|
|
valuesPrinted: false
|
|
};
|
|
}
|
|
|
|
function normalizeConfigData(data) {
|
|
if (!data || typeof data !== "object") return data;
|
|
const configToml = typeof data.configToml === "string" ? data.configToml : typeof data["config.toml"] === "string" ? data["config.toml"] : undefined;
|
|
const copy = normalizeProfileData(data);
|
|
if (typeof configToml === "string") copy.configToml = configToml;
|
|
copy.configTomlPrinted = typeof configToml === "string";
|
|
copy.credentialValuesPrinted = false;
|
|
copy.valuesPrinted = false;
|
|
return copy;
|
|
}
|
|
|
|
function normalizeValidationData(data, fallbackProfile) {
|
|
if (!data || typeof data !== "object") return data;
|
|
const copy = normalizeProfileData(data);
|
|
if (!copy.profile) copy.profile = fallbackProfile;
|
|
if (copy.result && typeof copy.result === "object") copy.result = redactObject(copy.result);
|
|
if (copy.runnerJobs && Array.isArray(copy.runnerJobs)) copy.runnerJobs = copy.runnerJobs.map(redactObject);
|
|
return copy;
|
|
}
|
|
|
|
function listAliases(data) {
|
|
return Array.isArray(data?.items) ? { items: data.items, count: data.count ?? data.items.length } : {};
|
|
}
|
|
|
|
function delegatedError(delegated) {
|
|
const body = delegated.payload && typeof delegated.payload === "object" ? delegated.payload : {};
|
|
const nested = body.error && typeof body.error === "object" ? body.error : {};
|
|
return {
|
|
code: text(nested.code ?? body.code) || "agentrun_delegation_failed",
|
|
message: text(nested.message ?? body.message) || `AgentRun provider profile delegation failed with HTTP ${delegated.httpStatus}`,
|
|
failureKind: text(nested.failureKind ?? body.failureKind) || undefined,
|
|
agentRun: {
|
|
httpStatus: delegated.httpStatus,
|
|
traceId: delegated.traceId || undefined,
|
|
route: { method: delegated.method, path: delegated.path },
|
|
elapsedMs: delegated.elapsedMs,
|
|
transportError: delegated.transportError ? redactObject(delegated.transportError) : undefined,
|
|
valuesPrinted: false
|
|
},
|
|
valuesPrinted: false
|
|
};
|
|
}
|
|
|
|
function delegatedBy(auth, requestId) {
|
|
return {
|
|
system: "hwlab-v02",
|
|
userId: text(auth.actor?.id),
|
|
username: text(auth.actor?.username),
|
|
authMethod: text(auth.authMethod) || (auth.apiKey ? "api-key" : "web-session"),
|
|
requestId,
|
|
valuesPrinted: false
|
|
};
|
|
}
|
|
|
|
function actorSummary(actor) {
|
|
return actor ? {
|
|
id: text(actor.id),
|
|
username: text(actor.username),
|
|
displayName: text(actor.displayName),
|
|
role: text(actor.role),
|
|
status: text(actor.status),
|
|
valuesPrinted: false
|
|
} : null;
|
|
}
|
|
|
|
function delegationSummary(managerUrl, delegated, requestId) {
|
|
const url = new URL(managerUrl);
|
|
return {
|
|
provider: "agentrun-v01",
|
|
requestId,
|
|
agentRunBaseUrl: redactUrl(managerUrl),
|
|
agentRunHost: url.hostname,
|
|
traceId: delegated.traceId || undefined,
|
|
httpStatus: delegated.httpStatus,
|
|
elapsedMs: delegated.elapsedMs,
|
|
valuesPrinted: false
|
|
};
|
|
}
|
|
|
|
function deepseekBridgeSummary() {
|
|
return {
|
|
kind: "moon-bridge",
|
|
route: "HWLAB Moon Bridge -> DeepSeek official upstream",
|
|
serviceUrl: "http://hwlab-deepseek-proxy.hwlab-v02.svc.cluster.local:4000/v1",
|
|
responsesPath: "/v1/responses",
|
|
forbiddenHosts: ["hyueapi.com"],
|
|
valuesPrinted: false
|
|
};
|
|
}
|
|
|
|
function opencodeZenGoBridgeSummary() {
|
|
return {
|
|
kind: "moon-bridge",
|
|
route: "HWLAB Moon Bridge -> OpenCode Zen Go Chat Completions",
|
|
serviceUrl: "http://hwlab-deepseek-proxy.hwlab-v02.svc.cluster.local:4000/v1",
|
|
responsesPath: "/v1/responses",
|
|
model: "deepseek-v4-flash",
|
|
upstreamProvider: "opencode",
|
|
upstreamProtocol: "openai-chat",
|
|
forbiddenHosts: ["hyueapi.com"],
|
|
valuesPrinted: false
|
|
};
|
|
}
|
|
|
|
function resolveAgentRunManagerUrl(env) {
|
|
const raw = text(env.AGENTRUN_MGR_URL) || text(env.HWLAB_CODE_AGENT_AGENTRUN_MGR_URL) || text(env.AGENTRUN_MANAGER_URL) || DEFAULT_AGENTRUN_MGR_URL;
|
|
let parsed;
|
|
try {
|
|
parsed = new URL(raw);
|
|
} catch {
|
|
throw routeError(503, "agentrun_manager_url_invalid", "AgentRun manager URL is invalid", { managerUrl: redactUrl(raw) });
|
|
}
|
|
const allowLocal = truthy(env.HWLAB_PROVIDER_PROFILE_AGENTRUN_ALLOW_NON_K3S_URL) || truthy(env.HWLAB_CODE_AGENT_AGENTRUN_ALLOW_NON_K3S_URL);
|
|
const localAllowed = allowLocal && ["127.0.0.1", "localhost"].includes(parsed.hostname);
|
|
if (!isAgentRunManagerInternalServiceHost(parsed.hostname) && !localAllowed) {
|
|
throw routeError(503, "agentrun_manager_url_invalid", "AgentRun manager URL must use internal k3s Service DNS agentrun-mgr.<namespace>.svc.cluster.local", { managerUrl: redactUrl(raw) });
|
|
}
|
|
return raw.replace(/\/+$/u, "");
|
|
}
|
|
|
|
function resolveAgentRunApiKey(env) {
|
|
return text(env.AGENTRUN_API_KEY) || text(env.HWLAB_CODE_AGENT_AGENTRUN_API_KEY) || text(env.HWLAB_PROVIDER_PROFILE_AGENTRUN_API_KEY) || text(env.HWLAB_API_KEY);
|
|
}
|
|
|
|
function isAgentRunManagerInternalServiceHost(host) {
|
|
return AGENTRUN_MANAGER_HOST_PATTERN.test(String(host ?? "").trim().toLowerCase());
|
|
}
|
|
|
|
async function readOptionalJsonObject(request, limitBytes) {
|
|
const body = await readBody(request, limitBytes);
|
|
if (!body.trim()) return {};
|
|
return parseJsonObject(body);
|
|
}
|
|
|
|
async function readJsonObject(request, limitBytes) {
|
|
return parseJsonObject(await readBody(request, limitBytes));
|
|
}
|
|
|
|
async function readBody(request, limitBytes = 1024 * 1024) {
|
|
const chunks = [];
|
|
let total = 0;
|
|
for await (const chunk of request) {
|
|
const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
|
|
total += buffer.length;
|
|
if (total > limitBytes) throw routeError(413, "body_too_large", "Request body is too large");
|
|
chunks.push(buffer);
|
|
}
|
|
return Buffer.concat(chunks).toString("utf8");
|
|
}
|
|
|
|
function parseJsonObject(body) {
|
|
const parsed = parseJson(body);
|
|
if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw routeError(400, "invalid_json_body", "Request body must be a JSON object");
|
|
return parsed;
|
|
}
|
|
|
|
function parseJson(value) {
|
|
try {
|
|
return value ? JSON.parse(value) : null;
|
|
} catch (error) {
|
|
throw routeError(400, "parse_error", "Invalid JSON body", { reason: error?.message ?? String(error) });
|
|
}
|
|
}
|
|
|
|
function redactObject(value, key = "") {
|
|
if (Array.isArray(value)) return value.map((item) => redactObject(item, key));
|
|
if (value && typeof value === "object") {
|
|
return Object.fromEntries(Object.entries(value).map(([entryKey, entryValue]) => [entryKey, redactObject(entryValue, entryKey)]));
|
|
}
|
|
if (typeof value === "string" && (secretField(key) || looksSecret(value))) return "[redacted]";
|
|
return value;
|
|
}
|
|
|
|
function secretField(key) {
|
|
const lower = key.toLowerCase();
|
|
if (["apikey", "api_key", "authorization", "authjson", "auth.json", "configtoml", "config.toml", "stringdata"].includes(lower)) return true;
|
|
if (lower === "secretref" || lower === "secretname" || lower === "secretkey" || lower === "keys") return false;
|
|
return lower.includes("password") || lower.endsWith("token");
|
|
}
|
|
|
|
function looksSecret(value) {
|
|
return /^sk-[A-Za-z0-9_-]{10,}/u.test(value) || /^Bearer\s+\S+/u.test(value);
|
|
}
|
|
|
|
function requestIdFor(request) {
|
|
return getHeader(request, "x-request-id") || `req_provider_${randomUUID().replace(/-/gu, "")}`;
|
|
}
|
|
|
|
function getHeader(request, name) {
|
|
const value = request.headers?.[name.toLowerCase()];
|
|
if (Array.isArray(value)) return text(value[0]);
|
|
return text(value);
|
|
}
|
|
|
|
function positiveInteger(value, fallback) {
|
|
const parsed = Number(value);
|
|
return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : fallback;
|
|
}
|
|
|
|
function numericStatus(value) {
|
|
const parsed = Number(value);
|
|
return Number.isInteger(parsed) && parsed >= 100 && parsed <= 599 ? parsed : null;
|
|
}
|
|
|
|
function truthy(value) {
|
|
return ["1", "true", "yes", "on"].includes(text(value).toLowerCase());
|
|
}
|
|
|
|
function redactUrl(value) {
|
|
try {
|
|
const url = new URL(value);
|
|
if (url.username) url.username = "redacted";
|
|
if (url.password) url.password = "redacted";
|
|
return url.toString().replace(/\/$/u, "");
|
|
} catch {
|
|
return "[invalid-url]";
|
|
}
|
|
}
|
|
|
|
function routeError(httpStatus, code, message, details = {}) {
|
|
return Object.assign(new Error(message), { httpStatus, code, details });
|
|
}
|
|
|
|
function errorPayload(code, message, status, details = {}) {
|
|
return { ok: false, status: "failed", contractVersion: CONTRACT_VERSION, error: { code, message, ...details, valuesPrinted: false }, valuesPrinted: false, statusCode: status };
|
|
}
|
|
|
|
function sendError(response, statusCode, code, message, details = {}) {
|
|
return sendJson(response, statusCode, { ok: false, status: "failed", contractVersion: CONTRACT_VERSION, error: { code, message, ...redactObject(details), valuesPrinted: false }, valuesPrinted: false });
|
|
}
|
|
|
|
function sendJson(response, statusCode, payload, options = {}) {
|
|
response.writeHead(statusCode, { "content-type": "application/json" });
|
|
const body = options.allowConfigToml ? redactObjectAllowingConfigToml(payload) : redactObject(payload);
|
|
response.end(`${JSON.stringify(body)}\n`);
|
|
}
|
|
|
|
function redactObjectAllowingConfigToml(value, key = "") {
|
|
if ((key === "configToml" || key === "config.toml") && typeof value === "string") return value;
|
|
if (Array.isArray(value)) return value.map((item) => redactObjectAllowingConfigToml(item, key));
|
|
if (value && typeof value === "object") {
|
|
return Object.fromEntries(Object.entries(value).map(([entryKey, entryValue]) => [entryKey, redactObjectAllowingConfigToml(entryValue, entryKey)]));
|
|
}
|
|
if (typeof value === "string" && (secretField(key) || looksSecret(value))) return "[redacted]";
|
|
return value;
|
|
}
|
|
|
|
function text(value) {
|
|
return String(value ?? "").trim();
|
|
}
|