228 lines
15 KiB
TypeScript
228 lines
15 KiB
TypeScript
/**
|
||
* Foundry的同源服务端代理。浏览器只持HttpOnly会话Cookie，代理转为上游Bearer；
|
||
* 限定可转发路径/查询/header，处理体积、超时、素材类型和会话续期。领域回执/模型校验仍由客户端服务适配器执行。
|
||
* canonical文档和AI冻结写入保留原字节，模型/图片大响应流式转发，避免代理重编码破坏请求身份或额外缓存整份模型。
|
||
*/
|
||
import { fetchCanvasResponse } from "@/lib/canvas-response";
|
||
import { sessionCookie, sessionMaxAge, SESSION_EXPIRY_HEADER } from "@/lib/session-cookie";
|
||
import { NextRequest, NextResponse } from "next/server";
|
||
|
||
/** 普通账户/工作区/material接口白名单；canvas与asset细分端点由下方独立表达式允许。 */
|
||
const allowed =
|
||
/^(profile|auth\/(login|register|verify-email|exchange|me|logout)|workspaces(?:\/[a-zA-Z0-9_-]+(?:\/(?:materials(?:\/[a-zA-Z0-9_-]+(?:\/canvas)?)?|search))?)?)$/;
|
||
/** 明确列出旧canvas、新model增量/迁移、子图事务和AI端点，拒绝把代理变成任意上游路径通道。 */
|
||
const canvasRoute = /^workspaces\/[a-zA-Z0-9_-]+\/materials\/[a-zA-Z0-9_-]+\/canvas(?:\/(?:model(?:\/(?:migrate|operations(?:\/[a-zA-Z0-9_-]+)?))?|operations(?:\/[a-zA-Z0-9_-]+)?|connections|capabilities|subgraphs(?:\/(?:migrate|[a-zA-Z0-9_-]+\/(?:members|dissolve)))?|transactions\/[a-zA-Z0-9_-]+\/undo|ai\/(?:models|operations\/[a-zA-Z0-9_-]+|runs(?:\/[a-zA-Z0-9_-]+(?:\/(?:cancel|apply))?)?)))?$/;
|
||
/** 素材上传/原件读取、操作回执和授权元数据是不同路径，后续按类别选择解析与响应方式。 */
|
||
const assetRoute = /^workspaces\/[a-zA-Z0-9_-]+\/assets(?:\/(?:(?:operations|metadata)\/[a-zA-Z0-9_-]+|[a-zA-Z0-9_-]+))?$/;
|
||
/** 普通请求体上限1MiB；画布5MiB、multipart素材21MiB由handler显式覆盖。 */
|
||
const bodyLimit = 1024 * 1024;
|
||
|
||
// Route Handlers do not have the Pages Router bodyParser size limit.
|
||
/** 逐块计数后再组装请求体，超限取消reader，finally释放锁。
|
||
* binary原样返回字节供冻结JSON/multipart转发，其它请求才解析JSON；这不是无限body缓冲。 */
|
||
async function readBody(req: NextRequest, limit = bodyLimit, binary = false) {
|
||
const reader = req.body?.getReader();
|
||
if (!reader) return {};
|
||
const chunks: Uint8Array[] = [];
|
||
let size = 0;
|
||
try {
|
||
while (true) {
|
||
const { done, value } = await reader.read();
|
||
if (done) break;
|
||
size += value.byteLength;
|
||
if (size > limit) {
|
||
await reader.cancel();
|
||
throw new Error("body_too_large");
|
||
}
|
||
chunks.push(value);
|
||
}
|
||
} finally {
|
||
reader.releaseLock();
|
||
}
|
||
// 空body普通模式用空对象，binary模式保留空字节；无reader则早已返回空对象。
|
||
if (!size) return binary ? new Uint8Array() : {};
|
||
const bytes = Buffer.concat(chunks);
|
||
return binary ? bytes : JSON.parse(bytes.toString("utf8"));
|
||
}
|
||
|
||
/** 共用GET/POST/PATCH/DELETE处理器。params是当前Next版本的异步路由参数，先await再匹配路径。
|
||
* 所有本代理响应默认no-store；HTTP成功/失败保持上游状态，上游调用/响应解析异常另转为502或超时504。 */
|
||
async function handler(
|
||
req: NextRequest,
|
||
{ params }: { params: Promise<{ path: string[] }> },
|
||
) {
|
||
const requestStarted = performance.now();
|
||
const requestStartedAt = new Date().toISOString();
|
||
const responseHeaders = new Headers({ "Cache-Control": "no-store" });
|
||
/** 复用当前响应头集合，JSON错误和普通结果都带相同缓存/续期/诊断头策略。 */
|
||
const json = (body: unknown, status: number) =>
|
||
NextResponse.json(body, { status, headers: responseHeaders });
|
||
// 非GET且带Origin时比对host；缺Origin的请求在此不被拒绝，最终身份/权限仍由上游校验。
|
||
const requestOrigin = req.headers.get("origin");
|
||
if (req.method !== "GET" && requestOrigin) {
|
||
try {
|
||
if (new URL(requestOrigin).host !== req.headers.get("host"))
|
||
return json({ error: "invalid_origin" }, 403);
|
||
} catch {
|
||
return json({ error: "invalid_origin" }, 403);
|
||
}
|
||
}
|
||
const path = (await params).path.join("/");
|
||
if (!allowed.test(path) && !canvasRoute.test(path) && !assetRoute.test(path)) return json({ error: "not_found" }, 404);
|
||
// operations/metadata返回JSON，不能被当成原图流，也不使用图片multipart请求体上限。
|
||
const assetReceipt = assetRoute.test(path) && /\/assets\/operations\//.test(path);
|
||
const assetMetadata = assetRoute.test(path) && /\/assets\/metadata\//.test(path);
|
||
const asset = assetRoute.test(path) && !assetReceipt && !assetMetadata;
|
||
const canvas = canvasRoute.test(path);
|
||
const canonical = canvas && /\/canvas\/model(?:\/|$)/.test(path);
|
||
const frozenAI = canvas && /\/canvas\/ai\/runs(?:\/|$)/.test(path);
|
||
let requestBody: unknown;
|
||
// 在网络转发前完成请求体限额：原始图片含multipart开销，新模型/AI写入保留原请求字节。
|
||
if (req.method !== "GET") {
|
||
try {
|
||
requestBody = await readBody(req, asset ? 21 * 1024 * 1024 : canonical || path.endsWith("/canvas") || path.endsWith("/canvas/operations") ? 5 * 1024 * 1024 : bodyLimit, asset || canonical || frozenAI);
|
||
} catch (error) {
|
||
const tooLarge = error instanceof Error && error.message === "body_too_large";
|
||
return json({ error: tooLarge ? "body_too_large" : "invalid_json" }, tooLarge ? 413 : 400);
|
||
}
|
||
}
|
||
const bodyReceived = performance.now();
|
||
// 上游地址来自服务端环境，客户端path白名单不会让调用者自己指定任意目标源站。
|
||
const origin = process.env.FOUNDRY_API_ORIGIN || "https://api.foundry.entroia.com";
|
||
const project = process.env.NEXT_PUBLIC_FOUNDRY_PROJECT || "endoleap";
|
||
// multipart沿用浏览器Content-Type和boundary，其余发JSON；不透传浏览器任意请求头。
|
||
const headers: Record<string, string> = { "Content-Type": asset ? (req.headers.get("content-type") || "application/octet-stream") : "application/json" };
|
||
if (canvas) headers.Accept = "application/vnd.foundry.canvas+json;version=2";
|
||
// 仅精确协商的canonical GET模型流改变Accept，普通canvas请求继续兼容v2表示。
|
||
const modelStream = canonical && path.endsWith('/canvas/model') && req.method==='GET' && req.headers.get('accept')==='application/vnd.foundry.canvas-model+ndjson;version=1';
|
||
if(modelStream)headers.Accept='application/vnd.foundry.canvas-model+ndjson;version=1';
|
||
// Bearer从服务端读Cookie，禁止直接依赖客户端自行提供的Authorization冒充当前会话。
|
||
const session = req.cookies.get("foundry_session")?.value;
|
||
if (session) headers.Authorization = "Bearer " + session;
|
||
// 明确允许OAuth交换、条件版本、幂等键、账户绑定和资源ID；这些值仍需上游验证。
|
||
for (const h of ["x-foundry-code", "x-foundry-verifier", "if-match", "idempotency-key", "x-expected-account", "x-resource-id"]) {
|
||
const value = req.headers.get(h);
|
||
if (value !== null) headers[h] = value;
|
||
}
|
||
// 查询参数限定名单、单值且每值<300字符，重复值不选择性取第一项，避免前后端解释分歧。
|
||
const query = new URLSearchParams();
|
||
for (const key of ["kind", "sort", "q", "limit", "offset", "after_seq", "status", "include_descendants", "include_subgraphs", "cursor", "variant", "width"]) {
|
||
const values = req.nextUrl.searchParams.getAll(key);
|
||
if (values.length === 1 && values[0].length < 300) query.set(key, values[0]);
|
||
}
|
||
const encodingStarted = performance.now();
|
||
// Frozen document and AI requests cross the proxy byte-for-byte.
|
||
// binary Buffer直接转发，不JSON.parse/stringify；普通业务JSON才重编码，GET不带body。
|
||
const outboundBody = req.method === "GET" ? undefined : asset || canonical || frozenAI ? requestBody as BodyInit : JSON.stringify(requestBody || {});
|
||
const encodeMs = performance.now() - encodingStarted;
|
||
const started = performance.now();
|
||
try {
|
||
// 模型/旧快照与图片读取使用分层超时流；其它请求组合15秒总超时和客户端取消。
|
||
const snapshotRead = canvas && (path.endsWith("/canvas") || canonical) && req.method === "GET";
|
||
const streamedRead = snapshotRead || asset && req.method === "GET";
|
||
const snapshotWrite = canvas && path.endsWith("/canvas") && req.method === "PATCH";
|
||
const traceId = streamedRead || snapshotWrite ? crypto.randomUUID() : "";
|
||
/** 大响应只记录传输时序/字节数/资源路径，不把图像/模型内容或会话令牌写入trace。 */
|
||
const requestUpstream = streamedRead ? (url: string, options: RequestInit) => fetchCanvasResponse(url, options, undefined, fetch, (trace) => {
|
||
console.info(snapshotRead ? "[canvas-transfer]" : "[asset-transfer]", JSON.stringify({ trace_id: traceId, resource: path, ...trace }));
|
||
}) : fetch;
|
||
if (streamedRead || snapshotWrite) responseHeaders.set("X-Canvas-Trace-Id", traceId);
|
||
// 禁止fetch缓存和自动跟随上游跳转；流读取继承请求取消，具体头/body/idle计时由fetchCanvasResponse管理。
|
||
const upstream = await requestUpstream(
|
||
origin + "/projects/" + encodeURIComponent(project) + "/" + path +
|
||
(query.size ? "?" + query.toString() : ""),
|
||
{
|
||
method: req.method,
|
||
headers,
|
||
body: outboundBody,
|
||
signal: streamedRead ? req.signal : AbortSignal.any([AbortSignal.timeout(15000), req.signal]),
|
||
redirect: "manual",
|
||
cache: "no-store",
|
||
},
|
||
);
|
||
// 转发明确允许的重试、版本和schema提示，不能用代理自己的时间推算服务端写入版本。
|
||
const retryAfter = upstream.headers.get("retry-after");
|
||
if (retryAfter) responseHeaders.set("Retry-After", retryAfter);
|
||
const etag = upstream.headers.get("etag");
|
||
if (etag) responseHeaders.set("ETag", etag);
|
||
const schema = upstream.headers.get("x-canvas-schema-version");
|
||
if (schema) responseHeaders.set("X-Canvas-Schema-Version", schema);
|
||
// 既有会话仅在非401且上游给合法剩余秒数时续期；Secure还取决于生产环境及代理HTTPS头。
|
||
const renewal = upstream.headers.get(SESSION_EXPIRY_HEADER);
|
||
if (session && upstream.status !== 401 && renewal !== null && /^\d+$/.test(renewal)) {
|
||
const secure = process.env.NODE_ENV === "production" && req.headers.get("x-forwarded-proto") === "https";
|
||
responseHeaders.set("Set-Cookie", sessionCookie(session, sessionMaxAge(renewal), secure));
|
||
}
|
||
// 成功素材GET只透传允许的图片MIME并加nosniff；不是任意内容的同源文件托管。
|
||
if (asset && upstream.ok && req.method === "GET") {
|
||
const type = upstream.headers.get("content-type") || "";
|
||
if (!/^image\/(png|jpeg|webp|gif)(?:;|$)/i.test(type)) { await upstream.body?.cancel(); return json({ error: "invalid_asset" }, 502); }
|
||
responseHeaders.set("Content-Type", type); responseHeaders.set("X-Content-Type-Options", "nosniff");
|
||
const variant = upstream.headers.get("x-asset-variant");
|
||
if (variant === "original" || variant === "preview") responseHeaders.set("X-Asset-Variant", variant);
|
||
responseHeaders.set("Server-Timing", `upstream;dur=${(performance.now() - started).toFixed(1)}`);
|
||
return new NextResponse(upstream.body, { status: upstream.status, headers: responseHeaders });
|
||
}
|
||
const headersReceived = performance.now();
|
||
// Snapshots contain no login exchange payload. Forward them without buffering
|
||
// and parsing/re-encoding multi-megabyte inline image JSON in the proxy.
|
||
// canonical含错误回执也原流透传；旧snapshot只有成功GET走此路径。此处不读取/删除模型payload字段。
|
||
if (canonical || canvas && path.endsWith("/canvas") && req.method === "GET" && upstream.ok) {
|
||
responseHeaders.set("Content-Type", modelStream && upstream.ok && upstream.headers.get('content-type')?.startsWith('application/vnd.foundry.canvas-model+ndjson;') ? upstream.headers.get('content-type')! : "application/json; charset=utf-8");
|
||
responseHeaders.set("Server-Timing", `upstream;dur=${(headersReceived - started).toFixed(1)}, proxy_headers;dur=${(performance.now() - headersReceived).toFixed(1)}`);
|
||
return new NextResponse(upstream.body, { status: upstream.status, headers: responseHeaders });
|
||
}
|
||
// 普通响应整体解JSON，因为登录/交换成功时须把access_token换成HttpOnly Cookie并从body移除。
|
||
const body = upstream.status === 204 ? null : await upstream.json();
|
||
// 旧快照写入trace分出接收/重编码/上游/响应耗时，不输出请求正文；字节数仅对字符串body计算。
|
||
if (snapshotWrite) console.info("[canvas-save]", JSON.stringify({
|
||
trace_id: traceId, resource: path, status: upstream.status, started_at: requestStartedAt, finished_at: new Date().toISOString(),
|
||
client_body_ms: Math.round((bodyReceived - requestStarted) * 10) / 10,
|
||
encode_ms: Math.round(encodeMs * 10) / 10,
|
||
request_bytes: typeof outboundBody === "string" ? new TextEncoder().encode(outboundBody).length : 0,
|
||
upload_and_server_ms: Math.round((headersReceived - started) * 10) / 10,
|
||
response_body_ms: Math.round((performance.now() - headersReceived) * 10) / 10,
|
||
total_ms: Math.round((performance.now() - requestStarted) * 10) / 10,
|
||
}));
|
||
responseHeaders.set(
|
||
"Server-Timing",
|
||
`upstream;dur=${(headersReceived - started).toFixed(1)}, total;dur=${(performance.now() - started).toFixed(1)}`,
|
||
);
|
||
const secure = process.env.NODE_ENV === "production" && req.headers.get("x-forwarded-proto") === "https";
|
||
// 登录/交换令牌只进Set-Cookie，不回到浏览器可读JSON；其它会话响应按上游剩余时间更新。
|
||
if (body?.access_token) {
|
||
responseHeaders.set("Set-Cookie", sessionCookie(body.access_token, sessionMaxAge(body.expires_in), secure));
|
||
delete body.access_token;
|
||
} else if (session && upstream.status !== 401) {
|
||
const renewed = upstream.headers.get(SESSION_EXPIRY_HEADER);
|
||
if (renewed !== null && /^\d+$/.test(renewed)) responseHeaders.set("Set-Cookie", sessionCookie(session, sessionMaxAge(renewed), secure));
|
||
}
|
||
// 仅上游确认登出成功后清Cookie，不把一次网络失败当成成功退出。
|
||
if (path === "auth/logout" && upstream.ok)
|
||
responseHeaders.set(
|
||
"Set-Cookie",
|
||
"foundry_session=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0",
|
||
);
|
||
if (upstream.status === 204)
|
||
return new NextResponse(null, { status: 204, headers: responseHeaders });
|
||
return json(body || { error: "upstream_unavailable" }, upstream.status);
|
||
// 这里只归一化代理传输/解析错误；成功开始转发后的流错误由流自身传播，不能补发第二个JSON响应。
|
||
} catch (error) {
|
||
responseHeaders.set("Server-Timing", `total;dur=${(performance.now() - started).toFixed(1)}`);
|
||
const timeout = error instanceof Error && error.name === "TimeoutError";
|
||
return json({ error: timeout ? "upstream_timeout" : "upstream_unavailable" }, timeout ? 504 : 502);
|
||
}
|
||
}
|
||
|
||
/** 显式拒绝PUT/HEAD/OPTIONS并说明允许方法，不依赖框架自动推导另一套接口行为。 */
|
||
function methodNotAllowed() {
|
||
return NextResponse.json({ error: "method_not_allowed" }, {
|
||
status: 405,
|
||
headers: { "Cache-Control": "no-store", Allow: "GET, POST, PATCH, DELETE" },
|
||
});
|
||
}
|
||
|
||
// 同一白名单/体积/会话策略覆盖允许的四种方法；具体操作是否合法仍由服务端端点决定。
|
||
export { handler as GET, handler as POST, handler as PATCH, handler as DELETE };
|
||
export { methodNotAllowed as PUT, methodNotAllowed as HEAD, methodNotAllowed as OPTIONS };
|