Repository navigation
Expand file tree
/
Copy path_api-key.js
More file actions
55 lines (47 loc) · 2.11 KB
/
Copy path_api-key.js
File metadata and controls
55 lines (47 loc) · 2.11 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
const DESKTOP_ORIGIN_PATTERNS = [
/^https?:\/\/tauri\.localhost(:\d+)?$/,
/^https?:\/\/[a-z0-9-]+\.tauri\.localhost(:\d+)?$/i,
/^tauri:\/\/localhost$/,
/^asset:\/\/localhost$/,
];
const BROWSER_ORIGIN_PATTERNS = [
/^https:\/\/(.*\.)?worldmonitor\.app$/,
/^https:\/\/worldmonitor-[a-z0-9-]+-elie-[a-z0-9]+\.vercel\.app$/,
...(process.env.NODE_ENV === 'production' ? [] : [
/^https?:\/\/localhost(:\d+)?$/,
/^https?:\/\/127\.0\.0\.1(:\d+)?$/,
]),
];
function isDesktopOrigin(origin) {
return Boolean(origin) && DESKTOP_ORIGIN_PATTERNS.some(p => p.test(origin));
}
function isTrustedBrowserOrigin(origin) {
return Boolean(origin) && BROWSER_ORIGIN_PATTERNS.some(p => p.test(origin));
}
export function validateApiKey(req) {
const key = req.headers.get('X-WorldMonitor-Key');
const origin = req.headers.get('Origin') || '';
// Desktop app — always require API key
if (isDesktopOrigin(origin)) {
if (!key) return { valid: false, required: true, error: 'API key required for desktop access' };
const validKeys = (process.env.WORLDMONITOR_VALID_KEYS || '').split(',').filter(Boolean);
if (!validKeys.includes(key)) return { valid: false, required: true, error: 'Invalid API key' };
return { valid: true, required: true };
}
// Trusted browser origin (worldmonitor.app, Vercel previews, localhost dev) — no key needed
if (isTrustedBrowserOrigin(origin)) {
if (key) {
const validKeys = (process.env.WORLDMONITOR_VALID_KEYS || '').split(',').filter(Boolean);
if (!validKeys.includes(key)) return { valid: false, required: true, error: 'Invalid API key' };
}
return { valid: true, required: false };
}
// Explicit key provided from unknown origin — validate it
if (key) {
const validKeys = (process.env.WORLDMONITOR_VALID_KEYS || '').split(',').filter(Boolean);
if (!validKeys.includes(key)) return { valid: false, required: true, error: 'Invalid API key' };
return { valid: true, required: true };
}
// No origin, no key — require API key (blocks unauthenticated curl/scripts)
return { valid: false, required: true, error: 'API key required' };
}