Chris Christiansen
dc9f7b6626
Replace the generic mcp-call socket path with two authenticated, read-only Git actions. Add response normalization and error masking, a purpose-built frontend, container build configuration, and socket handler unit tests.
99 lines
3.2 KiB
JavaScript
99 lines
3.2 KiB
JavaScript
import { callAgent } from './agentClient.js';
|
|
import { registerBrowserSocketHandlers } from './socketHandlers.js';
|
|
import 'dotenv/config';
|
|
import express from 'express';
|
|
import cors from 'cors';
|
|
import session from 'express-session';
|
|
import { OAuth2Client } from 'google-auth-library';
|
|
import { createServer } from 'node:http';
|
|
import { Server } from 'socket.io';
|
|
import path from 'path';
|
|
import { fileURLToPath } from 'url';
|
|
|
|
const app = express();
|
|
const http = createServer(app);
|
|
const front = process.env.FRONTEND_URL || 'http://localhost:5173';
|
|
const emails = new Set((process.env.ALLOWED_EMAILS || '').split(',').filter(Boolean));
|
|
const oauth = new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, `${front}/auth/callback`);
|
|
|
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
const frontendDistPath = path.join(__dirname, '../frontend/dist');
|
|
const frontendIndexPath = path.join(frontendDistPath, 'index.html');
|
|
|
|
if (process.env.NODE_ENV === 'production') {
|
|
app.set('trust proxy', 1);
|
|
}
|
|
|
|
const sessionSecret = process.env.SESSION_SECRET;
|
|
if (!sessionSecret || (sessionSecret === 'CHANGE_ME' && process.env.NODE_ENV !== 'production')) {
|
|
throw new Error('A valid SESSION_SECRET must be set.');
|
|
}
|
|
|
|
const sm = session({
|
|
secret: sessionSecret,
|
|
resave: false,
|
|
saveUninitialized: false,
|
|
cookie: {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === 'production',
|
|
sameSite: 'lax'
|
|
},
|
|
});
|
|
const io = new Server(http, { cors: { origin: front, credentials: true } });
|
|
|
|
app.use(cors({ origin: front, credentials: true }));
|
|
app.use(sm);
|
|
app.use(express.static(frontendDistPath));
|
|
io.use((s, n) => sm(s.request, {}, n));
|
|
|
|
app.get('/health', (_, r) => r.json({ status: 'ok' }));
|
|
|
|
app.get('/auth/google', (q, r) => r.redirect(oauth.generateAuthUrl({ scope: ['openid', 'email', 'profile'], prompt: 'consent' })));
|
|
|
|
app.get('/auth/callback', async (q, r) => {
|
|
try {
|
|
let { tokens } = await oauth.getToken(q.query.code);
|
|
let p = (await oauth.verifyIdToken({ idToken: tokens.id_token, audience: process.env.GOOGLE_CLIENT_ID })).getPayload();
|
|
if (!p?.email || !emails.has(p.email)) return r.status(403).send('Not authorised');
|
|
q.session.user = { email: p.email, name: p.name || p.email };
|
|
r.redirect('/');
|
|
} catch (e) {
|
|
r.status(500).send('Login failed');
|
|
}
|
|
});
|
|
|
|
app.get('/auth/me', (q, r) => (q.session.user ? r.json(q.session.user) : r.status(401).end()));
|
|
app.post('/auth/logout', (q, r) => q.session.destroy(() => r.json({ ok: true })));
|
|
|
|
io.on('connection', (s) => {
|
|
const u = s.request.session?.user;
|
|
if (!u) return s.disconnect();
|
|
|
|
registerBrowserSocketHandlers(s, { callAgentFn: callAgent });
|
|
});
|
|
|
|
app.get('*' , (req, res) => {
|
|
if (req.method !== 'GET') {
|
|
return res.status(404).end();
|
|
}
|
|
|
|
const isApiRoute = /^\/(auth|socket\.io|health|api)(\/.*|\/?)$/.test(req.path);
|
|
if (isApiRoute) {
|
|
return res.status(404).end();
|
|
}
|
|
|
|
if (req.accepts('html')) {
|
|
res.sendFile(frontendIndexPath, (err) => {
|
|
if (err && !res.headersSent) {
|
|
res.status(404).end();
|
|
}
|
|
});
|
|
} else {
|
|
if (!res.headersSent) {
|
|
res.status(404).end();
|
|
}
|
|
}
|
|
});
|
|
|
|
http.listen(Number(process.env.PORT || 8080), '0.0.0.0');
|