babelgate 0.0.0 → 1.1.0

package/dist/middleware/require-api-key.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractClientKeys = extractClientKeys;
+exports.requireApiKey = requireApiKey;
+const crypto_1 = require("crypto");
+const errors_1 = require("../utils/errors");
+/**
+ * Timing-safe string comparison — returns false for length mismatches
+ * without leaking length via early exit.
+ */
+function safeEqual(a, b) {
+    const aBuf = Buffer.from(a, "utf8");
+    const bBuf = Buffer.from(b, "utf8");
+    if (aBuf.length !== bBuf.length)
+        return false;
+    return (0, crypto_1.timingSafeEqual)(aBuf, bBuf);
+}
+/**
+ * Every credential a client may have presented (spec §3.4): the
+ * `Authorization: Bearer` token (scheme case-insensitive), `x-api-key`,
+ * `x-goog-api-key` and the `key` query parameter — covering the OpenAI,
+ * Anthropic and Gemini SDKs' native auth styles. Empty values are not
+ * candidates. Exported for tests.
+ */
+function extractClientKeys(req) {
+    const keys = [];
+    const collect = (value) => {
+        if (typeof value === "string" && value.length > 0) {
+            keys.push(value);
+        }
+        else if (Array.isArray(value)) {
+            value.forEach(collect);
+        }
+    };
+    const authorization = req.headers.authorization;
+    for (const value of Array.isArray(authorization)
+        ? authorization
+        : [authorization]) {
+        if (typeof value !== "string")
+            continue;
+        const match = /^bearer\s+(.+)$/i.exec(value);
+        if (match)
+            collect(match[1].trim());
+    }
+    collect(req.headers["x-api-key"]);
+    collect(req.headers["x-goog-api-key"]);
+    collect(req.query?.key);
+    return keys;
+}
+/**
+ * Client-facing auth for proxied endpoints.
+ *
+ * Enabled only when PROXY_API_KEY is set — unset means auth disabled
+ * (localhost/dev stays frictionless). Accepts the key in any of the
+ * provider-native styles (see extractClientKeys) so client SDKs work
+ * unchanged. Every candidate is compared with safeEqual; any match
+ * wins. These credentials are never forwarded upstream — the upstream
+ * gets the proxy's own key.
+ *
+ * Applied after /health in app.ts so health probes stay open.
+ */
+function requireApiKey(apiKey) {
+    // Auth disabled — pass everything through
+    if (!apiKey) {
+        return (_req, _res, next) => next();
+    }
+    return (req, _res, next) => {
+        // Compare every candidate; never return early on a mismatch —
+        // any match authenticates.
+        let authenticated = false;
+        for (const candidate of extractClientKeys(req)) {
+            if (safeEqual(candidate, apiKey))
+                authenticated = true;
+        }
+        if (!authenticated) {
+            return next(new errors_1.AuthError("Invalid or missing API key", { requestId: req.id }));
+        }
+        next();
+    };
+}

package/dist/middleware/resolve-source.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSource = resolveSource;
+const env_config_1 = require("../config/env-config");
+const adapters_1 = require("../transformers/adapters");
+/**
+ * Records the configured source provider on `res.locals.sourceApi` when
+ * the request matches one of its routes, so the error handler can render
+ * errors — including auth and body-parser errors — in that provider's
+ * dialect (spec §3.3). Mounted before the body parser and auth.
+ *
+ * Never throws: a broken config just leaves `sourceApi` unset and errors
+ * keep the generic shape.
+ */
+function resolveSource() {
+    return (req, res, next) => {
+        try {
+            const { sourceApi } = (0, env_config_1.getConfig)();
+            if ((0, adapters_1.findSourceRoute)(sourceApi, req.method, req.path)) {
+                res.locals.sourceApi = sourceApi;
+            }
+        }
+        catch {
+            // config unavailable — sourceApi stays unset
+        }
+        next();
+    };
+}

package/dist/routes/proxy.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.proxyRouter = void 0;
+const node_events_1 = require("node:events");
+const express_1 = require("express");
+const proxy_service_1 = require("../services/proxy.service");
+const errors_1 = require("../utils/errors");
+/**
+ * Thin HTTP adapter — all orchestration lives in proxy.service.
+ * Returns null from the service → next() → 404 handler.
+ */
+exports.proxyRouter = (0, express_1.Router)();
+exports.proxyRouter.use(async (req, res, next) => {
+    // Client disconnect mid-request → abort the upstream call. On a
+    // completed response "close" still fires, so guard on completion.
+    const ac = new AbortController();
+    let completed = false;
+    res.on("close", () => {
+        if (!completed)
+            ac.abort();
+    });
+    try {
+        const result = await (0, proxy_service_1.proxyRequest)(req.path, req.method, req.body, String(req.id), {
+            query: Object.fromEntries(Object.entries(req.query).map(([k, v]) => [k, String(v)])),
+            signal: ac.signal,
+        });
+        if (!result)
+            return next();
+        if (result.headers) {
+            for (const [name, value] of Object.entries(result.headers)) {
+                res.setHeader(name, value);
+            }
+        }
+        if (result.stream) {
+            // spec §3.2: headers once, before the first write; honour
+            // backpressure; never write after the client went away.
+            res.status(200);
+            res.setHeader("Content-Type", result.stream.contentType);
+            res.setHeader("Cache-Control", "no-cache");
+            res.setHeader("X-Accel-Buffering", "no");
+            res.flushHeaders();
+            // One close promise for the whole loop — racing a fresh
+            // `once(res, "close")` per backpressured write leaks listeners.
+            const closed = new Promise((resolve) => {
+                res.once("close", resolve);
+            });
+            for await (const chunk of result.stream.chunks) {
+                if (res.writableEnded || res.destroyed)
+                    break;
+                if (!res.write(chunk)) {
+                    await Promise.race([(0, node_events_1.once)(res, "drain"), closed]);
+                }
+            }
+            completed = true;
+            res.end();
+            return;
+        }
+        res.status(200).json(result.body);
+    }
+    catch (err) {
+        // The client went away mid-request — nothing left to answer.
+        if (ac.signal.aborted)
+            return;
+        // Headers already went out: a JSON error can't be rendered onto a
+        // streaming response — end it rather than calling next(err).
+        if (res.headersSent) {
+            res.destroy();
+            return;
+        }
+        next(err instanceof errors_1.ProxyError
+            ? err
+            : new errors_1.TransformError(err instanceof Error ? err.message : "Unknown proxy error", { requestId: req.id }));
+    }
+});

package/dist/services/http-client.js

@@ -0,0 +1,220 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestJson = requestJson;
+exports.postJson = postJson;
+exports.getJson = getJson;
+exports.postStream = postStream;
+const errors_1 = require("../utils/errors");
+const canonical_error_1 = require("../utils/canonical-error");
+const logger_1 = require("../utils/logger");
+/** Retry only these upstream statuses — upstream rejected before processing */
+const RETRYABLE_STATUSES = new Set([429, 503]);
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_RETRIES = 1;
+const BASE_BACKOFF_MS = 250;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** Exponential backoff with jitter: ~250ms, ~500ms, ... */
+function backoffMs(attempt) {
+    const base = BASE_BACKOFF_MS * Math.pow(2, attempt);
+    return base + Math.floor(Math.random() * base * 0.5);
+}
+function isAbortError(err) {
+    return (err instanceof Error &&
+        (err.name === "AbortError" || err.name === "TimeoutError"));
+}
+/**
+ * Send a JSON request to an upstream provider with timeout + conservative
+ * retry. postJson/getJson are thin wrappers.
+ *
+ * Retry policy: LLM POSTs aren't idempotent — retrying a request the
+ * upstream may have already processed can double-bill tokens. So we only
+ * retry transport failures (connection refused, DNS, socket reset) and
+ * 429/503 where the upstream rejected before processing. Never retry other
+ * statuses or timeouts (a partial generation may have run). GETs are
+ * idempotent but follow the same policy for simplicity.
+ */
+async function requestJson(method, opts) {
+    const { url, headers, body, timeoutMs = DEFAULT_TIMEOUT_MS, retries = DEFAULT_RETRIES, requestId, } = opts;
+    const maxAttempts = retries + 1;
+    let lastError = null;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        const start = Date.now();
+        try {
+            const res = await fetch(url, {
+                method,
+                headers: {
+                    "Content-Type": "application/json",
+                    ...headers,
+                    ...(requestId ? { "x-request-id": requestId } : {}),
+                },
+                ...(method === "POST" ? { body: JSON.stringify(body) } : {}),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+            const durationMs = Date.now() - start;
+            const contentType = res.headers.get("content-type") ?? "unknown";
+            const retryAfterSeconds = (0, canonical_error_1.parseRetryAfter)(res.headers.get("retry-after"));
+            const text = await res.text();
+            let parsed = null;
+            let parseFailed = false;
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parseFailed = true;
+            }
+            logger_1.logger.info({
+                requestId,
+                url,
+                attempt: attempt + 1,
+                durationMs,
+                status: res.status,
+            }, "Upstream request");
+            // Retryable rejection (429/503): upstream declined before processing
+            if (RETRYABLE_STATUSES.has(res.status)) {
+                if (attempt < maxAttempts - 1) {
+                    await sleep(backoffMs(attempt));
+                    continue;
+                }
+                const error = new errors_1.UpstreamError(`Upstream rejected request after ${maxAttempts} attempts`, res.status, parsed, { requestId, url, attempts: maxAttempts });
+                error.retryAfterSeconds = retryAfterSeconds;
+                throw error;
+            }
+            // A 2xx that isn't valid JSON is an upstream failure (e.g. Ollama
+            // answering with NDJSON), not a successful empty response.
+            if (res.ok && parseFailed) {
+                throw new errors_1.UpstreamError(`Upstream returned a non-JSON response (content-type: ${contentType})`, res.status, undefined, {
+                    requestId,
+                    url,
+                    // the error-handler never logs err.context; the body preview
+                    // (completion text for NDJSON) surfaces only in
+                    // non-production response details
+                    ...(process.env.NODE_ENV !== "production"
+                        ? { bodyPreview: text.slice(0, 200) }
+                        : {}),
+                });
+            }
+            return {
+                status: res.status,
+                body: parseFailed ? null : parsed,
+                durationMs,
+                contentType,
+                ...(retryAfterSeconds !== undefined && { retryAfterSeconds }),
+            };
+        }
+        catch (err) {
+            // Our own UpstreamErrors (non-JSON 2xx, retries exhausted) propagate.
+            if (err instanceof errors_1.UpstreamError)
+                throw err;
+            const durationMs = Date.now() - start;
+            // Timeout: never retry — upstream may have partially processed
+            if (isAbortError(err)) {
+                throw new errors_1.UpstreamError(`Upstream timed out after ${timeoutMs}ms`, undefined, undefined, { requestId, url, durationMs }, 504);
+            }
+            // Transport failure: safe to retry — upstream likely never saw it
+            lastError = new errors_1.UpstreamError(`Upstream unreachable: ${err instanceof Error ? err.message : "connection failed"}`, undefined, undefined, { requestId, url, attempt: attempt + 1, durationMs });
+            if (attempt < maxAttempts - 1) {
+                await sleep(backoffMs(attempt));
+                continue;
+            }
+        }
+    }
+    throw lastError ?? new errors_1.UpstreamError("Upstream request failed");
+}
+function postJson(opts) {
+    return requestJson("POST", opts);
+}
+function getJson(opts) {
+    return requestJson("GET", opts);
+}
+/**
+ * POST that resolves as soon as response headers arrive, leaving the body
+ * as a ReadableStream for the streaming pipeline (spec §3.2).
+ *
+ * Non-2xx: the body is read as JSON (null when it isn't) and the same
+ * UpstreamError the JSON path produces is thrown — proxy.service maps it
+ * to the client's dialect identically. `timeoutMs` covers connect +
+ * headers only; inter-chunk gaps are the pipeline's idle timeout.
+ * Retries match requestJson (transport failures, 429/503) and can only
+ * ever happen before headers — the stream body is never retried.
+ * `signal` aborts the upstream request (client disconnect).
+ */
+async function postStream(opts) {
+    const { url, headers, body, timeoutMs = DEFAULT_TIMEOUT_MS, retries = DEFAULT_RETRIES, requestId, signal, } = opts;
+    const maxAttempts = retries + 1;
+    let lastError = null;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        const start = Date.now();
+        try {
+            // timeoutMs bounds connect + response headers only (spec §3.2):
+            // a header-phase AbortController whose timer is cleared the
+            // moment fetch resolves, so nothing bounds the body except the
+            // pipeline's idle timeout. The caller's signal stays armed — it
+            // is what aborts the body on client disconnect.
+            const headerPhase = new AbortController();
+            const headerTimer = setTimeout(() => headerPhase.abort(), timeoutMs);
+            const res = await fetch(url, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    ...headers,
+                    ...(requestId ? { "x-request-id": requestId } : {}),
+                },
+                body: JSON.stringify(body),
+                signal: signal
+                    ? AbortSignal.any([signal, headerPhase.signal])
+                    : headerPhase.signal,
+            }).finally(() => clearTimeout(headerTimer));
+            const durationMs = Date.now() - start;
+            const retryAfterSeconds = (0, canonical_error_1.parseRetryAfter)(res.headers.get("retry-after"));
+            logger_1.logger.info({
+                requestId,
+                url,
+                attempt: attempt + 1,
+                durationMs,
+                status: res.status,
+            }, "Upstream request");
+            if (!res.ok) {
+                // The client gets a normal JSON error in its own dialect — read
+                // the body like requestJson does, then throw the same error.
+                const text = await res.text();
+                let parsed = null;
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch {
+                    // body stays null — adapters' toCanonicalError handles that
+                }
+                if (RETRYABLE_STATUSES.has(res.status) &&
+                    attempt < maxAttempts - 1) {
+                    await sleep(backoffMs(attempt));
+                    continue;
+                }
+                const error = new errors_1.UpstreamError(`Upstream returned ${res.status}`, res.status, parsed, { requestId, url });
+                error.retryAfterSeconds = retryAfterSeconds;
+                throw error;
+            }
+            if (!res.body) {
+                throw new errors_1.UpstreamError("Upstream returned no response body", res.status, undefined, { requestId, url });
+            }
+            return { status: res.status, body: res.body, durationMs };
+        }
+        catch (err) {
+            if (err instanceof errors_1.UpstreamError)
+                throw err;
+            const durationMs = Date.now() - start;
+            // Aborted by the caller (client disconnect): not a timeout, not
+            // retryable — propagate as-is so the route can tell.
+            if (signal?.aborted)
+                throw err;
+            if (isAbortError(err)) {
+                throw new errors_1.UpstreamError(`Upstream timed out after ${timeoutMs}ms`, undefined, undefined, { requestId, url, durationMs }, 504);
+            }
+            lastError = new errors_1.UpstreamError(`Upstream unreachable: ${err instanceof Error ? err.message : "connection failed"}`, undefined, undefined, { requestId, url, attempt: attempt + 1, durationMs });
+            if (attempt < maxAttempts - 1) {
+                await sleep(backoffMs(attempt));
+                continue;
+            }
+        }
+    }
+    throw lastError ?? new errors_1.UpstreamError("Upstream request failed");
+}