botversion-sdk 1.0.3 → 1.0.5

package/interceptor.js

@@ -1,16 +1,119 @@
 // botversion-sdk/interceptor.js
 "use strict";
 
+/**
+ * Makes an internal HTTP request to the user's own backend.
+ * Forwards cookies, auth headers, and CSRF tokens.
+ */
+function makeInternalRequest(method, path, body, cookies, headers, baseUrl) {
+  return new Promise(function (resolve) {
+    var http = require("http");
+    var https = require("https");
+    var url = require("url");
+
+    baseUrl = baseUrl || "http://127.0.0.1:8000";
+    var fullUrl = baseUrl + path;
+    var parsedUrl = url.parse(fullUrl);
+    var isHttps = parsedUrl.protocol === "https:";
+    var lib = isHttps ? https : http;
+
+    var bodyStr = body ? JSON.stringify(body) : null;
+
+    var reqHeaders = {
+      "Content-Type": "application/json",
+    };
+
+    if (bodyStr) {
+      reqHeaders["Content-Length"] = String(Buffer.byteLength(bodyStr));
+    }
+
+    // Forward cookies — this is what identifies the user
+    if (cookies) reqHeaders["Cookie"] = cookies;
+
+    // Forward auth header
+    var authHeader =
+      headers && (headers["authorization"] || headers["Authorization"]);
+    if (authHeader) reqHeaders["Authorization"] = authHeader;
+
+    // Forward CSRF token
+    var csrf =
+      headers &&
+      (headers["x-csrftoken"] ||
+        headers["X-CSRFToken"] ||
+        headers["x-xsrf-token"] ||
+        headers["X-XSRF-TOKEN"]);
+    if (csrf) reqHeaders["X-CSRFToken"] = csrf;
+
+    var reqOptions = {
+      hostname: parsedUrl.hostname,
+      port: parsedUrl.port || (isHttps ? 443 : 80),
+      path: parsedUrl.path,
+      method: method.toUpperCase(),
+      headers: reqHeaders,
+      timeout: 30000,
+    };
+
+    var req = lib.request(reqOptions, function (res) {
+      var data = "";
+      res.on("data", function (chunk) {
+        data += chunk;
+      });
+      res.on("end", function () {
+        var parsed;
+        try {
+          parsed = JSON.parse(data);
+        } catch (e) {
+          parsed = { raw: data };
+        }
+
+        // Handle redirects
+        if (
+          res.statusCode >= 300 &&
+          res.statusCode < 400 &&
+          res.headers.location
+        ) {
+          makeInternalRequest(
+            res.statusCode === 303 ? "GET" : method,
+            res.headers.location,
+            res.statusCode === 303 ? null : body,
+            cookies,
+            headers,
+            baseUrl,
+          ).then(resolve);
+          return;
+        }
+
+        resolve({
+          status: res.statusCode,
+          ok: res.statusCode >= 200 && res.statusCode < 300,
+          data: parsed,
+        });
+      });
+    });
+
+    req.on("error", function (err) {
+      resolve({ status: 500, ok: false, data: { error: err.message } });
+    });
+
+    req.on("timeout", function () {
+      req.destroy();
+      resolve({ status: 500, ok: false, data: { error: "Request timed out" } });
+    });
+
+    if (bodyStr) req.write(bodyStr);
+    req.end();
+  });
+}
+
 /**
  * Attaches a middleware to the Express app that
  * silently intercepts every request and reports
- * new endpoints to BotVersion platform
+ * new endpoints to BotVersion platform.
+ * Auth and user context are handled client-side — not here.
  */
 function attachInterceptor(app, client, options) {
   options = options || {};
-  var getUserContext = options.getUserContext || null;
 
-  // Paths to always ignore
   const ignorePaths = [
     "/health",
     "/favicon.ico",
@@ -20,11 +123,9 @@ function attachInterceptor(app, client, options) {
   ].concat(options.exclude || []);
 
   // Track which endpoints we have already reported
-  // so we don't spam the platform on every request
   const reportedEndpoints = new Set();
 
   app.use(function botVersionInterceptor(req, res, next) {
-    // Skip ignored paths
     const path = req.path || req.url || "";
     const shouldIgnore = ignorePaths.some(function (p) {
       return path.startsWith(p);
@@ -34,21 +135,15 @@ function attachInterceptor(app, client, options) {
       return next();
     }
 
-    // Skip non-API paths if configured
     if (options.apiPrefix && !path.startsWith(options.apiPrefix)) {
       return next();
     }
 
     const method = req.method.toUpperCase();
-
-    // Normalize path — replace IDs with :param
     const normalizedPath = normalizePath(path);
     const endpointKey = method + ":" + normalizedPath;
 
-    // Only report if we haven't seen this endpoint before
     const bodyStructure = buildBodyStructure(req.body);
-    console.log("[DEBUG] endpoint:", endpointKey);
-    console.log("[DEBUG] bodyStructure:", JSON.stringify(bodyStructure));
     const bodyKey =
       endpointKey +
       ":" +
@@ -59,7 +154,6 @@ function attachInterceptor(app, client, options) {
     if (!reportedEndpoints.has(bodyKey)) {
       reportedEndpoints.add(bodyKey);
 
-      // Convert to JSON Schema format so Gemini can read field names
       const jsonSchema = bodyStructure
         ? {
             type: "object",
@@ -78,9 +172,8 @@ function attachInterceptor(app, client, options) {
             ),
           }
         : null;
-      console.log("[DEBUG] jsonSchema:", JSON.stringify(jsonSchema));
 
-      // Report async — don't block the request
+      // Report async — never block the request
       setImmediate(function () {
         client
           .updateEndpoint({
@@ -90,7 +183,6 @@ function attachInterceptor(app, client, options) {
             detectedBy: "runtime",
           })
           .catch(function (err) {
-            // Silent fail — never crash customer's app
             if (options.debug) {
               console.warn(
                 "[BotVersion SDK] Failed to report endpoint:",
@@ -103,52 +195,10 @@ function attachInterceptor(app, client, options) {
 
     next();
   });
-  // Attached to app so SaaS owner can call it in their agent route
-  app.executeAgentCall = function (req, call) {
-    var userContext = getUserContext
-      ? getUserContext(req)
-      : extractDefaultContext(req);
-
-    return client
-      .agentChat({
-        message: req.body.message,
-        conversationHistory: req.body.conversationHistory || [],
-        pageContext: req.body.pageContext || {},
-        userContext: userContext,
-      })
-      .then(function (response) {
-        // Handle plain chat/greeting responses from ai-response.js
-        if (response.answer) {
-          return { action: "RESPOND", message: response.answer };
-        }
-
-        // Handle agent action
-        if (response.action !== "EXECUTE_CALL") return response;
-
-        return makeLocalCall(req, response.call).then(function (result) {
-          return client
-            .agentToolResult(
-              response.sessionToken,
-              result,
-              response.sessionData,
-            )
-            .then(function (toolResponse) {
-              if (toolResponse.action === "EXECUTE_CALL") {
-                return makeLocalCall(req, toolResponse.call).then(
-                  function (result2) {
-                    return client.agentToolResult(
-                      toolResponse.sessionToken,
-                      result2,
-                      toolResponse.sessionData,
-                    );
-                  },
-                );
-              }
-              return toolResponse;
-            });
-        });
-      });
-  };
+  // Register executor so WebSocket can forward calls to user's backend
+  client.setExecutor(function (method, path, body, cookies, headers, baseUrl) {
+    return makeInternalRequest(method, path, body, cookies, headers, baseUrl);
+  });
 }
 
 /**
@@ -172,7 +222,7 @@ function normalizePath(path) {
       // Numeric ID
       if (/^\d+$/.test(segment)) return ":id";
 
-      // cuid pattern (your system uses these)
+      // cuid pattern
       if (/^c[a-z0-9]{20,}$/i.test(segment)) return ":id";
 
       // MongoDB ObjectId
@@ -201,7 +251,6 @@ function buildBodyStructure(body) {
   const structure = {};
 
   Object.keys(body).forEach(function (key) {
-    // Never store sensitive values
     const sensitiveKeys = [
       "password",
       "token",
@@ -242,64 +291,3 @@ module.exports = {
   normalizePath,
   buildBodyStructure,
 };
-
-// Default userContext extraction — reads common patterns
-// SaaS owner can override this with getUserContext option
-function extractDefaultContext(req) {
-  var user = req.user || (req.session && req.session.user) || {};
-  return {
-    userId: user.id || user.userId || user._id || null,
-    email: user.email || null,
-    role: user.role || user.userRole || null,
-    name: user.name || user.username || null,
-  };
-}
-
-// Makes the HTTP call locally on the SaaS owner's server
-// forwarding the user's real auth headers
-function makeLocalCall(req, call) {
-  return new Promise(function (resolve) {
-    var http = require("http");
-    var https = require("https");
-
-    var body = call.body ? JSON.stringify(call.body) : null;
-    var isHttps = req.protocol === "https" || req.secure;
-    var lib = isHttps ? https : http;
-
-    var options = {
-      hostname: "127.0.0.1",
-      port: process.env.PORT || 3000,
-      path: call.path,
-      method: call.method,
-      headers: {
-        "Content-Type": "application/json",
-        // Forward the user's real auth token — this is the key part
-        Authorization: req.headers["authorization"] || "",
-        Cookie: req.headers["cookie"] || "",
-      },
-    };
-
-    if (body) options.headers["Content-Length"] = Buffer.byteLength(body);
-
-    var apiReq = lib.request(options, function (apiRes) {
-      var data = "";
-      apiRes.on("data", function (chunk) {
-        data += chunk;
-      });
-      apiRes.on("end", function () {
-        try {
-          resolve({ status: apiRes.statusCode, data: JSON.parse(data) });
-        } catch {
-          resolve({ status: apiRes.statusCode, data: { raw: data } });
-        }
-      });
-    });
-
-    apiReq.on("error", function (err) {
-      resolve({ status: 500, error: err.message });
-    });
-
-    if (body) apiReq.write(body);
-    apiReq.end();
-  });
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "botversion-sdk",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "BotVersion SDK — auto-detect and register your API endpoints",
   "main": "index.js",
   "bin": {
@@ -16,6 +16,7 @@
   "author": "Saurav Dhakal",
   "license": "MIT",
   "dependencies": {
-    "express": "^4.18.2"
+    "express": "^4.18.2",
+    "ws": "^8.20.0"
   }
 }