smartxtrader 3.8.1-xm.0

package/api/_lib/http_utils.js

@@ -0,0 +1,150 @@
+const crypto = require('crypto');
+
+const SECRET_ENV_KEYS = [
+    'SMARTANALYZER_FRONTEND_SECRET',
+    'SMARTANALYZER_SHARED_SECRET',
+    'SMARTANALYZER_FRONTEND_SHARED_SECRET',
+];
+
+const SECRET_HEADER_KEYS = [
+    'x-smartanalizer-secret',
+    'x-smartanalizer-shared-secret',
+    'x-shared-secret',
+];
+
+const pickFirstString = (values = []) => {
+    for (const value of values) {
+        if (typeof value !== 'string') continue;
+        const trimmed = value.trim();
+        if (trimmed.length) {
+            return trimmed;
+        }
+    }
+    return null;
+};
+
+const getHeader = (req, key) => {
+    if (!req || !req.headers) return undefined;
+    const value = req.headers[key];
+    if (Array.isArray(value)) {
+        return value.length ? value[0] : undefined;
+    }
+    return value;
+};
+
+const getRequestOrigin = (req) => {
+    const forwardedHost = pickFirstString((getHeader(req, 'x-forwarded-host') || '').split(',').map(entry => entry.trim()));
+    const host = forwardedHost || pickFirstString([(getHeader(req, 'host') || '')]);
+    const proto = pickFirstString((getHeader(req, 'x-forwarded-proto') || '').split(',').map(entry => entry.trim())) || 'https';
+
+    if (!host) {
+        return `${proto}://localhost`;
+    }
+
+    return `${proto}://${host}`;
+};
+
+const getRequestUrl = (req) => {
+    try {
+        return new URL(req.url, getRequestOrigin(req));
+    } catch (error) {
+        return new URL('http://localhost');
+    }
+};
+
+const sendJson = (res, statusCode, payload) => {
+    res.statusCode = statusCode;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify(payload));
+};
+
+const parseJsonBody = (req) => {
+    if (!req) return {};
+
+    if (req.body && typeof req.body === 'object') {
+        return req.body;
+    }
+
+    let raw = req.body;
+
+    if (!raw && typeof req.__body !== 'undefined') {
+        raw = req.__body;
+    }
+
+    if (Buffer.isBuffer(raw)) {
+        raw = raw.toString('utf8');
+    }
+
+    if (typeof raw !== 'string') {
+        return {};
+    }
+
+    try {
+        return JSON.parse(raw);
+    } catch (error) {
+        return {};
+    }
+};
+
+const getSharedSecret = () => pickFirstString(SECRET_ENV_KEYS.map((key) => process.env[key]));
+
+const getSharedSecretFromRequest = (req) => pickFirstString(SECRET_HEADER_KEYS.map((key) => getHeader(req, key)));
+
+const timingSafeEqual = (expected, provided) => {
+    const expectedBuffer = Buffer.from(expected, 'utf8');
+    const providedBuffer = Buffer.from(provided, 'utf8');
+
+    if (expectedBuffer.length !== providedBuffer.length) {
+        return false;
+    }
+
+    return crypto.timingSafeEqual(expectedBuffer, providedBuffer);
+};
+
+const verifySharedSecret = (req) => {
+    const expected = getSharedSecret();
+    if (!expected) {
+        return {
+            ok        : false,
+            statusCode: 500,
+            message   : 'Shared secret is not configured on the server.',
+        };
+    }
+
+    const provided = getSharedSecretFromRequest(req);
+    if (!provided) {
+        return {
+            ok        : false,
+            statusCode: 401,
+            message   : 'Missing shared secret header.',
+        };
+    }
+
+    if (!timingSafeEqual(expected, provided)) {
+        return {
+            ok        : false,
+            statusCode: 401,
+            message   : 'Invalid shared secret.',
+        };
+    }
+
+    return { ok: true, secret: expected };
+};
+
+const respondWithOptions = (res, allow = []) => {
+    if (allow.length) {
+        res.setHeader('Allow', allow.join(', '));
+    }
+    res.statusCode = 204;
+    res.end();
+};
+
+module.exports = {
+    getRequestUrl,
+    getRequestOrigin,
+    sendJson,
+    parseJsonBody,
+    getSharedSecret,
+    verifySharedSecret,
+    respondWithOptions,
+};

package/api/_lib/legal_consent_store.js

@@ -0,0 +1,108 @@
+const { Redis } = require('@upstash/redis');
+
+const CONSENT_TTL_SECONDS = Number(process.env.LEGAL_CONSENT_TTL_SECONDS || 365 * 24 * 60 * 60);
+const REDIS_URL = process.env.UPSTASH_REDIS_REST_URL;
+const REDIS_TOKEN = process.env.UPSTASH_REDIS_REST_TOKEN;
+
+let redisClient;
+let memoryStore;
+
+const getRedisClient = () => {
+  if (redisClient !== undefined) {
+    return redisClient;
+  }
+
+  if (REDIS_URL && REDIS_TOKEN) {
+    redisClient = new Redis({
+      url: REDIS_URL,
+      token: REDIS_TOKEN,
+    });
+  } else {
+    redisClient = null;
+    if (!global.__smartanalizerLegalConsentStore) {
+      Object.defineProperty(global, '__smartanalizerLegalConsentStore', {
+        value: new Map(),
+        enumerable: false,
+        configurable: false,
+        writable: false,
+      });
+    }
+    memoryStore = global.__smartanalizerLegalConsentStore;
+  }
+
+  return redisClient;
+};
+
+const getConsentKey = (telegramId) => `telegram:legal_consent:${telegramId}`;
+
+const serialize = (payload) => JSON.stringify(payload);
+const deserialize = (raw) => {
+  if (!raw) return null;
+  if (typeof raw === 'object') return raw;
+  try {
+    return JSON.parse(raw);
+  } catch (error) {
+    return null;
+  }
+};
+
+const storeConsent = async (telegramId, record) => {
+  if (!telegramId || !record) return null;
+
+  const normalized = {
+    ...record,
+    stored_at: record.stored_at || Date.now(),
+  };
+
+  const key = getConsentKey(telegramId);
+  const redis = getRedisClient();
+
+  if (redis) {
+    await redis.set(key, serialize(normalized), {
+      ex: CONSENT_TTL_SECONDS > 0 ? CONSENT_TTL_SECONDS : undefined,
+    });
+  } else if (memoryStore) {
+    memoryStore.set(key, normalized);
+  }
+
+  return normalized;
+};
+
+const loadConsent = async (telegramId) => {
+  if (!telegramId) return null;
+  const key = getConsentKey(telegramId);
+  const redis = getRedisClient();
+  let raw;
+
+  if (redis) {
+    raw = await redis.get(key);
+  } else if (memoryStore) {
+    raw = memoryStore.get(key);
+  }
+
+  return deserialize(raw);
+};
+
+const deleteConsent = async (telegramId) => {
+  if (!telegramId) return false;
+  const key = getConsentKey(telegramId);
+  const redis = getRedisClient();
+
+  if (redis) {
+    await redis.del(key);
+    return true;
+  }
+
+  if (memoryStore) {
+    return memoryStore.delete(key);
+  }
+
+  return false;
+};
+
+module.exports = {
+  storeConsent,
+  loadConsent,
+  deleteConsent,
+  CONSENT_TTL_SECONDS,
+};

package/api/_lib/telegram_session_store.js

@@ -0,0 +1,182 @@
+const crypto = require('crypto');
+const { Redis } = require('@upstash/redis');
+
+const SESSION_SECRET = process.env.TELEGRAM_SESSION_SECRET || '';
+const SESSION_TTL_SECONDS = Number(process.env.TELEGRAM_SESSION_TTL_SECONDS || 24 * 60 * 60);
+const REDIS_URL = process.env.UPSTASH_REDIS_REST_URL;
+const REDIS_TOKEN = process.env.UPSTASH_REDIS_REST_TOKEN;
+
+let redisClient;
+let memoryStore;
+
+const getRedisClient = () => {
+    if (redisClient !== undefined) {
+        return redisClient;
+    }
+
+    if (REDIS_URL && REDIS_TOKEN) {
+        redisClient = new Redis({
+            url  : REDIS_URL,
+            token: REDIS_TOKEN,
+        });
+    } else {
+        redisClient = null;
+        if (!global.__telegramSessionStore) {
+            Object.defineProperty(global, '__telegramSessionStore', {
+                value       : new Map(),
+                enumerable  : false,
+                configurable: false,
+                writable    : false,
+            });
+        }
+        memoryStore = global.__telegramSessionStore;
+    }
+
+    return redisClient;
+};
+
+const ensureSecretKey = () => {
+    if (!SESSION_SECRET) {
+        const error = new Error('TELEGRAM_SESSION_SECRET environment variable is not configured.');
+        error.code = 'TELEGRAM_SESSION_SECRET_MISSING';
+        throw error;
+    }
+};
+
+const getDerivedKey = () => crypto.createHash('sha256').update(SESSION_SECRET).digest();
+
+const serializeBuffer = (buffer) => buffer.toString('base64');
+const deserializeBuffer = (value) => Buffer.from(value, 'base64');
+
+const encrypt = (plaintext) => {
+    if (plaintext === undefined || plaintext === null) return null;
+    ensureSecretKey();
+    const key = getDerivedKey();
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const encrypted = Buffer.concat([cipher.update(String(plaintext), 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+
+    return serializeBuffer(Buffer.concat([iv, tag, encrypted]));
+};
+
+const decrypt = (ciphertext) => {
+    if (!ciphertext) return null;
+    ensureSecretKey();
+    const key = getDerivedKey();
+    const buffer = deserializeBuffer(ciphertext);
+    const iv = buffer.subarray(0, 12);
+    const tag = buffer.subarray(12, 28);
+    const encrypted = buffer.subarray(28);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+    return decrypted.toString('utf8');
+};
+
+const getSessionKey = (telegramId) => `telegram:sessions:${telegramId}`;
+
+const serializeSession = (session) => JSON.stringify(session);
+const deserializeSession = (raw) => {
+    if (!raw) return null;
+    if (typeof raw === 'object') return raw;
+    try {
+        return JSON.parse(raw);
+    } catch (error) {
+        return null;
+    }
+};
+
+const withTimestamps = (session) => ({
+    ...session,
+    stored_at : Date.now(),
+    expires_at: SESSION_TTL_SECONDS > 0
+        ? Date.now() + SESSION_TTL_SECONDS * 1000
+        : null,
+});
+
+const scrubAccount = (account) => ({
+    loginid        : account.loginid,
+    token_encrypted: encrypt(account.token),
+    currency       : account.currency,
+    is_virtual     : account.is_virtual,
+    account_type   : account.account_type,
+    landing_company: account.landing_company,
+});
+
+const expandAccount = (account) => ({
+    loginid        : account.loginid,
+    token          : decrypt(account.token_encrypted),
+    currency       : account.currency,
+    is_virtual     : account.is_virtual,
+    account_type   : account.account_type,
+    landing_company: account.landing_company,
+});
+
+const storeSession = async (telegramId, session) => {
+    if (!telegramId || !session) return null;
+
+    const record = withTimestamps({
+        ...session,
+        accounts: (session.accounts || []).map(scrubAccount),
+    });
+
+    const key = getSessionKey(telegramId);
+    const redis = getRedisClient();
+
+    if (redis) {
+        await redis.set(key, serializeSession(record), {
+            ex: SESSION_TTL_SECONDS > 0 ? SESSION_TTL_SECONDS : undefined,
+        });
+    } else if (memoryStore) {
+        memoryStore.set(key, record);
+    }
+
+    return record;
+};
+
+const loadSession = async (telegramId) => {
+    if (!telegramId) return null;
+    const key = getSessionKey(telegramId);
+    const redis = getRedisClient();
+    let raw;
+
+    if (redis) {
+        raw = await redis.get(key);
+    } else if (memoryStore) {
+        raw = memoryStore.get(key);
+    }
+
+    const record = deserializeSession(raw);
+    if (!record) return null;
+
+    return {
+        ...record,
+        accounts: (record.accounts || []).map(expandAccount).filter(account => account.token),
+    };
+};
+
+const deleteSession = async (telegramId) => {
+    if (!telegramId) return false;
+    const key = getSessionKey(telegramId);
+    const redis = getRedisClient();
+
+    if (redis) {
+        await redis.del(key);
+        return true;
+    }
+
+    if (memoryStore) {
+        return memoryStore.delete(key);
+    }
+
+    return false;
+};
+
+module.exports = {
+    storeSession,
+    loadSession,
+    deleteSession,
+    ensureSecretKey,
+    SESSION_TTL_SECONDS,
+};