zengate 1.0.0 → 1.0.2

package/README.md

@@ -3,6 +3,7 @@
 [![CI](https://github.com/developingchet/zengate/actions/workflows/ci.yml/badge.svg)](https://github.com/developingchet/zengate/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/zengate)](https://www.npmjs.com/package/zengate)
 [![Docker Hub](https://img.shields.io/docker/v/developingchet/zengate?label=docker&sort=semver)](https://hub.docker.com/r/developingchet/zengate)
+[![Socket](https://socket.dev/api/badge/npm/package/zengate)](https://socket.dev/npm/package/zengate)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
 An **OpenAI-compatible API for OpenCode's free Zen models: no Zen account or upstream API key needed.**

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "zengate",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Keyless OpenAI-compatible API (Chat Completions + Responses) for OpenCode's free Zen models, served through the real OpenCode CLI.",
+  "author": {
+    "name": "developingchet",
+    "url": "https://github.com/developingchet"
+  },
   "homepage": "https://github.com/developingchet/zengate#readme",
   "repository": {
     "type": "git",
@@ -46,12 +50,16 @@
     "self-hosted"
   ],
   "license": "MIT",
-  "engines": {
-    "node": ">=24.0.0"
-  },
   "dependencies": {
-    "cors": "^2.8.5",
     "express": "^5.1.0",
     "opencode-ai": "^1.18.32"
+  },
+  "overrides": {
+    "es-define-property": "npm:@socketregistry/es-define-property@^1",
+    "safer-buffer": "npm:@socketregistry/safer-buffer@^1",
+    "side-channel": "npm:@socketregistry/side-channel@^1"
+  },
+  "engines": {
+    "node": ">=24.0.0"
   }
 }

package/src/server/app.js

@@ -1,8 +1,8 @@
-import cors from 'cors';
 import express from 'express';
 import { chatCompletionsHandler } from '../openai/chat.js';
 import { modelsHandlers } from '../openai/models.js';
 import { responsesHandlers } from '../openai/responses.js';
+import { corsMiddleware } from './cors.js';
 import { ApiError, sendError, toApiError } from './errors.js';
 import { createLimiter } from './limiter.js';
 import { createMetrics } from './metrics.js';
@@ -68,7 +68,7 @@ export function createApp({ config, logger, backend, hub, catalog, runner, store
     app.set('trust proxy', config.TRUST_PROXY || false);
     app.use(requestId, securityHeaders, metrics.middleware, requestLogger(logger));
     if (config.CORS_ORIGINS.length) {
-        app.use(cors({ origin: config.CORS_ORIGINS, exposedHeaders: EXPOSED_HEADERS, maxAge: 600 }));
+        app.use(corsMiddleware({ origins: config.CORS_ORIGINS, exposedHeaders: EXPOSED_HEADERS, maxAge: 600 }));
     }
 
     app.get('/health', (req, res) => res.json({ status: 'ok' }));

package/src/server/cors.js

@@ -0,0 +1,33 @@
+const ALLOWED_METHODS = 'GET,HEAD,POST,DELETE,OPTIONS';
+// A comma-separated list of HTTP header names (RFC 9110 tokens).
+const HEADER_LIST = /^[!#$%&'*+.^`|~\w-]+(?:\s*,\s*[!#$%&'*+.^`|~\w-]+)*$/;
+
+/**
+ * CORS for an explicit list of browser origins. Origins are matched exactly,
+ * credentials are never allowed, and preflights are answered directly.
+ * @param {{ origins: string[], exposedHeaders: string[], maxAge: number }} options
+ */
+export function corsMiddleware({ origins, exposedHeaders, maxAge }) {
+    const allowed = new Set(origins);
+    const exposed = exposedHeaders.join(',');
+
+    return (req, res, next) => {
+        const origin = req.headers.origin;
+        if (!origin) return next();
+        res.vary('Origin');
+        const granted = allowed.has(origin);
+        const isPreflight = req.method === 'OPTIONS' && Boolean(req.headers['access-control-request-method']);
+
+        if (!isPreflight) {
+            if (granted) res.set({ 'Access-Control-Allow-Origin': origin, 'Access-Control-Expose-Headers': exposed });
+            return next();
+        }
+        if (granted) {
+            const requested = String(req.headers['access-control-request-headers'] || '').trim();
+            res.set({ 'Access-Control-Allow-Origin': origin, 'Access-Control-Allow-Methods': ALLOWED_METHODS, 'Access-Control-Max-Age': String(maxAge) });
+            if (requested && HEADER_LIST.test(requested)) res.set('Access-Control-Allow-Headers', requested);
+            res.vary('Access-Control-Request-Headers');
+        }
+        return res.status(204).end();
+    };
+}

package/src/server/middleware.js

@@ -3,17 +3,25 @@ import { ApiError, sendError } from './errors.js';
 
 const PUBLIC_PATHS = new Set(['/health', '/ready']);
 
-/** Constant-time comparison; hashing first hides the key length. */
-function safeEqual(a, b) {
-    const ha = crypto.createHash('sha256').update(a).digest();
-    const hb = crypto.createHash('sha256').update(b).digest();
-    return crypto.timingSafeEqual(ha, hb);
+const BEARER = 'bearer';
+
+/**
+ * Constant-time comparison of the key bytes. Only the length can differ in
+ * timing, and key lengths are not secret (generated keys have a fixed format).
+ */
+function safeEqual(presented, expected) {
+    const a = Buffer.from(presented);
+    const b = Buffer.from(expected);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
 }
 
+/** The key from `Authorization: Bearer <key>`, parsed without a backtracking regex. */
 function presentedKey(req) {
-    const header = req.headers.authorization || '';
-    const match = /^Bearer\s+(.+)$/i.exec(header);
-    return match ? match[1].trim() : '';
+    const header = typeof req.headers.authorization === 'string' ? req.headers.authorization.trim() : '';
+    const scheme = header.slice(0, BEARER.length);
+    const separator = header.charAt(BEARER.length);
+    if (scheme.toLowerCase() !== BEARER || !/\s/.test(separator)) return '';
+    return header.slice(BEARER.length + 1).trim();
 }
 
 /**
@@ -25,9 +33,11 @@ export function authMiddleware({ apiKeys, allowNoAuth, onFailure }) {
         req.clientId = 'anonymous';
         if (allowNoAuth || PUBLIC_PATHS.has(req.path) || req.method === 'OPTIONS') return next();
         const key = presentedKey(req);
-        if (key && apiKeys.some((candidate) => safeEqual(key, candidate))) {
-            // Opaque per-key id: scopes stored responses to the key that made them.
-            req.clientId = crypto.createHash('sha256').update(key).digest('hex').slice(0, 32);
+        const index = key ? apiKeys.findIndex((candidate) => safeEqual(key, candidate)) : -1;
+        if (index !== -1) {
+            // Names the matched key without deriving anything from it; scopes
+            // stored responses to the key that made them.
+            req.clientId = `key_${index}`;
             return next();
         }
         onFailure?.();