Authentication

import express from "express";

export const DEFAULT_TOKEN_ENDPOINT =
  "https://api-v2.returning.ai/v2/api/widget-access-keys/token";

function noStore(response) {
  response.set("Cache-Control", "no-store, max-age=0");
  response.set("Pragma", "no-cache");
}

function jsonError(response, status, error) {
  noStore(response);
  return response.status(status).json({ error });
}

function readList(value) {
  return String(value ?? "")
    .split(",")
    .map((item) => item.trim())
    .filter(Boolean);
}

function readTimeout(value) {
  const timeoutMs = Number(value ?? 10_000);
  return Number.isFinite(timeoutMs) && timeoutMs > 0 && timeoutMs <= 30_000
    ? Math.floor(timeoutMs)
    : Number.NaN;
}

export function readConfig(env = process.env) {
  return {
    accessId: String(env.RAI_ACCESS_ID ?? "").trim(),
    accessKey: String(env.RAI_ACCESS_KEY ?? "").trim(),
    userIdentifierKeys: readList(env.RAI_USER_IDENTIFIER_KEYS),
    tokenEndpoint: String(
      env.RAI_TOKEN_ENDPOINT || DEFAULT_TOKEN_ENDPOINT,
    ).trim(),
    timeoutMs: readTimeout(env.RAI_TOKEN_TIMEOUT_MS),
  };
}

function getConfigurationProblems(config) {
  const problems = [];
  if (!config.accessId) problems.push("RAI_ACCESS_ID");
  if (!config.accessKey) problems.push("RAI_ACCESS_KEY");
  if (config.userIdentifierKeys.length === 0) {
    problems.push("RAI_USER_IDENTIFIER_KEYS");
  }
  if (
    config.userIdentifierKeys.some(
      (key) => !key.startsWith("data-") || key.length <= 5 || /\s/.test(key),
    )
  ) {
    problems.push("RAI_USER_IDENTIFIER_KEYS");
  }
  if (!Number.isFinite(config.timeoutMs)) problems.push("RAI_TOKEN_TIMEOUT_MS");
  return problems;
}

function isCrossSiteRequest(request) {
  if (String(request.get("sec-fetch-site") || "").toLowerCase() === "cross-site") {
    return true;
  }

  const origin = request.get("origin");
  if (!origin) return false;

  let originUrl;
  try {
    originUrl = new URL(origin);
  } catch {
    return true;
  }

  const requestProtocol = request.protocol === "https" ? "https:" : "http:";
  const requestHost = String(request.get("host") || "").toLowerCase();
  return (
    originUrl.protocol !== requestProtocol ||
    originUrl.host.toLowerCase() !== requestHost
  );
}

/**
 * Host-session adapter boundary.
 *
 * Install the host application's existing session/auth middleware before this
 * route. It must set request.user from the server-side session. The browser
 * may send a session cookie, but it must not choose an identity in a query,
 * body, or browser-controlled header. Replace this fallback with the host's
 * trusted lookup when integrating the example.
 */
function getAuthenticatedUser(request) {
  return request.user ?? null;
}

function selectConfiguredIdentifiers(user, keys) {
  const source = user?.identifiers;
  if (!source || typeof source !== "object" || Array.isArray(source)) {
    throw new Error("Authenticated host user has no identifier map");
  }

  const identifiers = {};
  for (const key of keys) {
    const value = source[key];
    if (
      typeof value !== "string" &&
      !(typeof value === "number" && Number.isFinite(value))
    ) {
      throw new Error(`Authenticated host user is missing ${key}`);
    }
    const normalized = String(value).trim();
    if (!normalized) throw new Error(`Authenticated host user is missing ${key}`);
    identifiers[key] = normalized;
  }
  return identifiers;
}

async function requestEmbedToken(config, userIdentifiers, fetchImpl) {
  const controller = new AbortController();
  const timeout = setTimeout(() => controller.abort(), config.timeoutMs);

  try {
    const response = await fetchImpl(config.tokenEndpoint, {
      method: "POST",
      headers: {
        Accept: "application/json",
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        accessId: config.accessId,
        accessKey: config.accessKey,
        userIdentifiers,
      }),
      signal: controller.signal,
      cache: "no-store",
    });

    if (!response?.ok) {
      throw new Error("Returning.AI token endpoint returned a non-success status");
    }

    let payload;
    try {
      payload = await response.json();
    } catch {
      throw new Error("Returning.AI token response was not valid JSON");
    }

    const data =
      payload && typeof payload === "object" && !Array.isArray(payload)
        ? payload.data
        : null;
    if (!data || typeof data !== "object" || Array.isArray(data)) {
      throw new Error("Returning.AI token response had malformed data");
    }

    const embedToken = data.embedToken;
    if (typeof embedToken !== "string" || !embedToken.trim()) {
      throw new Error("Returning.AI token response did not include data.embedToken");
    }

    if (
      data.expiresIn !== undefined &&
      !(
        typeof data.expiresIn === "number" &&
        Number.isFinite(data.expiresIn) &&
        data.expiresIn > 0
      )
    ) {
      throw new Error("Returning.AI token response had invalid data.expiresIn");
    }

    return data.expiresIn === undefined
      ? { embedToken }
      : { embedToken, expiresIn: data.expiresIn };
  } finally {
    clearTimeout(timeout);
  }
}

/**
 * Create the host application route.
 *
 * `hostSessionMiddleware` is the existing host session/auth setup. The
 * default is intentionally unauthenticated so an unwired example cannot mint
 * a token. The route itself remains independent of the frontend framework.
 */
export function createApp({
  env = process.env,
  fetchImpl = globalThis.fetch,
  hostSessionMiddleware,
  getUser = getAuthenticatedUser,
} = {}) {
  const config = readConfig(env);
  const app = express();
  app.disable("x-powered-by");
  app.use(hostSessionMiddleware ?? ((_request, _response, next) => next()));

  app.all("/api/widget-token", async (request, response) => {
    if (request.method !== "GET") {
      return jsonError(response, 405, "Method not allowed");
    }
    if (isCrossSiteRequest(request)) {
      return jsonError(response, 403, "Cross-site token requests are not allowed");
    }

    if (getConfigurationProblems(config).length > 0) {
      return jsonError(response, 503, "The token route is not configured yet");
    }

    let user;
    try {
      user = await getUser(request);
    } catch {
      return jsonError(response, 500, "Authentication setup failed");
    }
    if (!user) return jsonError(response, 401, "Sign-in is required");

    let userIdentifiers;
    try {
      userIdentifiers = selectConfiguredIdentifiers(
        user,
        config.userIdentifierKeys,
      );
    } catch {
      return jsonError(
        response,
        500,
        "The authenticated user is missing a configured identifier",
      );
    }

    try {
      const token = await requestEmbedToken(
        config,
        userIdentifiers,
        fetchImpl,
      );
      noStore(response);
      return response.status(200).json(token);
    } catch {
      return jsonError(response, 502, "Unable to mint a widget token");
    }
  });

  app.use((_error, _request, response, _next) => {
    return jsonError(response, 500, "Request failed");
  });

  return app;
}