Spaces:
Sleeping
Sleeping
| import express from "express"; | |
| import { existsSync, readFileSync } from "node:fs"; | |
| import { timingSafeEqual } from "node:crypto"; | |
| import path from "node:path"; | |
| import { fileURLToPath } from "node:url"; | |
| import { answer } from "./answer.js"; | |
| import { COORDINATOR_EMAIL, KB_VERSION, LOOKUP_RATE_LIMIT, MAX_MESSAGE_CHARS, RATE_LIMIT } from "./constants.js"; | |
| import { createInsights } from "./insights.js"; | |
| import { gatesRequested, skipGates } from "./localtest.js"; | |
| import { lookup } from "./lookup.js"; | |
| import { verifyRecaptcha } from "./recaptcha.js"; | |
| import { buildIndex } from "./retrieve.js"; | |
| const here = path.dirname(fileURLToPath(import.meta.url)); | |
| // The coordinator lists dates in server/data/deadlines.json: [{ "label": "...", "date": "YYYY-MM-DD" }]. | |
| // Only dates that have not passed are shown. An empty file shows nothing. | |
| function upcomingDeadlines(file = path.resolve(here, "../data/deadlines.json")) { | |
| try { | |
| const today = new Date().toISOString().slice(0, 10); | |
| return JSON.parse(readFileSync(file, "utf8")) | |
| .filter((d) => typeof d.label === "string" && /^\d{4}-\d{2}-\d{2}$/.test(d.date) && d.date >= today) | |
| .sort((a, b) => a.date.localeCompare(b.date)) | |
| .slice(0, 3); | |
| } catch { | |
| return []; | |
| } | |
| } | |
| const sameKey = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b)); | |
| export function createApp({ kb, llm, apiKey, verify = verifyRecaptcha, log = console.log, allowedOrigin = process.env.ALLOWED_ORIGIN, env = process.env } = {}) { | |
| const index = buildIndex(kb); | |
| const insights = createInsights(kb.segments.map((s) => s.id)); | |
| const allowed = String(allowedOrigin || "").split(",").map((o) => o.trim()).filter(Boolean); | |
| const app = express(); | |
| app.disable("x-powered-by"); | |
| app.set("trust proxy", 1); | |
| app.use(express.json({ limit: "16kb" })); | |
| // Log method, path, status and time only. Never the request body. | |
| app.use((req, res, next) => { | |
| const t0 = Date.now(); | |
| res.on("finish", () => log(`${req.method} ${req.path} ${res.statusCode} ${Date.now() - t0}ms`)); | |
| next(); | |
| }); | |
| app.use((req, res, next) => { | |
| const origin = req.headers.origin; | |
| if (allowedOrigin && origin && allowed.includes(origin)) { | |
| res.setHeader("Access-Control-Allow-Origin", origin); | |
| res.setHeader("Vary", "Origin"); | |
| res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization"); | |
| res.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS"); | |
| } | |
| res.setHeader("X-Content-Type-Options", "nosniff"); | |
| res.setHeader("Referrer-Policy", "no-referrer"); | |
| if (req.method === "OPTIONS") return res.sendStatus(204); | |
| next(); | |
| }); | |
| const makeLimiter = ({ windowMs, max }) => { | |
| const hits = new Map(); | |
| return (req, res, next) => { | |
| if (skipGates(req, env)) return next(); | |
| const now = Date.now(); | |
| const rec = hits.get(req.ip); | |
| if (!rec || now - rec.start > windowMs) hits.set(req.ip, { start: now, n: 1 }); | |
| else if (++rec.n > max) { | |
| return res.status(429).json({ error: "Too many questions at once. Please wait a minute and try again." }); | |
| } | |
| next(); | |
| }; | |
| }; | |
| const chatLimiter = makeLimiter(RATE_LIMIT); | |
| const lookupLimiter = makeLimiter(LOOKUP_RATE_LIMIT); | |
| const validate = (req, res, next) => { | |
| const { message } = req.body ?? {}; | |
| if (typeof message !== "string" || !message.trim()) { | |
| return res.status(400).json({ error: "Type a question first." }); | |
| } | |
| if (message.length > MAX_MESSAGE_CHARS) { | |
| return res.status(400).json({ error: `Please keep it under ${MAX_MESSAGE_CHARS} characters.` }); | |
| } | |
| next(); | |
| }; | |
| app.get("/api/kb", (_req, res) => { | |
| const { version, glossary, groups, segments } = kb; | |
| res.json({ | |
| version, | |
| glossary, | |
| groups, | |
| coordinatorEmail: COORDINATOR_EMAIL, | |
| maxChars: MAX_MESSAGE_CHARS, | |
| popular: insights.popular(), | |
| deadlines: upcomingDeadlines(), | |
| recaptchaSiteKey: gatesRequested(env) ? null : env.RECAPTCHA_SITE_KEY || null, | |
| segments: segments.map(({ id, group, title, icon, blurb, steps }) => ({ id, group, title, icon, blurb, steps })), | |
| }); | |
| }); | |
| // Step 1: is there a written document for this? Free, no model call. | |
| app.post("/api/lookup", lookupLimiter, validate, (req, res) => { | |
| res.json({ doc: lookup(index, req.body.message.trim()) }); | |
| }); | |
| // Step 2 (when the document did not help): the chatbot. Rate limited and reCAPTCHA gated. | |
| app.post("/api/chat", chatLimiter, validate, async (req, res) => { | |
| const check = skipGates(req, env) ? { ok: true, reason: "local-testing" } : await verify(req.body.captchaToken, req.ip); | |
| if (!check.ok) { | |
| return res.status(403).json({ error: "We could not confirm you are a person. Please try again.", reason: check.reason }); | |
| } | |
| const { message, history } = req.body; | |
| const out = await answer({ index, message: message.trim(), history, llm, ...(apiKey !== undefined && { apiKey }) }); | |
| res.json(out); | |
| }); | |
| // Anonymous counts so the coordinator can see which answers get read and which fail. | |
| app.post("/api/event", lookupLimiter, (req, res) => { | |
| insights.record(req.body?.type, req.body?.id); | |
| res.sendStatus(204); | |
| }); | |
| app.get("/api/stats", (req, res) => { | |
| const key = env.STATS_KEY; | |
| const given = String(req.headers.authorization || "").replace(/^Bearer /, ""); | |
| if (!key) return res.sendStatus(404); | |
| if (!given || !sameKey(given, key)) return res.status(401).json({ error: "Wrong key." }); | |
| res.json(insights.snapshot()); | |
| }); | |
| app.get("/api/health", (_req, res) => res.json({ ok: true, kbVersion: KB_VERSION })); | |
| const dist = path.resolve(here, "../../web/dist"); | |
| if (existsSync(dist)) { | |
| app.use(express.static(dist)); | |
| app.get("*", (_req, res) => res.sendFile(path.join(dist, "index.html"))); | |
| } | |
| return app; | |
| } | |