Update app.js

app.js

@@ -41,32 +41,18 @@ try {
 
 const verifySupabaseUser = async (req, res, next) => {
     const debugMode = process.env.DEBUG_NO_AUTH === 'true';
-
-    if (debugMode) {
-        req.user = { id: "user_dev_01" };
-        return next();
-    }
-
+    if (debugMode) { req.user = { id: "user_dev_01" }; return next(); }
     const authHeader = req.headers.authorization;
-    if (!authHeader || !authHeader.startsWith('Bearer ')) {
-        return res.status(401).json({ error: 'Missing Bearer token' });
-    }
-
+    if (!authHeader || !authHeader.startsWith('Bearer ')) return res.status(401).json({ error: 'Missing Bearer token' });
     const idToken = authHeader.split('Bearer ')[1];
-
     try {
         if (supabase) {
             const { data: { user }, error } = await supabase.auth.getUser(idToken);
             if (error || !user) throw new Error("Invalid Token");
             req.user = user;
             next();
-        } else {
-            req.user = { id: "memory_user" };
-            next();
-        }
-    } catch (error) {
-        return res.status(403).json({ error: 'Unauthorized', details: error.message });
-    }
+        } else { req.user = { id: "memory_user" }; next(); }
+    } catch (error) { return res.status(403).json({ error: 'Unauthorized', details: error.message }); }
 };
 
 async function getSessionSecret(uid, projectId) {
@@ -76,25 +62,14 @@ async function getSessionSecret(uid, projectId) {
         session.lastAccessed = Date.now();
         return session.secret;
     }
-
     if (supabase) {
         try {
-            const { data, error } = await supabase
-                .from('projects')
-                .select('plugin_secret')
-                .eq('id', projectId)
-                .eq('user_id', uid)
-                .single();
-
+            const { data } = await supabase.from('projects').select('plugin_secret').eq('id', projectId).eq('user_id', uid).single();
             if (data && data.plugin_secret) {
-                const secret = data.plugin_secret;
-                activeSessions.set(cacheKey, { secret, lastAccessed: Date.now() });
-                console.log(`💧 Hydrated secret for ${cacheKey} from DB`);
-                return secret;
+                activeSessions.set(cacheKey, { secret: data.plugin_secret, lastAccessed: Date.now() });
+                return data.plugin_secret;
             }
-        } catch (err) {
-            console.error("DB Read Error:", err);
-        }
+        } catch (err) { console.error("DB Read Error:", err); }
     }
     return null;
 }
@@ -102,47 +77,21 @@ async function getSessionSecret(uid, projectId) {
 app.post('/key', verifySupabaseUser, (req, res) => {
     const { projectId } = req.body;
     if (!projectId) return res.status(400).json({ error: 'projectId required' });
-
     const key = `key_${uuidv4().replace(/-/g, '')}`;
-    
-    tempKeys.set(key, {
-        uid: req.user.id, 
-        projectId: projectId,
-        createdAt: Date.now()
-    });
-
+    tempKeys.set(key, { uid: req.user.id, projectId: projectId, createdAt: Date.now() });
     console.log(`🔑 Generated Key for user ${req.user.id}: ${key}`);
     res.json({ key, expiresIn: 300 });
 });
 
 app.post('/redeem', async (req, res) => {
     const { key } = req.body;
-    
-    if (!key || !tempKeys.has(key)) {
-        return res.status(404).json({ error: 'Invalid or expired key' });
-    }
-
+    if (!key || !tempKeys.has(key)) return res.status(404).json({ error: 'Invalid or expired key' });
     const data = tempKeys.get(key);
     const sessionSecret = uuidv4(); 
-    
-    const token = jwt.sign(
-        { uid: data.uid, projectId: data.projectId }, 
-        sessionSecret, 
-        { expiresIn: '3d' } 
-    );
-
+    const token = jwt.sign({ uid: data.uid, projectId: data.projectId }, sessionSecret, { expiresIn: '3d' });
     const cacheKey = `${data.uid}:${data.projectId}`;
-
     activeSessions.set(cacheKey, { secret: sessionSecret, lastAccessed: Date.now() });
-
-    if (supabase) {
-        await supabase
-            .from('projects')
-            .update({ plugin_secret: sessionSecret })
-            .eq('id', data.projectId)
-            .eq('user_id', data.uid);
-    }
-
+    if (supabase) await supabase.from('projects').update({ plugin_secret: sessionSecret }).eq('id', data.projectId).eq('user_id', data.uid);
     tempKeys.delete(key);
     console.log(`🚀 Redeemed JWT for ${cacheKey}`);
     res.json({ token });
@@ -150,291 +99,117 @@ app.post('/redeem', async (req, res) => {
 
 app.post('/verify', async (req, res) => {
     const { token } = req.body;
-    if (!token) return res.status(400).json({ valid: false, error: 'Token required' });
-
+    if (!token) return res.status(400).json({ valid: false });
     const decoded = jwt.decode(token);
-    if (!decoded || !decoded.uid || !decoded.projectId) {
-        return res.status(401).json({ valid: false, error: 'Malformed token' });
-    }
-
+    if (!decoded || !decoded.uid || !decoded.projectId) return res.status(401).json({ valid: false });
     const secret = await getSessionSecret(decoded.uid, decoded.projectId);
-
-    if (!secret) {
-        return res.status(401).json({ valid: false, error: 'Session revoked' });
-    }
-
-    try {
-        jwt.verify(token, secret);
-        const threeDaysInSeconds = 3 * 24 * 60 * 60;
-        const nowInSeconds = Math.floor(Date.now() / 1000);
-        if (decoded.iat && (nowInSeconds - decoded.iat > threeDaysInSeconds)) {
-             return res.status(403).json({ valid: false, error: 'Expired' });
-        }
-
-        return res.json({ valid: true });
-    } catch (err) {
-        return res.status(403).json({ valid: false, error: 'Invalid signature' });
-    }
+    if (!secret) return res.status(401).json({ valid: false });
+    try { jwt.verify(token, secret); return res.json({ valid: true }); } catch (err) { return res.status(403).json({ valid: false }); }
 });
 
 app.post('/feedback', async (req, res) => {
     const { token, ...pluginPayload } = req.body;
-
     if (!token) return res.status(400).json({ error: 'Token required' });
-
     const decoded = jwt.decode(token);
-    if (!decoded || !decoded.uid || !decoded.projectId) {
-        return res.status(401).json({ error: 'Malformed token' });
-    }
-
+    if (!decoded) return res.status(401).json({ error: 'Malformed token' });
     const secret = await getSessionSecret(decoded.uid, decoded.projectId);
     if (!secret) return res.status(404).json({ error: 'Session revoked' });
-
     try {
         jwt.verify(token, secret); 
-
         const targetUrl = EXTERNAL_SERVER_URL.replace(/\/$/, '') + '/project/feedback';
-
-        console.log(`📨 Forwarding PLUGIN feedback for ${decoded.projectId} (${decoded.uid})`);
-
-        const response = await axios.post(targetUrl, {
-            userId: decoded.uid,       
-            projectId: decoded.projectId, 
-            ...pluginPayload           
-        });
-
+        const response = await axios.post(targetUrl, { userId: decoded.uid, projectId: decoded.projectId, ...pluginPayload });
         return res.json({ success: true, externalResponse: response.data });
-
-    } catch (err) {
-        console.error("Feedback Forward Error:", err.message);
-        if (err.response) {
-            return res.status(err.response.status).json(err.response.data);
-        }
-        return res.status(502).json({ error: 'Failed to forward feedback to Main AI server' });
-    }
+    } catch (err) { return res.status(502).json({ error: 'Failed to forward' }); }
 });
 
 app.post('/feedback2', verifySupabaseUser, async (req, res) => {
     const { projectId, prompt, images, ...otherPayload } = req.body; 
     const userId = req.user.id;
-
-    if (!projectId || !prompt) {
-        return res.status(400).json({ error: 'Missing projectId or prompt' });
-    }
-
+    if (!projectId || !prompt) return res.status(400).json({ error: 'Missing projectId or prompt' });
     const targetUrl = EXTERNAL_SERVER_URL.replace(/\/$/, '') + '/project/feedback';
-
     try {
-        const response = await axios.post(targetUrl, {
-            userId: userId,
-            projectId: projectId,
-            prompt: prompt,
-            images: images || [], 
-            ...otherPayload
-        });
-
+        const response = await axios.post(targetUrl, { userId: userId, projectId: projectId, prompt: prompt, images: images || [], ...otherPayload });
         return res.json({ success: true, externalResponse: response.data });
-    } catch (err) {
-        console.error("Forward Error:", err.message);
-        return res.status(502).json({ error: 'Failed to forward' });
-    }
+    } catch (err) { return res.status(502).json({ error: 'Failed to forward' }); }
 });
 
+// --- STREAM FEED (Optimized headers) ---
 app.post('/stream-feed', verifySupabaseUser, async (req, res) => {
     const { projectId } = req.body;
     const userId = req.user.id;
 
-    if (!projectId) {
-        return res.status(400).json({ error: 'Missing projectId' });
-    }
+    // Headers to disable caching for poller
+    res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+    res.setHeader('Pragma', 'no-cache');
+    res.setHeader('Expires', '0');
+
+    if (!projectId) return res.status(400).json({ error: 'Missing projectId' });
     
     if (supabase) {
-         const { data, error } = await supabase
-             .from('projects')
-             .select('id, user_id, info')
-             .eq('id', projectId)
-             .single();
-
-         if (error || !data || data.user_id !== userId) {
-             return res.status(403).json({ error: 'Unauthorized' });
-         }
+         const { data, error } = await supabase.from('projects').select('id, user_id, info').eq('id', projectId).single();
+         if (error || !data || data.user_id !== userId) return res.status(403).json({ error: 'Unauthorized' });
          
          const targetUrl = EXTERNAL_SERVER_URL.replace(/\/$/, '') + '/project/ping';
-
          try {
-             const response = await axios.post(targetUrl, {
-                 projectId: projectId,
-                 userId: userId,
-                 isFrontend: true
-             });
-             
-             return res.json({ 
-                 ...response.data, 
-                 dbStatus: data.info?.status || 'idle' 
-             });
-         } catch (e) {
-             return res.status(502).json({ error: "AI Server Unreachable" });
-         }
+             const response = await axios.post(targetUrl, { projectId, userId, isFrontend: true });
+             return res.json({ ...response.data, dbStatus: data.info?.status || 'idle' });
+         } catch (e) { return res.status(502).json({ error: "AI Server Unreachable" }); }
     }
 });
 
 app.post('/poll', async (req, res) => {
     const { token } = req.body;
-
     if (!token) return res.status(400).json({ error: 'Token required' });
-
     const decoded = jwt.decode(token);
-    if (!decoded || !decoded.uid || !decoded.projectId) {
-        return res.status(401).json({ error: 'Malformed token' });
-    }
-
+    if (!decoded) return res.status(401).json({ error: 'Malformed token' });
     const secret = await getSessionSecret(decoded.uid, decoded.projectId);
-    if (!secret) return res.status(404).json({ error: 'Session revoked or not found' });
-
+    if (!secret) return res.status(404).json({ error: 'Session revoked' });
     try {
-        const verifiedData = jwt.verify(token, secret);
-
-        const threeDaysInSeconds = 3 * 24 * 60 * 60;
-        const nowInSeconds = Math.floor(Date.now() / 1000);
-        if (verifiedData.iat && (nowInSeconds - verifiedData.iat > threeDaysInSeconds)) {
-             return res.status(403).json({ error: 'Token expired (older than 3 days)' });
-        }
-        
+        jwt.verify(token, secret);
         const targetUrl = EXTERNAL_SERVER_URL.replace(/\/$/, '') + '/project/ping'; 
-      
-        try {
-            const response = await axios.post(targetUrl, {
-              projectId: verifiedData.projectId,
-              userId: verifiedData.uid
-            });
-          
-            return res.json(response.data); 
-        } catch (extError) {
-            return res.status(502).json({ error: 'External server error' });
-        }
-
-    } catch (err) {
-        return res.status(403).json({ error: 'Invalid Token Signature' });
-    }
+        const response = await axios.post(targetUrl, { projectId: decoded.projectId, userId: decoded.uid });
+        return res.json(response.data); 
+    } catch (err) { return res.status(403).json({ error: 'Invalid Token' }); }
 });
 
 app.post('/project/delete', verifySupabaseUser, async (req, res) => {
     const { projectId } = req.body;
     const userId = req.user.id;
-
     if (!projectId) return res.status(400).json({ error: "Missing Project ID" });
-
-    console.log(`🗑️ Deleting Project: ${projectId} requested by ${userId}`);
-
     try {
-        const { data: project, error: fetchError } = await supabase
-            .from('projects')
-            .select('user_id')
-            .eq('id', projectId)
-            .single();
-
-        if (fetchError || !project || project.user_id !== userId) {
-            return res.status(403).json({ error: "Unauthorized" });
-        }
-
-        const { error: chunkError } = await supabase
-            .from('message_chunks')
-            .delete()
-            .eq('project_id', projectId);
-
-        if (chunkError) {
-            console.warn(`Warning: Failed to delete message chunks: ${chunkError.message}`);
-        }
-
-        const { error: dbError } = await supabase
-            .from('projects')
-            .delete()
-            .eq('id', projectId);
-        
-        if (dbError) throw dbError;
-
+        const { data: project, error: fetchError } = await supabase.from('projects').select('user_id').eq('id', projectId).single();
+        if (fetchError || !project || project.user_id !== userId) return res.status(403).json({ error: "Unauthorized" });
+        await supabase.from('message_chunks').delete().eq('project_id', projectId);
+        await supabase.from('projects').delete().eq('id', projectId);
         if (STORAGE_BUCKET) {
             const { data: files } = await supabase.storage.from(STORAGE_BUCKET).list(projectId);
-            
-            if (files && files.length > 0) {
-                const filesToRemove = files.map(f => `${projectId}/${f.name}`);
-                await supabase.storage.from(STORAGE_BUCKET).remove(filesToRemove);
-            }
+            if (files && files.length > 0) { const filesToRemove = files.map(f => `${projectId}/${f.name}`); await supabase.storage.from(STORAGE_BUCKET).remove(filesToRemove); }
         }
-
         activeSessions.delete(`${userId}:${projectId}`);
-        for (const [key, val] of tempKeys.entries()) {
-            if (val.projectId === projectId) tempKeys.delete(key);
-        }
-        
-        console.log(`✅ Project ${projectId} deleted successfully.`);
+        for (const [key, val] of tempKeys.entries()) { if (val.projectId === projectId) tempKeys.delete(key); }
         res.json({ success: true });
-
-    } catch (err) {
-        console.error("Delete Error:", err);
-        res.status(500).json({ error: "Failed to delete project resources" });
-    }
+    } catch (err) { res.status(500).json({ error: "Delete failed" }); }
 });
 
 app.get('/cleanup', (req, res) => {
+    // ... (Standard cleanup) ...
     const THRESHOLD = 1000 * 60 * 60; 
     const now = Date.now();
     let cleanedCount = 0;
-
-    for (const [key, value] of activeSessions.entries()) {
-        if (now - value.lastAccessed > THRESHOLD) {
-            activeSessions.delete(key);
-            cleanedCount++;
-        }
-    }
-    for (const [key, value] of tempKeys.entries()) {
-        if (now - value.createdAt > (1000 * 60 * 4)) {
-            tempKeys.delete(key);
-        }
-    }
+    for (const [key, value] of activeSessions.entries()) { if (now - value.lastAccessed > THRESHOLD) { activeSessions.delete(key); cleanedCount++; } }
+    for (const [key, value] of tempKeys.entries()) { if (now - value.createdAt > (1000 * 60 * 4)) { tempKeys.delete(key); } }
     res.json({ message: `Cleaned ${cleanedCount} cached sessions from memory.` });
 });
 
 app.post('/nullify', verifySupabaseUser, async (req, res) => {
     const { projectId } = req.body;
     if (!projectId) return res.status(400).json({ error: 'projectId required' });
-
     const cacheKey = `${req.user.id}:${projectId}`;
-    const existedInMemory = activeSessions.delete(cacheKey);
-
-    let deletedTempKeys = 0;
-    for (const [tKey, tData] of tempKeys.entries()) {
-        if (tData.uid === req.user.id && tData.projectId === projectId) {
-            tempKeys.delete(tKey);
-            deletedTempKeys++;
-        }
-    }
-
-    if (supabase) {
-        try {
-            await supabase
-                .from('projects')
-                .update({ plugin_secret: null })
-                .eq('id', projectId)
-                .eq('user_id', req.user.id);
-        } catch (e) {
-            return res.status(500).json({ error: 'Database error during nullify' });
-        }
-    }
-
-    console.log(`☢️ NULLIFIED session for ${cacheKey}.`);
-    res.json({ 
-        success: true, 
-        message: 'Session purged.',
-        wasCached: existedInMemory,
-        tempKeysRemoved: deletedTempKeys
-    });
+    activeSessions.delete(cacheKey);
+    if (supabase) await supabase.from('projects').update({ plugin_secret: null }).eq('id', projectId).eq('user_id', req.user.id);
+    res.json({ success: true });
 });
 
-app.get('/', (req, res) => {
-    res.send('Plugin Auth Proxy Running (Supabase Edition)');
-});
+app.get('/', (req, res) => { res.send('Plugin Auth Proxy Running (Supabase Edition)'); });
 
-app.listen(PORT, () => {
-    console.log(`🚀 Auth Proxy running on port ${PORT}`);
-});
+app.listen(PORT, () => { console.log(`🚀 Auth Proxy running on port ${PORT}`); });