Upload 15 files

auth.js

@@ -1,19 +1,22 @@
-import fs from 'fs';
-import path from 'path';
-import os from 'os';
-import fetch from 'node-fetch';
-import { logDebug, logError, logInfo } from './logger.js';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import fetch from 'node-fetch';
+import { logDebug, logError, logInfo } from './logger.js';
 
 // State management for API key and refresh
-let currentApiKey = null;
-let currentRefreshToken = null;
-let lastRefreshTime = null;
-let clientId = null;
-let authSource = null; // 'env' or 'file' or 'factory_key' or 'client'
-let authFilePath = null;
+let currentApiKey = null;
+let currentRefreshToken = null;
+let lastRefreshTime = null;
+let clientId = null;
+let authSource = null; // 'env' or 'file' or 'factory_key' or 'client'
+let authFilePath = null;
 let factoryApiKey = null; // 单密钥（兼容旧行为）
 let factoryApiKeys = [];  // 多密钥轮询列表
 let factoryKeyIndex = 0;  // 轮询指针
+
+// 本服务对外提供的 API Key 访问控制（用于保护 /v1/* 入口）
+let accessKeys = null; // Set<string> 或 null（未启用鉴权）
 
 const REFRESH_URL = 'https://api.workos.com/user_management/authenticate';
 const REFRESH_INTERVAL_HOURS = 6; // Refresh every 6 hours
@@ -63,7 +66,7 @@ function generateClientId() {
  * Load auth configuration with priority system
  * Priority: FACTORY_API_KEY > refresh token mechanism > client authorization
  */
-function loadAuthConfig() {
+function loadAuthConfig() {
   // 1. Check FACTORY_API_KEY environment variable (highest priority)
   const factoryKey = process.env.FACTORY_API_KEY;
   if (factoryKey && factoryKey.trim() !== '') {
@@ -124,7 +127,7 @@ function loadAuthConfig() {
   logInfo('No auth configuration found, will use client authorization headers');
   authSource = 'client';
   return { type: 'client', value: null };
-}
+}
 
 /**
  * Refresh API key using refresh token
@@ -242,9 +245,9 @@ function shouldRefresh() {
 /**
  * Initialize auth system - load auth config and setup initial API key if needed
  */
-export async function initializeAuth() {
-  try {
-    const authConfig = loadAuthConfig();
+export async function initializeAuth() {
+  try {
+    const authConfig = loadAuthConfig();
     
     if (authConfig.type === 'factory_key') {
       // FACTORY_API_KEY 模式：固定或轮询
@@ -265,18 +268,26 @@ export async function initializeAuth() {
       logInfo('Auth system initialized for client authorization mode');
     }
     
-    logInfo('Auth system initialized successfully');
-  } catch (error) {
-    logError('Failed to initialize auth system', error);
-    throw error;
-  }
-}
+    logInfo('Auth system initialized successfully');
+
+    // 载入对外访问的 API Key 列表（用于入站鉴权）
+    loadAccessKeysFromEnv();
+    if (accessKeys && accessKeys.size > 0) {
+      logInfo(`Inbound API Key enforcement enabled (${accessKeys.size} key(s))`);
+    } else {
+      logInfo('Inbound API Key not configured; API is publicly accessible');
+    }
+  } catch (error) {
+    logError('Failed to initialize auth system', error);
+    throw error;
+  }
+}
 
 /**
  * Get API key based on configured authorization method
  * @param {string} clientAuthorization - Authorization header from client request (optional)
  */
-export async function getApiKey(clientAuthorization = null) {
+export async function getApiKey(clientAuthorization = null) {
   // Priority 1: FACTORY_API_KEY environment variable
   if (authSource === 'factory_key' && (factoryApiKey || factoryApiKeys.length > 0)) {
     // 轮询选择密钥（若仅1个则等价于固定密钥）
@@ -310,5 +321,82 @@ export async function getApiKey(clientAuthorization = null) {
   }
   
   // No authorization available
-  throw new Error('No authorization available. Please configure FACTORY_API_KEY, refresh token, or provide client authorization.');
-}
+  throw new Error('No authorization available. Please configure FACTORY_API_KEY, refresh token, or provide client authorization.');
+}
+
+/**
+ * 从环境变量加载对外访问的 API Key 列表
+ * 支持：
+ *  - ACCESS_KEYS: 多个密钥，逗号/分号/空白分隔
+ *  - ACCESS_KEY: 单个密钥
+ * 默认：未配置则不启用鉴权（保持向后兼容）；在公开部署时建议务必配置。
+ */
+function loadAccessKeysFromEnv() {
+  const multi = process.env.ACCESS_KEYS;
+  const single = process.env.ACCESS_KEY;
+
+  let keys = [];
+  if (multi && multi.trim() !== '') {
+    keys = multi.split(/[\s,;]+/).map(k => k.trim()).filter(Boolean);
+  } else if (single && single.trim() !== '') {
+    keys = [single.trim()];
+  }
+
+  accessKeys = keys.length > 0 ? new Set(keys) : null;
+}
+
+/**
+ * 提取客户端传入的访问密钥
+ * 支持：
+ *  - 请求头 X-API-Key: <key>
+ *  - Authorization: Bearer <key> | Api-Key <key> | Key <key>
+ *  - 查询参数 api_key=<key>（可选，尽量用请求头）
+ */
+function extractClientAccessKey(req) {
+  const hdrKey = req.headers['x-api-key'] || req.headers['x-api_key'];
+  if (typeof hdrKey === 'string' && hdrKey.trim() !== '') {
+    return hdrKey.trim();
+  }
+
+  const auth = req.headers['authorization'];
+  if (typeof auth === 'string' && auth.trim() !== '') {
+    const m = auth.match(/^(Bearer|Api-Key|Key)\s+(.+)$/i);
+    if (m && m[2]) return m[2].trim();
+  }
+
+  if (req.query && typeof req.query.api_key === 'string' && req.query.api_key.trim() !== '') {
+    return req.query.api_key.trim();
+  }
+  return null;
+}
+
+/**
+ * 入站 API Key 鉴权中间件（保护 /v1/*）
+ * - 如未配置 ACCESS_KEYS/ACCESS_KEY，则放行且记录提醒日志
+ * - 如已配置，则要求客户端提供有效 Key，否则 401
+ */
+export function accessKeyMiddleware(req, res, next) {
+  // 仅在配置了密钥时启用
+  if (!accessKeys || accessKeys.size === 0) {
+    return next();
+  }
+
+  const key = extractClientAccessKey(req);
+  if (!key) {
+    res.setHeader('WWW-Authenticate', 'Bearer realm="droid2api"');
+    return res.status(401).json({
+      error: 'unauthorized',
+      message: 'Missing API key. Provide X-API-Key or Authorization: Bearer.'
+    });
+  }
+
+  if (!accessKeys.has(key)) {
+    return res.status(401).json({
+      error: 'unauthorized',
+      message: 'Invalid API key'
+    });
+  }
+
+  // 通过校验
+  return next();
+}

server.js

@@ -1,26 +1,29 @@
 import express from 'express';
 import { loadConfig, isDevMode, getPort } from './config.js';
 import { logInfo, logError } from './logger.js';
-import router from './routes.js';
-import { initializeAuth } from './auth.js';
+import router from './routes.js';
+import { initializeAuth, accessKeyMiddleware } from './auth.js';
 
 const app = express();
 
 app.use(express.json({ limit: '50mb' }));
 app.use(express.urlencoded({ extended: true, limit: '50mb' }));
 
-app.use((req, res, next) => {
-  res.header('Access-Control-Allow-Origin', '*');
-  res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-  res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-API-Key, anthropic-version');
+app.use((req, res, next) => {
+  res.header('Access-Control-Allow-Origin', '*');
+  res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+  res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-API-Key, anthropic-version');
   
   if (req.method === 'OPTIONS') {
     return res.sendStatus(200);
   }
-  next();
-});
-
-app.use(router);
+  next();
+});
+
+// 入站 API Key 鉴权：仅保护 /v1/* 路由
+app.use('/v1', accessKeyMiddleware);
+
+app.use(router);
 
 app.get('/', (req, res) => {
   res.json({