Upload 3 files

package.json

@@ -12,6 +12,7 @@
     "express": "^4.21.2",
     "express-rate-limit": "^7.1.5",
     "helmet": "^7.1.0",
+    "jsonwebtoken": "^9.0.2",
     "node-fetch": "^2.7.0"
   },
   "engines": {

server.js

@@ -4,6 +4,7 @@ const cors = require('cors');
 const rateLimit = require('express-rate-limit');
 const helmet = require('helmet');
 const crypto = require('crypto');
+const jwt = require('jsonwebtoken');
 require('dotenv').config();
 
 const app = express();
@@ -253,17 +254,6 @@ function hasValidApiKey(req) {
     return typeof apiKey === 'string' && API_KEYS.some((configuredKey) => timingSafeEquals(configuredKey, apiKey));
 }
 
-function base64UrlEncode(value) {
-    const buffer = Buffer.isBuffer(value) ? value : Buffer.from(value);
-    return buffer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
-}
-
-function base64UrlDecode(value) {
-    const normalized = value.replace(/-/g, '+').replace(/_/g, '/');
-    const padLength = (4 - (normalized.length % 4)) % 4;
-    return Buffer.from(normalized + '='.repeat(padLength), 'base64');
-}
-
 function normalizeBotName(rawBotName) {
     if (typeof rawBotName !== 'string') return '';
     return rawBotName.toLowerCase().replace(/\s+/g, '-').substring(0, 100);
@@ -289,60 +279,30 @@ function hashUserAgent(value) {
     return crypto.createHash('sha256').update(userAgent).digest('hex');
 }
 
-function createChatAccessToken(payload) {
-    const header = { alg: 'HS256', typ: 'JWT' };
-    const encodedHeader = base64UrlEncode(JSON.stringify(header));
-    const encodedPayload = base64UrlEncode(JSON.stringify(payload));
-    const unsigned = `${encodedHeader}.${encodedPayload}`;
-    const signature = crypto.createHmac('sha256', CHAT_TOKEN_SECRET).update(unsigned).digest();
-    return `${unsigned}.${base64UrlEncode(signature)}`;
-}
-
 function verifyChatAccessToken(token) {
     if (typeof token !== 'string' || token.length < 20) {
         return { valid: false, reason: 'missing-token' };
     }
 
-    const parts = token.split('.');
-    if (parts.length !== 3) {
-        return { valid: false, reason: 'invalid-format' };
-    }
-
-    const [encodedHeader, encodedPayload, encodedSignature] = parts;
-    let header;
     let payload;
 
     try {
-        header = JSON.parse(base64UrlDecode(encodedHeader).toString('utf8'));
-        payload = JSON.parse(base64UrlDecode(encodedPayload).toString('utf8'));
-    } catch {
-        return { valid: false, reason: 'invalid-encoding' };
-    }
-
-    if (!header || header.alg !== 'HS256' || header.typ !== 'JWT') {
-        return { valid: false, reason: 'invalid-header' };
-    }
-
-    const unsigned = `${encodedHeader}.${encodedPayload}`;
-    const expectedSignature = base64UrlEncode(
-        crypto.createHmac('sha256', CHAT_TOKEN_SECRET).update(unsigned).digest()
-    );
-
-    if (!timingSafeEquals(expectedSignature, encodedSignature)) {
-        return { valid: false, reason: 'invalid-signature' };
-    }
-
-    const nowSeconds = Math.floor(Date.now() / 1000);
-    if (typeof payload.exp !== 'number' || payload.exp + CHAT_TOKEN_CLOCK_SKEW_SECONDS < nowSeconds) {
-        return { valid: false, reason: 'expired' };
-    }
-
-    if (typeof payload.iat !== 'number' || payload.iat - CHAT_TOKEN_CLOCK_SKEW_SECONDS > nowSeconds) {
-        return { valid: false, reason: 'invalid-issued-at' };
+        payload = jwt.verify(token, CHAT_TOKEN_SECRET, {
+            algorithms: ['HS256'],
+            issuer: CHAT_TOKEN_ISSUER,
+            clockTolerance: CHAT_TOKEN_CLOCK_SKEW_SECONDS
+        });
+    } catch (error) {
+        const message = String(error && error.message ? error.message : '').toLowerCase();
+        if (message.includes('jwt expired')) return { valid: false, reason: 'expired' };
+        if (message.includes('invalid issuer')) return { valid: false, reason: 'invalid-issuer' };
+        if (message.includes('invalid signature')) return { valid: false, reason: 'invalid-signature' };
+        if (message.includes('jwt malformed') || message.includes('invalid token')) return { valid: false, reason: 'invalid-format' };
+        return { valid: false, reason: 'invalid-token' };
     }
 
-    if (payload.iss !== CHAT_TOKEN_ISSUER) {
-        return { valid: false, reason: 'invalid-issuer' };
+    if (!payload || typeof payload !== 'object') {
+        return { valid: false, reason: 'invalid-token' };
     }
 
     if (!Number.isInteger(payload.instanceNum) || payload.instanceNum < 1) {
@@ -632,14 +592,21 @@ setInterval(() => {
 }, 10 * 60 * 1000);
 
 // --- FETCH WITH TIMEOUT ---
-async function fetchWithTimeout(url, options, timeout = 10000) {
-    return Promise.race([
-        fetch(url, options),
-        new Promise((_, reject) =>
-            setTimeout(() => reject(new Error('Request timeout')), timeout)
-        )
-    ]);
-}
+async function fetchWithTimeout(url, options, timeout = 10000) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeout);
+
+    try {
+        return await fetch(url, { ...options, signal: controller.signal });
+    } catch (error) {
+        if (error && error.name === 'AbortError') {
+            throw new Error('Request timeout');
+        }
+        throw error;
+    } finally {
+        clearTimeout(timer);
+    }
+}
 
 // --- RESOLVE CHATFLOW ID ---
 async function resolveChatflowId(instanceNum, botName) {
@@ -727,12 +694,12 @@ async function handleStreamingResponse(flowiseResponse, clientRes) {
         }
     }, 5000);
     
-    flowiseResponse.body.on('data', (chunk) => {
-        clearTimeout(timeoutCheck);
-        streamStarted = true;
-        dataReceived = true;
-        lastDataTime = Date.now();
-        totalBytes += chunk.length;
+    flowiseResponse.body.on('data', (chunk) => {
+        clearInterval(timeoutCheck);
+        streamStarted = true;
+        dataReceived = true;
+        lastDataTime = Date.now();
+        totalBytes += chunk.length;
         
         logSensitive(`[Streaming] Received chunk: ${chunk.length} bytes (total: ${totalBytes})`);
         clientRes.write(chunk);
@@ -837,12 +804,7 @@ app.post('/auth/chat-token', tokenIssueLimiter, async (req, res) => {
             });
         }
 
-        const nowSeconds = Math.floor(Date.now() / 1000);
         const claims = {
-            iss: CHAT_TOKEN_ISSUER,
-            iat: nowSeconds,
-            exp: nowSeconds + CHAT_TOKEN_TTL_SECONDS,
-            jti: crypto.randomBytes(12).toString('hex'),
             instanceNum: target.instanceNum,
             botName: target.botName
         };
@@ -859,7 +821,12 @@ app.post('/auth/chat-token', tokenIssueLimiter, async (req, res) => {
             claims.uaHash = hashUserAgent(req.headers['user-agent'] || '');
         }
 
-        const token = createChatAccessToken(claims);
+        const token = jwt.sign(claims, CHAT_TOKEN_SECRET, {
+            algorithm: 'HS256',
+            issuer: CHAT_TOKEN_ISSUER,
+            expiresIn: CHAT_TOKEN_TTL_SECONDS,
+            jwtid: crypto.randomBytes(12).toString('hex')
+        });
         res.status(200).json({
             token,
             tokenType: 'Bearer',