Update server.js

server.js

@@ -2,26 +2,46 @@ import express from 'express';
 import cors from 'cors';
 import rateLimit from 'express-rate-limit';
 import { Readable } from 'stream';
+import crypto from 'crypto';
 
 const app = express();
 const PORT = 7860;
 
-// --- SEGURIDAD ---
+// --- 1. CONFIGURACIÓN DE SEGURIDAD PARANOICA ---
+// CRÍTICO: trust proxy en 1 es vital para leer la IP real del usuario a través de Cloudflare/HF
 app.set('trust proxy', 1);
 app.disable('x-powered-by'); 
 app.use(cors());
+
 app.use((req, res, next) => {
     res.setHeader('X-Content-Type-Options', 'nosniff');
     res.setHeader('X-Frame-Options', 'DENY');
-    res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
-    res.setHeader('Referrer-Policy', 'no-referrer');
+    res.setHeader('X-XSS-Protection', '1; mode=block');
+    res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
+    res.setHeader('Referrer-Policy', 'no-referrer'); // Oculta que vienen de Ventarys AI
+    res.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none';");
     next();
 });
 
 app.use(express.json({ limit: '50mb' }));
 app.use(express.urlencoded({ limit: '50mb', extended: true }));
 
-// --- CONFIGURACIÓN DE PROVEEDORES ---
+function logError(providerId, reason) {
+    console.error(`[SYSTEM] Provider Error: ${providerId} | ${reason}`);
+}
+
+// Falsificación de huella digital del navegador
+function getRandomUserAgent() {
+    const agents = [
+        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15",
+        "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0",
+        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0"
+    ];
+    return agents[Math.floor(Math.random() * agents.length)];
+}
+
+// --- PROVEEDORES PÚBLICOS ---
 const PROVIDERS = [
     { 
         id: "pollinations-ai", 
@@ -34,92 +54,91 @@ const PROVIDERS = [
     },
     {
         id: "voids-api",
-        url: "https://api.voids.top/v1/chat/completions",
-        strictCloudflare: true,
-        needsDummyKey: true
+        url: "https://api.voids.top/v1/chat/completions"
     }
 ];
 
-const MAX_PER_PROVIDER = 1; 
+// CRÍTICO: Subimos el límite a 500 para permitir alta concurrencia.
+// Ahora el proxy dejará pasar todo el tráfico y el proveedor final aplicará el rate limit por IP.
+const MAX_PER_PROVIDER = 500; 
 const QUEUE_TIMEOUT = 45000; 
 let currentLoad = { "pollinations-ai": 0, "kepler-cloud": 0, "voids-api": 0 };
 
+// --- RATE LIMITING LOCAL ---
 const limiter = rateLimit({
     windowMs: 60 * 1000, 
-    max: 50, 
+    max: 50, // 50 peticiones por IP localmente para evitar que alguien tire TU servidor
     keyGenerator: (req) => req.ip, 
-    message: { error: { message: "Too many requests.", code: 429 } }
+    message: { error: { message: "Too many requests.", code: 429 } },
+    standardHeaders: false, 
+    legacyHeaders: false,
 });
 
-function getRandomUserAgent() {
-    const agents = ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"];
-    return agents[Math.floor(Math.random() * agents.length)];
+const IMAGE_KEYWORDS = ["flux", "dall", "midjourney", "sdxl", "stable-diffusion", "image", "vision"];
+const AUDIO_KEYWORDS = ["suno", "udio", "music", "audio", "song", "voice", "tts", "whisper"];
+
+function isImageModel(model) {
+    if (!model) return false;
+    if (model.type === 'image' || model.supports_images === true) return true;
+    return IMAGE_KEYWORDS.some(kw => (model.id || model.name || "").toLowerCase().includes(kw));
 }
 
-// --- RUTA PRINCIPAL ---
-app.post(['/v1/chat/completions', '/v1/images/generations'], limiter, async (req, res) => {
-    const isImage = req.path === '/v1/images/generations';
-    let availableProviders = [...PROVIDERS];
-    const clientIp = req.ip || req.headers['x-forwarded-for'] || req.socket.remoteAddress;
-    let payload = JSON.stringify(req.body); 
-    req.body = null; 
-    
-    const startTime = Date.now();
-    let responseSent = false;
-    
-    while (availableProviders.length > 0 && Date.now() - startTime < QUEUE_TIMEOUT) {
-        let selectedProvider = availableProviders.sort(() => Math.random() - 0.5)
-            .find(p => currentLoad[p.id] < MAX_PER_PROVIDER);
-        
-        if (!selectedProvider) {
-            await new Promise(r => setTimeout(r, 1000));
-            continue;
-        }
-        
-        currentLoad[selectedProvider.id]++;
-        const releaseSlot = () => { currentLoad[selectedProvider.id] = Math.max(0, currentLoad[selectedProvider.id] - 1); };
+function isAudioModel(model) {
+    if (model.type === 'audio' || model.type === 'music') return true;
+    return AUDIO_KEYWORDS.some(kw => (model.id || model.name || "").toLowerCase().includes(kw));
+}
+
+async function fetchAllModels() {
+    const fetchPromises = PROVIDERS.map(async (provider) => {
+        const modelsUrl = provider.modelsUrl || provider.url.replace("/chat/completions", "/models");
         
         try {
-            const fetchHeaders = { 
-                "Content-Type": "application/json",
-                "User-Agent": getRandomUserAgent()
-            };
-            
-            if (!selectedProvider.strictCloudflare) {
-                fetchHeaders["X-Forwarded-For"] = clientIp;
-            }
-            if (selectedProvider.needsDummyKey) {
-                fetchHeaders["Authorization"] = "Bearer sk-ventarys-proxy-pass";
-            }
-            
-            const response = await fetch(selectedProvider.url, {
-                method: "POST",
-                headers: fetchHeaders,
-                body: payload
+            const resp = await fetch(modelsUrl, { 
+                method: "GET", 
+                headers: { 
+                    "Content-Type": "application/json",
+                    "User-Agent": getRandomUserAgent() 
+                } 
             });
+            if (!resp.ok) return [];
             
-            if (!response.ok) throw new Error("Upstream Error");
+            const json = await resp.json();
+            let modelsArray = Array.isArray(json) ? json : (json && Array.isArray(json.data) ? json.data : []);
             
-            res.writeHead(response.status, { 'Content-Type': response.headers.get('content-type') });
-            if (response.body) {
-                Readable.fromWeb(response.body).pipe(res);
-                res.on('finish', releaseSlot);
-            } else {
-                releaseSlot();
-                res.end();
+            if (modelsArray.length > 0) {
+                return modelsArray
+                    .filter(model => !isAudioModel(model))
+                    .map(model => ({ ...model, id: model.id || model.name, owned_by: provider.id }));
             }
-            responseSent = true;
-            payload = null;
-            return;
-            
-        } catch (err) {
-            releaseSlot();
-            availableProviders = availableProviders.filter(p => p.id !== selectedProvider.id);
+            return [];
+        } catch (error) {
+            return [];
         }
-    }
+    });
+    
+    const results = await Promise.allSettled(fetchPromises);
+    let allModels = [];
+    results.forEach(result => {
+        if (result.status === "fulfilled") allModels = allModels.concat(result.value);
+    });
     
-    payload = null;
-    if (!responseSent) res.status(503).json({ error: "Service unavailable" });
+    if (allModels.length === 0) {
+        allModels = [
+            { id: "gpt-4o", object: "model", type: "text", owned_by: "pollinations-ai" },
+            { id: "claude-3-5-sonnet", object: "model", type: "text", owned_by: "pollinations-ai" },
+            { id: "gemini-1.5-pro", object: "model", type: "text", owned_by: "voids-api" },
+            { id: "gemini-1.5-flash", object: "model", type: "text", owned_by: "voids-api" }
+        ];
+    }
+    return allModels;
+}
+
+app.get('/health', (req, res) => {
+    res.json({ status: "online" }); 
 });
 
-app.listen(PORT, '0.0.0.0', () => console.log(`🚀 Ventarys Proxy Online`));
+app.get('/v1/models', async (req, res) => {
+    try {
+        const allModels = await fetchAllModels();
+        const textModels = allModels
+            .filter(m => !isImageModel(m)