chore: import upstream snapshot with attribution

2026-07-13 13:02:44 +08:00
commit 33645b2d9d
144 changed files with 63699 additions and 0 deletions
@@ -0,0 +1,134 @@
+import { NextResponse } from 'next/server';
+
+const MUAPI_BASE = 'https://api.muapi.ai';
+
+function getApiKey(request) {
+    // Only accept x-api-key header. Cookie-based auth is removed for security:
+    // cookies without HttpOnly flag can be stolen by any XSS (CWE-522).
+    const headerKey = request.headers.get('x-api-key');
+    return headerKey || null;
+}
+
+function cleanHeaders(request) {
+    const headers = new Headers(request.headers);
+    headers.delete('host');
+    headers.delete('connection');
+    headers.delete('cookie'); // CRITICAL: Stop forwarding browser cookies to MuAPI to avoid auth conflicts
+    return headers;
+}
+
+export async function GET(request, { params }) {
+    const slug = await params;
+    const pathSegments = slug.path || [];
+    const path = pathSegments.join('/');
+    
+    const { search } = new URL(request.url);
+    const targetUrl = `${MUAPI_BASE}/workflow/${path}${search}`;
+
+    const headers = cleanHeaders(request);
+
+    const apiKey = getApiKey(request);
+    // NOTE: apiKey is intentionally NOT logged here to prevent credential leakage (CWE-200)
+    if (apiKey) headers.set('x-api-key', apiKey);
+
+    try {
+        const response = await fetch(targetUrl, {
+            headers,
+            method: 'GET',
+        });
+        const data = await response.json();
+        if (path.includes('get-workflow-def')) {
+            console.log(`[proxy GET] get-workflow-def response: is_owner=${data?.is_owner}, workflow_id=${data?.workflow_id}`);
+        }
+        return NextResponse.json(data, { status: response.status });
+    } catch (error) {
+        return NextResponse.json({ error: error.message }, { status: 500 });
+    }
+}
+
+export async function POST(request, { params }) {
+    const slug = await params;
+    const pathSegments = slug.path || [];
+    const path = pathSegments.join('/');
+    
+    const { search } = new URL(request.url);
+    const targetUrl = `${MUAPI_BASE}/workflow/${path}${search}`;
+
+    const headers = cleanHeaders(request);
+
+    const apiKey = getApiKey(request);
+    // NOTE: credential logging removed for security (CWE-200)
+    if (apiKey) headers.set('x-api-key', apiKey);
+
+    try {
+        const body = await request.arrayBuffer();
+        // Decode body to see what workflow_id is being sent
+        try {
+            const parsed = JSON.parse(Buffer.from(body).toString('utf-8'));
+            console.log(`[proxy POST] body: workflow_id=${parsed.workflow_id}, source_workflow_id=${parsed.source_workflow_id}, name=${parsed.name}`);
+        } catch(e) { /* ignore decode errors */ }
+
+        const response = await fetch(targetUrl, {
+            method: 'POST',
+            headers,
+            body
+        });
+        const data = await response.json();
+        console.log(`[proxy POST] response: status=${response.status}`, JSON.stringify(data).slice(0, 200));
+        return NextResponse.json(data, { status: response.status });
+    } catch (error) {
+        return NextResponse.json({ error: error.message }, { status: 500 });
+    }
+}
+
+export async function DELETE(request, { params }) {
+    const slug = await params;
+    const pathSegments = slug.path || [];
+    const path = pathSegments.join('/');
+    
+    const { search } = new URL(request.url);
+    const targetUrl = `${MUAPI_BASE}/workflow/${path}${search}`;
+
+    const headers = cleanHeaders(request);
+
+    const apiKey = getApiKey(request);
+    if (apiKey) headers.set('x-api-key', apiKey);
+
+    try {
+        const response = await fetch(targetUrl, {
+            method: 'DELETE',
+            headers
+        });
+        const data = await response.json();
+        return NextResponse.json(data, { status: response.status });
+    } catch (error) {
+        return NextResponse.json({ error: error.message }, { status: 500 });
+    }
+}
+
+export async function PUT(request, { params }) {
+    const slug = await params;
+    const pathSegments = slug.path || [];
+    const path = pathSegments.join('/');
+    
+    const { search } = new URL(request.url);
+    const targetUrl = `${MUAPI_BASE}/workflow/${path}${search}`;
+
+    const headers = cleanHeaders(request);
+
+    const apiKey = getApiKey(request);
+    if (apiKey) headers.set('x-api-key', apiKey);
+
+    try {
+        const body = await request.arrayBuffer();
+        const response = await fetch(targetUrl, {
+            method: 'PUT',
+            headers,
+            body
+        });
+        const data = await response.json();
+        return NextResponse.json(data, { status: response.status });
+    } catch (error) {
+        return NextResponse.json({ error: error.message }, { status: 500 });
+    }
+}