mirror of
https://github.com/koala73/worldmonitor.git
synced 2026-04-25 17:14:57 +02:00
* fix(acled): add OAuth token manager with automatic refresh ACLED access tokens expire every 24 hours, but WorldMonitor stores a static ACLED_ACCESS_TOKEN with no refresh logic — causing all ACLED API calls to fail after the first day. This commit adds `acled-auth.ts`, an OAuth token manager that: - Exchanges ACLED_EMAIL + ACLED_PASSWORD for an access token (24h) and refresh token (14d) via the official ACLED OAuth endpoint - Caches tokens in memory and auto-refreshes before expiry - Falls back to static ACLED_ACCESS_TOKEN for backward compatibility - Deduplicates concurrent refresh attempts - Degrades gracefully when no credentials are configured The only change to the existing `acled.ts` is replacing the synchronous `process.env.ACLED_ACCESS_TOKEN` read with an async call to the new `getAcledAccessToken()` helper. Fixes #1283 Relates to #290 * fix: address review feedback on ACLED OAuth PR - Use Redis (Upstash) as L2 token cache to survive Vercel Edge cold starts (in-memory cache retained as fast-path L1) - Add CHROME_UA User-Agent header on OAuth token exchange and refresh - Update seed script to use OAuth flow via getAcledToken() helper instead of raw process.env.ACLED_ACCESS_TOKEN - Add security comment to .env.example about plaintext password trade-offs - Sidecar ACLED_ACCESS_TOKEN case is a validation probe (tests user-provided value, not process.env) — data fetching delegates to handler modules * feat(sidecar): add ACLED_EMAIL/ACLED_PASSWORD to env allowlist and validation - Add ACLED_EMAIL and ACLED_PASSWORD to ALLOWED_ENV_KEYS set - Add ACLED_EMAIL validation case (store-only, verified with password) - Add ACLED_PASSWORD validation case with OAuth token exchange via acleddata.com/api/acled/user/login - On successful login, store obtained OAuth token in ACLED_ACCESS_TOKEN - Follows existing validation patterns (Cloudflare challenge handling, auth failure detection, User-Agent header) * fix: address remaining review feedback (duplicate OAuth, em dashes, emoji) - Extract shared ACLED OAuth helper into scripts/shared/acled-oauth.mjs - Remove ~55 lines of duplicate OAuth logic from seed-unrest-events.mjs, now imports getAcledToken from the shared helper - Replace em dashes with ASCII dashes in acled-auth.ts section comments - Replace em dash with parentheses in sidecar validation message - Remove emoji from .env.example security note Addresses koala73's second review: MEDIUM (duplicate OAuth), LOW (em dashes), LOW (emoji). * fix: align sidecar OAuth endpoint, fix L1/L2 cache, cleanup artifacts - Sidecar: switch from /api/acled/user/login (JSON) to /oauth/token (URL-encoded) to match server/_shared/acled-auth.ts exactly - acled-auth.ts: check L2 Redis when L1 is expired, not only when L1 is null (fixes stale L1 skipping fresher L2 from another isolate) - acled-oauth.mjs: remove stray backslash on line 9 - seed-unrest-events.mjs: remove extra blank line at line 13 --------- Co-authored-by: Elie Habib <elie.habib@gmail.com> Co-authored-by: RepairYourTech <30200484+RepairYourTech@users.noreply.github.com>
80 lines
2.5 KiB
TypeScript
80 lines
2.5 KiB
TypeScript
/**
|
|
* Shared ACLED API fetch with Redis caching.
|
|
*
|
|
* Three endpoints call ACLED independently (risk-scores, unrest-events,
|
|
* acled-events) with overlapping queries. This shared layer ensures
|
|
* identical queries hit Redis instead of making redundant upstream calls.
|
|
*/
|
|
import { CHROME_UA } from './constants';
|
|
import { cachedFetchJson } from './redis';
|
|
import { getAcledAccessToken } from './acled-auth';
|
|
|
|
const ACLED_API_URL = 'https://acleddata.com/api/acled/read';
|
|
const ACLED_CACHE_TTL = 900; // 15 min — matches ACLED rate-limit window
|
|
const ACLED_TIMEOUT_MS = 15_000;
|
|
|
|
export interface AcledRawEvent {
|
|
event_id_cnty?: string;
|
|
event_type?: string;
|
|
sub_event_type?: string;
|
|
country?: string;
|
|
location?: string;
|
|
latitude?: string;
|
|
longitude?: string;
|
|
event_date?: string;
|
|
fatalities?: string;
|
|
source?: string;
|
|
actor1?: string;
|
|
actor2?: string;
|
|
admin1?: string;
|
|
notes?: string;
|
|
tags?: string;
|
|
}
|
|
|
|
interface FetchAcledOptions {
|
|
eventTypes: string;
|
|
startDate: string;
|
|
endDate: string;
|
|
country?: string;
|
|
limit?: number;
|
|
}
|
|
|
|
/**
|
|
* Fetch ACLED events with automatic Redis caching.
|
|
* Cache key is derived from query parameters so identical queries across
|
|
* different handlers share the same cached result.
|
|
*/
|
|
export async function fetchAcledCached(opts: FetchAcledOptions): Promise<AcledRawEvent[]> {
|
|
const token = await getAcledAccessToken();
|
|
if (!token) return [];
|
|
|
|
const cacheKey = `acled:shared:${opts.eventTypes}:${opts.startDate}:${opts.endDate}:${opts.country || 'all'}:${opts.limit || 500}`;
|
|
const result = await cachedFetchJson<AcledRawEvent[]>(cacheKey, ACLED_CACHE_TTL, async () => {
|
|
const params = new URLSearchParams({
|
|
event_type: opts.eventTypes,
|
|
event_date: `${opts.startDate}|${opts.endDate}`,
|
|
event_date_where: 'BETWEEN',
|
|
limit: String(opts.limit || 500),
|
|
_format: 'json',
|
|
});
|
|
if (opts.country) params.set('country', opts.country);
|
|
|
|
const resp = await fetch(`${ACLED_API_URL}?${params}`, {
|
|
headers: {
|
|
Accept: 'application/json',
|
|
Authorization: `Bearer ${token}`,
|
|
'User-Agent': CHROME_UA,
|
|
},
|
|
signal: AbortSignal.timeout(ACLED_TIMEOUT_MS),
|
|
});
|
|
|
|
if (!resp.ok) throw new Error(`ACLED API error: ${resp.status}`);
|
|
const data = (await resp.json()) as { data?: AcledRawEvent[]; message?: string; error?: string };
|
|
if (data.message || data.error) throw new Error(data.message || data.error || 'ACLED API error');
|
|
|
|
const events = data.data || [];
|
|
return events.length > 0 ? events : null;
|
|
});
|
|
return result || [];
|
|
}
|