Files
worldmonitor/server/_shared/acled.ts
RepairYourTech 0420a54866 fix(acled): add OAuth token manager with automatic refresh (#1437)
* fix(acled): add OAuth token manager with automatic refresh

ACLED access tokens expire every 24 hours, but WorldMonitor stores a
static ACLED_ACCESS_TOKEN with no refresh logic — causing all ACLED
API calls to fail after the first day.

This commit adds `acled-auth.ts`, an OAuth token manager that:
- Exchanges ACLED_EMAIL + ACLED_PASSWORD for an access token (24h)
  and refresh token (14d) via the official ACLED OAuth endpoint
- Caches tokens in memory and auto-refreshes before expiry
- Falls back to static ACLED_ACCESS_TOKEN for backward compatibility
- Deduplicates concurrent refresh attempts
- Degrades gracefully when no credentials are configured

The only change to the existing `acled.ts` is replacing the synchronous
`process.env.ACLED_ACCESS_TOKEN` read with an async call to the new
`getAcledAccessToken()` helper.

Fixes #1283
Relates to #290

* fix: address review feedback on ACLED OAuth PR

- Use Redis (Upstash) as L2 token cache to survive Vercel Edge cold starts
  (in-memory cache retained as fast-path L1)
- Add CHROME_UA User-Agent header on OAuth token exchange and refresh
- Update seed script to use OAuth flow via getAcledToken() helper
  instead of raw process.env.ACLED_ACCESS_TOKEN
- Add security comment to .env.example about plaintext password trade-offs
- Sidecar ACLED_ACCESS_TOKEN case is a validation probe (tests user-provided
  value, not process.env) — data fetching delegates to handler modules

* feat(sidecar): add ACLED_EMAIL/ACLED_PASSWORD to env allowlist and validation

- Add ACLED_EMAIL and ACLED_PASSWORD to ALLOWED_ENV_KEYS set
- Add ACLED_EMAIL validation case (store-only, verified with password)
- Add ACLED_PASSWORD validation case with OAuth token exchange via
  acleddata.com/api/acled/user/login
- On successful login, store obtained OAuth token in ACLED_ACCESS_TOKEN
- Follows existing validation patterns (Cloudflare challenge handling,
  auth failure detection, User-Agent header)

* fix: address remaining review feedback (duplicate OAuth, em dashes, emoji)

- Extract shared ACLED OAuth helper into scripts/shared/acled-oauth.mjs
- Remove ~55 lines of duplicate OAuth logic from seed-unrest-events.mjs,
  now imports getAcledToken from the shared helper
- Replace em dashes with ASCII dashes in acled-auth.ts section comments
- Replace em dash with parentheses in sidecar validation message
- Remove emoji from .env.example security note

Addresses koala73's second review: MEDIUM (duplicate OAuth), LOW (em
dashes), LOW (emoji).

* fix: align sidecar OAuth endpoint, fix L1/L2 cache, cleanup artifacts

- Sidecar: switch from /api/acled/user/login (JSON) to /oauth/token
  (URL-encoded) to match server/_shared/acled-auth.ts exactly
- acled-auth.ts: check L2 Redis when L1 is expired, not only when L1
  is null (fixes stale L1 skipping fresher L2 from another isolate)
- acled-oauth.mjs: remove stray backslash on line 9
- seed-unrest-events.mjs: remove extra blank line at line 13

---------

Co-authored-by: Elie Habib <elie.habib@gmail.com>
Co-authored-by: RepairYourTech <30200484+RepairYourTech@users.noreply.github.com>
2026-03-12 22:24:40 +04:00

80 lines
2.5 KiB
TypeScript

/**
* Shared ACLED API fetch with Redis caching.
*
* Three endpoints call ACLED independently (risk-scores, unrest-events,
* acled-events) with overlapping queries. This shared layer ensures
* identical queries hit Redis instead of making redundant upstream calls.
*/
import { CHROME_UA } from './constants';
import { cachedFetchJson } from './redis';
import { getAcledAccessToken } from './acled-auth';
const ACLED_API_URL = 'https://acleddata.com/api/acled/read';
const ACLED_CACHE_TTL = 900; // 15 min — matches ACLED rate-limit window
const ACLED_TIMEOUT_MS = 15_000;
export interface AcledRawEvent {
event_id_cnty?: string;
event_type?: string;
sub_event_type?: string;
country?: string;
location?: string;
latitude?: string;
longitude?: string;
event_date?: string;
fatalities?: string;
source?: string;
actor1?: string;
actor2?: string;
admin1?: string;
notes?: string;
tags?: string;
}
interface FetchAcledOptions {
eventTypes: string;
startDate: string;
endDate: string;
country?: string;
limit?: number;
}
/**
* Fetch ACLED events with automatic Redis caching.
* Cache key is derived from query parameters so identical queries across
* different handlers share the same cached result.
*/
export async function fetchAcledCached(opts: FetchAcledOptions): Promise<AcledRawEvent[]> {
const token = await getAcledAccessToken();
if (!token) return [];
const cacheKey = `acled:shared:${opts.eventTypes}:${opts.startDate}:${opts.endDate}:${opts.country || 'all'}:${opts.limit || 500}`;
const result = await cachedFetchJson<AcledRawEvent[]>(cacheKey, ACLED_CACHE_TTL, async () => {
const params = new URLSearchParams({
event_type: opts.eventTypes,
event_date: `${opts.startDate}|${opts.endDate}`,
event_date_where: 'BETWEEN',
limit: String(opts.limit || 500),
_format: 'json',
});
if (opts.country) params.set('country', opts.country);
const resp = await fetch(`${ACLED_API_URL}?${params}`, {
headers: {
Accept: 'application/json',
Authorization: `Bearer ${token}`,
'User-Agent': CHROME_UA,
},
signal: AbortSignal.timeout(ACLED_TIMEOUT_MS),
});
if (!resp.ok) throw new Error(`ACLED API error: ${resp.status}`);
const data = (await resp.json()) as { data?: AcledRawEvent[]; message?: string; error?: string };
if (data.message || data.error) throw new Error(data.message || data.error || 'ACLED API error');
const events = data.data || [];
return events.length > 0 ? events : null;
});
return result || [];
}