mirror of
https://github.com/koala73/worldmonitor.git
synced 2026-04-25 17:14:57 +02:00
595e3dbb86
* Add premium finance stock analysis suite * docs: link premium finance from README Add Premium Stock Analysis entry to the Finance & Markets section with a link to docs/PREMIUM_FINANCE.md. * fix: address review feedback on premium finance suite - Chunk Redis pipelines into batches of 200 (Upstash limit) - Add try-catch around cachedFetchJson in backtest handler - Log warnings on Redis pipeline HTTP failures - Include name in analyze-stock cache key to avoid collisions - Change analyze-stock and backtest-stock gateway cache to 'slow' - Add dedup guard for concurrent ledger generation - Add SerpAPI date pre-filter (tbs=qdr:d/w) - Extract sanitizeSymbol to shared module - Extract buildEmptyAnalysisResponse helper - Fix RSI to use Wilder's smoothing (matches TradingView) - Add console.warn for daily brief summarization errors - Fall back to stale data in loadStockBacktest on error - Make daily-market-brief premium on all platforms - Use word boundaries for short token headline matching - Add stock-analysis 15-min refresh interval - Stagger stock-analysis and backtest requests (200ms) - Rename signalTone to stockSignalTone
71 lines
2.6 KiB
JavaScript
71 lines
2.6 KiB
JavaScript
const DESKTOP_ORIGIN_PATTERNS = [
|
|
/^https?:\/\/tauri\.localhost(:\d+)?$/,
|
|
/^https?:\/\/[a-z0-9-]+\.tauri\.localhost(:\d+)?$/i,
|
|
/^tauri:\/\/localhost$/,
|
|
/^asset:\/\/localhost$/,
|
|
];
|
|
|
|
const BROWSER_ORIGIN_PATTERNS = [
|
|
/^https:\/\/(.*\.)?worldmonitor\.app$/,
|
|
/^https:\/\/worldmonitor-[a-z0-9-]+-elie-[a-z0-9]+\.vercel\.app$/,
|
|
...(process.env.NODE_ENV === 'production' ? [] : [
|
|
/^https?:\/\/localhost(:\d+)?$/,
|
|
/^https?:\/\/127\.0\.0\.1(:\d+)?$/,
|
|
]),
|
|
];
|
|
|
|
function isDesktopOrigin(origin) {
|
|
return Boolean(origin) && DESKTOP_ORIGIN_PATTERNS.some(p => p.test(origin));
|
|
}
|
|
|
|
function isTrustedBrowserOrigin(origin) {
|
|
return Boolean(origin) && BROWSER_ORIGIN_PATTERNS.some(p => p.test(origin));
|
|
}
|
|
|
|
function extractOriginFromReferer(referer) {
|
|
if (!referer) return '';
|
|
try {
|
|
return new URL(referer).origin;
|
|
} catch {
|
|
return '';
|
|
}
|
|
}
|
|
|
|
export function validateApiKey(req, options = {}) {
|
|
const forceKey = options.forceKey === true;
|
|
const key = req.headers.get('X-WorldMonitor-Key');
|
|
// Same-origin browser requests don't send Origin (per CORS spec).
|
|
// Fall back to Referer to identify trusted same-origin callers.
|
|
const origin = req.headers.get('Origin') || extractOriginFromReferer(req.headers.get('Referer')) || '';
|
|
|
|
// Desktop app — always require API key
|
|
if (isDesktopOrigin(origin)) {
|
|
if (!key) return { valid: false, required: true, error: 'API key required for desktop access' };
|
|
const validKeys = (process.env.WORLDMONITOR_VALID_KEYS || '').split(',').filter(Boolean);
|
|
if (!validKeys.includes(key)) return { valid: false, required: true, error: 'Invalid API key' };
|
|
return { valid: true, required: true };
|
|
}
|
|
|
|
// Trusted browser origin (worldmonitor.app, Vercel previews, localhost dev) — no key needed
|
|
if (isTrustedBrowserOrigin(origin)) {
|
|
if (forceKey && !key) {
|
|
return { valid: false, required: true, error: 'API key required' };
|
|
}
|
|
if (key) {
|
|
const validKeys = (process.env.WORLDMONITOR_VALID_KEYS || '').split(',').filter(Boolean);
|
|
if (!validKeys.includes(key)) return { valid: false, required: true, error: 'Invalid API key' };
|
|
}
|
|
return { valid: true, required: forceKey };
|
|
}
|
|
|
|
// Explicit key provided from unknown origin — validate it
|
|
if (key) {
|
|
const validKeys = (process.env.WORLDMONITOR_VALID_KEYS || '').split(',').filter(Boolean);
|
|
if (!validKeys.includes(key)) return { valid: false, required: true, error: 'Invalid API key' };
|
|
return { valid: true, required: true };
|
|
}
|
|
|
|
// No origin, no key — require API key (blocks unauthenticated curl/scripts)
|
|
return { valid: false, required: true, error: 'API key required' };
|
|
}
|