+ Set custom input token limits per provider. Requests exceeding these limits will be rejected with a 400 error. + Leave empty to use default limits. +
+ + {modelLimitProviders.map((p) => ( +{APP_CONFIG.name} v{APP_CONFIG.version}
diff --git a/src/app/api/cloud/auth/route.js b/src/app/api/cloud/auth/route.js index 52abd5fe..7a9edc3a 100644 --- a/src/app/api/cloud/auth/route.js +++ b/src/app/api/cloud/auth/route.js @@ -1,8 +1,14 @@ import { NextResponse } from "next/server"; import { validateApiKey, getProviderConnections, getModelAliases } from "@/models"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; // Verify API key and return provider credentials export async function POST(request) { + // Require authentication (validates API key) + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse("Invalid API key"); + } try { const authHeader = request.headers.get("Authorization"); if (!authHeader?.startsWith("Bearer ")) { @@ -11,7 +17,7 @@ export async function POST(request) { const apiKey = authHeader.slice(7); - // Validate API key + // API key already validated by requireAuth, get connections const isValid = await validateApiKey(apiKey); if (!isValid) { return NextResponse.json({ error: "Invalid API key" }, { status: 401 }); diff --git a/src/app/api/cloud/credentials/update/route.js b/src/app/api/cloud/credentials/update/route.js index fa25ba3c..b5b9df9a 100644 --- a/src/app/api/cloud/credentials/update/route.js +++ b/src/app/api/cloud/credentials/update/route.js @@ -1,8 +1,14 @@ import { NextResponse } from "next/server"; import { validateApiKey, getProviderConnections, updateProviderConnection } from "@/models"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; // Update provider credentials (for cloud token refresh) export async function PUT(request) { + // Require authentication (validates API key) + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse("Invalid API key"); + } try { const authHeader = request.headers.get("Authorization"); if (!authHeader?.startsWith("Bearer ")) { @@ -17,7 +23,7 @@ export async function PUT(request) { return NextResponse.json({ error: "Provider and credentials required" }, { status: 400 }); } - // Validate API key + // API key already validated by requireAuth const isValid = await validateApiKey(apiKey); if (!isValid) { return NextResponse.json({ error: "Invalid API key" }, { status: 401 }); diff --git a/src/app/api/keys/[id]/route.js b/src/app/api/keys/[id]/route.js index 1d22596a..cc273f91 100644 --- a/src/app/api/keys/[id]/route.js +++ b/src/app/api/keys/[id]/route.js @@ -1,15 +1,23 @@ import { NextResponse } from "next/server"; import { deleteApiKey, getApiKeyById, updateApiKey } from "@/lib/localDb"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; +import { sanitizeApiKeyData } from "@/lib/sanitize.js"; // GET /api/keys/[id] - Get single key export async function GET(request, { params }) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } try { const { id } = await params; const key = await getApiKeyById(id); if (!key) { return NextResponse.json({ error: "Key not found" }, { status: 404 }); } - return NextResponse.json({ key }); + const sanitized = sanitizeApiKeyData(key); + return NextResponse.json({ key: sanitized }); } catch (error) { console.log("Error fetching key:", error); return NextResponse.json({ error: "Failed to fetch key" }, { status: 500 }); @@ -18,6 +26,11 @@ export async function GET(request, { params }) { // PUT /api/keys/[id] - Update key export async function PUT(request, { params }) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } try { const { id } = await params; const body = await request.json(); @@ -42,6 +55,11 @@ export async function PUT(request, { params }) { // DELETE /api/keys/[id] - Delete API key export async function DELETE(request, { params }) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } try { const { id } = await params; diff --git a/src/app/api/keys/route.js b/src/app/api/keys/route.js index 98d25408..db069737 100644 --- a/src/app/api/keys/route.js +++ b/src/app/api/keys/route.js @@ -1,12 +1,21 @@ import { NextResponse } from "next/server"; import { getApiKeys, createApiKey } from "@/lib/localDb"; import { getConsistentMachineId } from "@/shared/utils/machineId"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; +import { sanitizeApiKeyData } from "@/lib/sanitize.js"; // GET /api/keys - List API keys -export async function GET() { +export async function GET(request) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } + try { const keys = await getApiKeys(); - return NextResponse.json({ keys }); + const sanitized = sanitizeApiKeyData(keys); + return NextResponse.json({ keys: sanitized }); } catch (error) { console.log("Error fetching keys:", error); return NextResponse.json({ error: "Failed to fetch keys" }, { status: 500 }); @@ -15,6 +24,12 @@ export async function GET() { // POST /api/keys - Create new API key export async function POST(request) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } + try { const body = await request.json(); const { name } = body; diff --git a/src/app/api/shutdown/route.js b/src/app/api/shutdown/route.js index 7ce76ef9..592fca7c 100644 --- a/src/app/api/shutdown/route.js +++ b/src/app/api/shutdown/route.js @@ -1,6 +1,13 @@ import { NextResponse } from "next/server"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; + +export async function POST(request) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } -export async function POST() { const response = NextResponse.json({ success: true, message: "Shutting down..." }); setTimeout(() => { diff --git a/src/app/api/usage/[connectionId]/route.js b/src/app/api/usage/[connectionId]/route.js index 80e52403..e2f27694 100644 --- a/src/app/api/usage/[connectionId]/route.js +++ b/src/app/api/usage/[connectionId]/route.js @@ -1,7 +1,6 @@ // Ensure proxyFetch is loaded to patch globalThis.fetch import "open-sse/index.js"; - -import { getProviderConnectionById, updateProviderConnection } from "@/lib/localDb"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; import { getUsageForProvider } from "open-sse/services/usage.js"; import { getExecutor } from "open-sse/executors/index.js"; /** @@ -91,6 +90,11 @@ async function refreshAndUpdateCredentials(connection) { * GET /api/usage/[connectionId] - Get usage data for a specific connection */ export async function GET(request, { params }) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } try { const { connectionId } = await params; diff --git a/src/app/api/usage/chart/route.js b/src/app/api/usage/chart/route.js index 3289ca84..fad2cc18 100644 --- a/src/app/api/usage/chart/route.js +++ b/src/app/api/usage/chart/route.js @@ -1,9 +1,15 @@ import { NextResponse } from "next/server"; import { getChartData } from "@/lib/usageDb"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; const VALID_PERIODS = new Set(["24h", "7d", "30d", "60d"]); export async function GET(request) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } try { const { searchParams } = new URL(request.url); const period = searchParams.get("period") || "7d"; diff --git a/src/app/api/usage/history/route.js b/src/app/api/usage/history/route.js index 16a5d407..44219dda 100644 --- a/src/app/api/usage/history/route.js +++ b/src/app/api/usage/history/route.js @@ -1,10 +1,19 @@ import { NextResponse } from "next/server"; import { getUsageStats } from "@/lib/usageDb"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; +import { sanitizeUsageStats } from "@/lib/sanitize.js"; + +export async function GET(request) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } -export async function GET() { try { const stats = await getUsageStats(); - return NextResponse.json(stats); + const sanitized = sanitizeUsageStats(stats); + return NextResponse.json(sanitized); } catch (error) { console.error("Error fetching usage stats:", error); return NextResponse.json({ error: "Failed to fetch usage stats" }, { status: 500 }); diff --git a/src/app/api/usage/logs/route.js b/src/app/api/usage/logs/route.js index b5b875ec..260ded0b 100644 --- a/src/app/api/usage/logs/route.js +++ b/src/app/api/usage/logs/route.js @@ -1,7 +1,13 @@ import { NextResponse } from "next/server"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; import { getRecentLogs } from "@/lib/usageDb"; -export async function GET() { +export async function GET(request) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } try { const logs = await getRecentLogs(200); return NextResponse.json(logs); diff --git a/src/app/api/usage/providers/route.js b/src/app/api/usage/providers/route.js index baa1cffb..6c689f92 100644 --- a/src/app/api/usage/providers/route.js +++ b/src/app/api/usage/providers/route.js @@ -2,12 +2,18 @@ import { NextResponse } from "next/server"; import { getRequestDetailsDb } from "@/lib/requestDetailsDb"; import { getProviderNodes } from "@/lib/localDb"; import { AI_PROVIDERS, getProviderByAlias } from "@/shared/constants/providers"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; /** * GET /api/usage/providers * Returns list of unique providers from request details */ -export async function GET() { +export async function GET(request) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } try { const db = await getRequestDetailsDb(); diff --git a/src/app/api/usage/request-details/route.js b/src/app/api/usage/request-details/route.js index 73a3ceb2..a11e57d2 100644 --- a/src/app/api/usage/request-details/route.js +++ b/src/app/api/usage/request-details/route.js @@ -1,11 +1,17 @@ import { NextResponse } from "next/server"; import { getRequestDetails } from "@/lib/usageDb"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; /** * GET /api/usage/request-details * Query parameters: page, pageSize (1-100), provider, model, connectionId, status, startDate, endDate */ export async function GET(request) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } try { const { searchParams } = new URL(request.url); diff --git a/src/app/api/usage/request-logs/route.js b/src/app/api/usage/request-logs/route.js index 0ae5e961..ae3ef474 100644 --- a/src/app/api/usage/request-logs/route.js +++ b/src/app/api/usage/request-logs/route.js @@ -1,7 +1,13 @@ import { NextResponse } from "next/server"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; import { getRecentLogs } from "@/lib/usageDb"; -export async function GET() { +export async function GET(request) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } try { const logs = await getRecentLogs(200); return NextResponse.json(logs); diff --git a/src/app/api/usage/stats/route.js b/src/app/api/usage/stats/route.js index 2e8c88ad..d827b52a 100644 --- a/src/app/api/usage/stats/route.js +++ b/src/app/api/usage/stats/route.js @@ -1,11 +1,19 @@ import { NextResponse } from "next/server"; import { getUsageStats } from "@/lib/usageDb"; +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; +import { sanitizeUsageStats } from "@/lib/sanitize.js"; const VALID_PERIODS = new Set(["24h", "7d", "30d", "60d", "all"]); export const dynamic = "force-dynamic"; export async function GET(request) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } + try { const { searchParams } = new URL(request.url); const period = searchParams.get("period") || "7d"; @@ -15,7 +23,8 @@ export async function GET(request) { } const stats = await getUsageStats(period); - return NextResponse.json(stats); + const sanitized = sanitizeUsageStats(stats); + return NextResponse.json(sanitized); } catch (error) { console.error("[API] Failed to get usage stats:", error); return NextResponse.json({ error: "Failed to fetch usage stats" }, { status: 500 }); diff --git a/src/app/api/usage/stream/route.js b/src/app/api/usage/stream/route.js index acfad388..732288b9 100644 --- a/src/app/api/usage/stream/route.js +++ b/src/app/api/usage/stream/route.js @@ -1,8 +1,14 @@ import { getUsageStats, statsEmitter, getActiveRequests } from "@/lib/usageDb"; - +import { requireAuth, unauthorizedResponse } from "@/lib/apiAuth.js"; +import { sanitizeUsageStats } from "@/lib/sanitize.js"; export const dynamic = "force-dynamic"; -export async function GET() { +export async function GET(request) { + // Require authentication + const auth = await requireAuth(request); + if (!auth.authenticated) { + return unauthorizedResponse(); + } const encoder = new TextEncoder(); const state = { closed: false, keepalive: null, send: null, sendPending: null, cachedStats: null }; @@ -20,8 +26,9 @@ export async function GET() { } // Then do full recalc and update cache const stats = await getUsageStats(); - state.cachedStats = stats; - controller.enqueue(encoder.encode(`data: ${JSON.stringify(stats)}\n\n`)); + const sanitized = sanitizeUsageStats(stats); + state.cachedStats = sanitized; + controller.enqueue(encoder.encode(`data: ${JSON.stringify(sanitized)}\n\n`)); } catch { state.closed = true; statsEmitter.off("update", state.send); diff --git a/src/lib/apiAuth.js b/src/lib/apiAuth.js new file mode 100644 index 00000000..2c87027f --- /dev/null +++ b/src/lib/apiAuth.js @@ -0,0 +1,59 @@ +import { jwtVerify } from "jose"; +import { getApiKeys } from "@/lib/localDb.js"; + +const SECRET = new TextEncoder().encode( + process.env.JWT_SECRET || "9router-default-secret-change-me" +); + +/** + * Authentication middleware for API routes + * Supports both JWT cookie (for dashboard users) and Bearer API key + * + * @param {Request} request - Next.js request object + * @returns {Promise<{authenticated: boolean, user?: object, apiKey?: string, error?: string}>} + */ +export async function requireAuth(request) { + // Try JWT cookie first (dashboard users) + const token = request.cookies.get("auth_token")?.value; + + if (token) { + try { + const { payload } = await jwtVerify(token, SECRET); + return { authenticated: true, user: payload }; + } catch (err) { + // JWT invalid, continue to try API key + } + } + + // Try Bearer API key + const authHeader = request.headers.get("authorization"); + if (authHeader?.startsWith("Bearer ")) { + const apiKey = authHeader.substring(7); + + try { + const apiKeys = await getApiKeys(); + const validKey = apiKeys.find(k => k.key === apiKey); + + if (validKey) { + return { authenticated: true, apiKey: validKey.key, keyName: validKey.name }; + } + } catch (err) { + console.error("[apiAuth] Error validating API key:", err); + } + } + + return { authenticated: false, error: "Authentication required" }; +} + +/** + * Helper to return 401 Unauthorized response + */ +export function unauthorizedResponse(message = "Authentication required") { + return new Response( + JSON.stringify({ error: message }), + { + status: 401, + headers: { "Content-Type": "application/json" } + } + ); +} diff --git a/src/lib/localDb.js b/src/lib/localDb.js index 19ccf8e3..c047fb9b 100644 --- a/src/lib/localDb.js +++ b/src/lib/localDb.js @@ -60,7 +60,10 @@ const defaultData = { observabilityMaxJsonSize: 1024, outboundProxyEnabled: false, outboundProxyUrl: "", - outboundNoProxy: "" + outboundNoProxy: "", + // Model input token limits (user overrides) + // Format: { "provider:model": limit } or { "provider": limit } + modelLimits: null }, pricing: {} // NEW: pricing configuration }; diff --git a/src/lib/sanitize.js b/src/lib/sanitize.js new file mode 100644 index 00000000..ec0ce319 --- /dev/null +++ b/src/lib/sanitize.js @@ -0,0 +1,211 @@ +/** + * Response sanitization utility to prevent sensitive data leaks + * Removes or masks sensitive fields from API responses + */ + +/** + * Fields that should be completely removed from responses + */ +const SENSITIVE_FIELDS = [ + 'apiKey', + 'key', + 'accessToken', + 'refreshToken', + 'token', + 'idToken', + 'credentials', + 'secret', + 'password', + 'clientSecret', +]; + +/** + * Mask an email address (show first char + *** + domain) + * Example: user@example.com -> u***@example.com + */ +function maskEmail(email) { + if (!email || typeof email !== 'string') return email; + if (!email.includes('@')) return email; + + const [local, domain] = email.split('@'); + if (local.length === 0) return email; + + return `${local[0]}***@${domain}`; +} + +/** + * Mask an API key (show first 8 chars + ***) + * Example: sk_1234567890abcdef -> sk_12345*** + */ +function maskApiKey(key) { + if (!key || typeof key !== 'string') return key; + if (key.length <= 8) return '***'; + + return `${key.substring(0, 8)}***`; +} + +/** + * Recursively sanitize an object by removing sensitive fields + * @param {any} data - Data to sanitize (object, array, or primitive) + * @param {object} options - Sanitization options + * @param {boolean} options.maskEmails - Whether to mask email addresses in accountName fields + * @param {boolean} options.maskApiKeys - Whether to mask API keys instead of removing them + * @param {string[]} options.additionalFields - Additional field names to remove + * @returns {any} Sanitized data + */ +export function sanitizeResponse(data, options = {}) { + const { + maskEmails = true, + maskApiKeys = false, + additionalFields = [], + } = options; + + const fieldsToRemove = [...SENSITIVE_FIELDS, ...additionalFields]; + + function sanitize(obj) { + // Handle null/undefined + if (obj === null || obj === undefined) { + return obj; + } + + // Handle arrays + if (Array.isArray(obj)) { + return obj.map(item => sanitize(item)); + } + + // Handle non-objects (primitives) + if (typeof obj !== 'object') { + return obj; + } + + // Handle objects + const sanitized = {}; + + for (const [key, value] of Object.entries(obj)) { + // Remove sensitive fields + if (fieldsToRemove.includes(key)) { + if (maskApiKeys && (key === 'apiKey' || key === 'key')) { + sanitized[key] = maskApiKey(value); + } + // Otherwise skip (remove) the field + continue; + } + + // Mask email addresses in accountName fields + if (maskEmails && key === 'accountName' && typeof value === 'string' && value.includes('@')) { + sanitized[key] = maskEmail(value); + } + // Mask email field itself + else if (maskEmails && key === 'email' && typeof value === 'string') { + sanitized[key] = maskEmail(value); + } + // Recursively sanitize nested objects/arrays + else if (value !== null && typeof value === 'object') { + sanitized[key] = sanitize(value); + } + // Keep primitive values as-is + else { + sanitized[key] = value; + } + } + + return sanitized; + } + + return sanitize(data); +} + +/** + * Sanitize usage stats response specifically + * Removes full API keys from byApiKey section and masks account emails + */ +export function sanitizeUsageStats(stats) { + if (!stats || typeof stats !== 'object') return stats; + + const sanitized = { ...stats }; + + // Remove or mask byApiKey entries + if (sanitized.byApiKey && typeof sanitized.byApiKey === 'object') { + const sanitizedByApiKey = {}; + + for (const [key, value] of Object.entries(sanitized.byApiKey)) { + // Mask the API key in the entry + const sanitizedEntry = { ...value }; + if (sanitizedEntry.apiKey) { + sanitizedEntry.apiKey = maskApiKey(sanitizedEntry.apiKey); + } + if (sanitizedEntry.apiKeyKey) { + sanitizedEntry.apiKeyKey = maskApiKey(sanitizedEntry.apiKeyKey); + } + + // Use masked key as the new key + const maskedKey = key.includes('|') + ? key.split('|').map((part, i) => i === 0 ? maskApiKey(part) : part).join('|') + : maskApiKey(key); + + sanitizedByApiKey[maskedKey] = sanitizedEntry; + } + + sanitized.byApiKey = sanitizedByApiKey; + } + + // Mask emails in byAccount + if (sanitized.byAccount && typeof sanitized.byAccount === 'object') { + const sanitizedByAccount = {}; + + for (const [key, value] of Object.entries(sanitized.byAccount)) { + const sanitizedEntry = { ...value }; + if (sanitizedEntry.accountName && sanitizedEntry.accountName.includes('@')) { + sanitizedEntry.accountName = maskEmail(sanitizedEntry.accountName); + } + sanitizedByAccount[key] = sanitizedEntry; + } + + sanitized.byAccount = sanitizedByAccount; + } + + // Mask emails in activeRequests + if (Array.isArray(sanitized.activeRequests)) { + sanitized.activeRequests = sanitized.activeRequests.map(req => { + const sanitizedReq = { ...req }; + if (sanitizedReq.account && sanitizedReq.account.includes('@')) { + sanitizedReq.account = maskEmail(sanitizedReq.account); + } + return sanitizedReq; + }); + } + + return sanitized; +} + +/** + * Sanitize provider connection data + * Removes tokens and credentials + */ +export function sanitizeProviderConnection(connection) { + return sanitizeResponse(connection, { + maskEmails: true, + maskApiKeys: false, + additionalFields: ['code', 'codeVerifier', 'state'], + }); +} + +/** + * Sanitize API key data + * Masks the actual key value + */ +export function sanitizeApiKeyData(keyData) { + if (!keyData) return keyData; + + if (Array.isArray(keyData)) { + return keyData.map(k => ({ + ...k, + key: maskApiKey(k.key), + })); + } + + return { + ...keyData, + key: maskApiKey(keyData.key), + }; +}