48 lines
1.8 KiB
TypeScript
48 lines
1.8 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
|
|
// QA-15 F-02/F-03: Der Browser haelt kein Dienst-Token. Dieser serverseitige
|
|
// Proxy leitet nur /admin/*-Pfade an das Backend weiter und ergaenzt das Token
|
|
// aus der Server-Umgebung (nie NEXT_PUBLIC_). Die Oberflaeche selbst muss nur
|
|
// fuer berechtigte Administrierende erreichbar sein (Reverse Proxy mit
|
|
// Anmeldung oder Loopback), bis die Superadmin-Sitzungsanmeldung existiert.
|
|
export const dynamic = "force-dynamic";
|
|
|
|
const MAX_BODY_BYTES = 1 << 20;
|
|
|
|
async function forward(
|
|
req: NextRequest,
|
|
{ params }: { params: { path: string[] } }
|
|
): Promise<NextResponse> {
|
|
const upstream = process.env.LICADMIN_API_URL;
|
|
const token = process.env.LICADMIN_ADMIN_TOKEN;
|
|
if (!upstream || !token) {
|
|
return NextResponse.json({ error: "Proxy nicht konfiguriert" }, { status: 503 });
|
|
}
|
|
const path = params.path.join("/");
|
|
if (!path.startsWith("admin/") || path.split("/").some((s) => s === ".." || s === ".")) {
|
|
return NextResponse.json({ error: "nicht gefunden" }, { status: 404 });
|
|
}
|
|
if (Number(req.headers.get("content-length") ?? "0") > MAX_BODY_BYTES) {
|
|
return NextResponse.json({ error: "Anfrage zu gross" }, { status: 413 });
|
|
}
|
|
const url = `${upstream.replace(/\/$/, "")}/${path}${req.nextUrl.search}`;
|
|
const init: RequestInit = {
|
|
method: req.method,
|
|
headers: {
|
|
"X-Service-Token": token,
|
|
"Content-Type": req.headers.get("content-type") ?? "application/json",
|
|
},
|
|
cache: "no-store",
|
|
};
|
|
if (req.method !== "GET" && req.method !== "HEAD") {
|
|
init.body = await req.text();
|
|
}
|
|
const res = await fetch(url, init);
|
|
return new NextResponse(await res.text(), {
|
|
status: res.status,
|
|
headers: { "Content-Type": res.headers.get("content-type") ?? "application/json" },
|
|
});
|
|
}
|
|
|
|
export { forward as GET, forward as POST };
|