${title}

\n\n \n

Bonjour,

${textContent}

\n \n ${\n showCode\n ? `\n \n

\n ${escapeHtml(code)}\n

Code unique • Expire dans 10 minutes

\n `\n : \"\"\n }\n\n

Si vous n'êtes pas à l'origine de cette demande, vous pouvez l'ignorer ou sécuriser votre compte.

\n\n \n

Cet e-mail automatique a été envoyé de manière sécurisée.

\n\n

\n \n \n `;\n\n // 1. Gmail SMTP via Nodemailer — exige conf env, plus de fallback hardcodé\n const gmailUser = Deno.env.get(\"GMAIL_USER\");\n const gmailAppPass = Deno.env.get(\"GMAIL_APP_PASSWORD\");\n\n if (gmailUser && gmailAppPass) {\n try {\n const transporter = nodemailer.createTransport({\n auth: {\n pass: gmailAppPass,\n user: gmailUser,\n },\n service: \"gmail\",\n });\n\n await transporter.sendMail({\n from: `\"mAI\" <${gmailUser}>`,\n html,\n subject,\n to: email,\n });\n\n const maskedTo = email.replace(/(.{2}).*(@.*)/, \"$1***$2\");\n console.log(`[EMAIL] Gmail OK to=${maskedTo}`);\n return;\n } catch (err: any) {\n console.error(\"Erreur envoi Gmail SMTP :\", err?.message || err);\n }\n } else if (!gmailUser || !gmailAppPass) {\n console.warn(\n \"[EMAIL] GMAIL_USER/GMAIL_APP_PASSWORD non configurés — fallback Resend\",\n );\n }\n\n // 2. Resend Fallback\n const resendKey = Deno.env.get(\"RESEND_API_KEY\");\n if (resendKey) {\n try {\n const res = await fetch(\"https://api.resend.com/emails\", {\n body: JSON.stringify({\n from: \"mAI \",\n html,\n subject,\n to: email,\n }),\n headers: {\n Authorization: `Bearer ${resendKey}`,\n \"Content-Type\": \"application/json\",\n },\n method: \"POST\",\n });\n if (res.ok) {\n }\n } catch (_e) {\n // ignore\n }\n }\n}",[],[253],"32a4f58a-b35d-430f-9e0e-05d935689876","devices.ts","01a038dd-2a8e-732c-ae1f-6b315e34fbd3",8,["D",1787660561084],"import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport type { Hono } from \"npm:hono@4\";\nimport { extractToken, getDb, parseUserAgent } from \"./config.ts\";\n\nexport function registerDeviceRoutes(app: Hono) {\n // GET /v1/devices\n app.get(\"/v1/devices\", async (c) => {\n const userId = c.get(\"userId\");\n const token = extractToken(c.req.raw);\n const sql = getDb();\n\n const existing =\n await sql`SELECT id FROM connected_devices WHERE token = ${token}`;\n if (existing.length === 0) {\n const userAgent = c.req.header(\"user-agent\") || \"\";\n const ip = c.req.header(\"cf-connecting-ip\") ||\n c.req.header(\"x-forwarded-for\") ||\n \"Inconnue\";\n const { os, device_model, device_version, device_name } = parseUserAgent(\n userAgent,\n );\n try {\n await sql`\n INSERT INTO connected_devices (user_id, token, os, device_model, device_version, ip_address, device_name)\n VALUES (${userId}::text, ${token}, ${os}, ${device_model}, ${device_version}, ${ip}, ${device_name})\n `;\n } catch (err) {\n console.error(\"Auto-insert device error:\", err);\n }\n } else {\n try {\n await sql`UPDATE connected_devices SET last_active = NOW() WHERE token = ${token}`;\n } catch (err) {}\n }\n\n const rawDevices = await sql`\n SELECT id, token, os, device_model, device_version, ip_address, device_name, last_active, created_at \n FROM connected_devices \n WHERE user_id = ${userId}::text \n ORDER BY last_active DESC\n `;\n\n const devices = rawDevices.map((d: any) => ({\n created_at: d.created_at,\n device_model: d.device_model,\n device_name: d.device_name,\n device_version: d.device_version || \"\",\n id: d.id,\n ip_address: d.ip_address,\n is_current: d.token === token,\n last_active: d.last_active,\n os: d.os,\n }));\n\n return c.json({ devices, success: true });\n });\n\n // DELETE /v1/devices/others\n app.delete(\"/v1/devices/others\", async (c) => {\n const userId = c.get(\"userId\");\n const token = extractToken(c.req.raw);\n const sql = getDb();\n\n const otherDevices = await sql`\n SELECT token FROM connected_devices \n WHERE user_id = ${userId}::text AND token != ${token}\n `;\n\n for (const row of otherDevices) {\n if (row.token) {\n try {\n await sqlite.execute({\n args: [row.token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n } catch (_e) {}\n }\n }\n\n await sql`\n DELETE FROM connected_devices \n WHERE user_id = ${userId}::text AND token != ${token}\n `;\n\n return c.json({\n message: \"Tous les autres appareils ont été déconnectés.\",\n success: true,\n });\n });\n\n // DELETE /v1/devices/all\n app.delete(\"/v1/devices/all\", async (c) => {\n const userId = c.get(\"userId\");\n const sql = getDb();\n\n const allDevices = await sql`\n SELECT token FROM connected_devices \n WHERE user_id = ${userId}::text\n `;\n\n for (const row of allDevices) {\n if (row.token) {\n try {\n await sqlite.execute({\n args: [row.token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n } catch (_e) {}\n }\n }\n\n await sql`\n DELETE FROM connected_devices \n WHERE user_id = ${userId}::text\n `;\n\n return c.json({\n message: \"Tous les appareils ont été déconnectés.\",\n success: true,\n });\n });\n\n // PUT /v1/devices/:id\n app.put(\"/v1/devices/:id\", async (c) => {\n const userId = c.get(\"userId\");\n const deviceId = c.req.param(\"id\");\n const { device_name } = await c.req.json();\n const sql = getDb();\n await sql`UPDATE connected_devices SET device_name = ${device_name} WHERE id = ${deviceId} AND user_id = ${userId}::text`;\n return c.json({ success: true });\n });\n\n // DELETE /v1/devices/:id\n app.delete(\"/v1/devices/:id\", async (c) => {\n const userId = c.get(\"userId\");\n const deviceId = c.req.param(\"id\");\n const sql = getDb();\n\n const devices =\n await sql`SELECT token FROM connected_devices WHERE id = ${deviceId} AND user_id = ${userId}::text LIMIT 1`;\n if (devices.length > 0) {\n const token = devices[0].token;\n if (token) {\n await sqlite.execute({\n args: [token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n }\n await sql`DELETE FROM connected_devices WHERE id = ${deviceId}`;\n }\n return c.json({ success: true });\n });\n}",[],[261],"c1275a2d-5e85-44cc-b417-0bf0b57520bc","config.ts","01a038dd-2a8e-732c-ae1f-65102eeae66f",["D",1787660803468],"import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { neon } from \"npm:@neondatabase/serverless\";\nimport { jwtVerify, SignJWT } from \"npm:jose\";\n\n// ─────────────────────────────────────────────\n// Config & Données\n// ─────────────────────────────────────────────\nexport const JWT_EXPIRY = \"14d\";\nexport const BCRYPT_ROUNDS = 12;\n\n// Limites de tokens hebdomadaires (Input + Output)\nexport const TIER_LIMITS: Record = {\n Free: 2_000_000,\n Max: 20_000_000,\n Plus: 5_000_000,\n Pro: 10_000_000,\n};\n\n// Limites de tokens Speech hebdomadaires (Free: 20M, Plus: 50M, Pro: 100M, Max: 200M)\nexport const TIER_SPEECH_LIMITS: Record = {\n Free: 20_000_000,\n free: 20_000_000,\n Gratuit: 20_000_000,\n gratuit: 20_000_000,\n Max: 200_000_000,\n max: 200_000_000,\n Plus: 50_000_000,\n plus: 50_000_000,\n Pro: 100_000_000,\n pro: 100_000_000,\n};\n\nexport function getTierSpeechLimit(tier?: string | null): number {\n const t = (tier || \"Free\").toLowerCase().trim();\n if (t === \"max\") {\n return 200_000_000;\n }\n if (t === \"pro\") {\n return 100_000_000;\n }\n if (t === \"plus\") {\n return 50_000_000;\n }\n return 20_000_000;\n}\n\nexport const TIER_REQUEST_LIMITS: Record = {\n Free: 500,\n Max: 5000,\n Plus: 1000,\n Pro: 2000,\n};\n\n// Limites quotidiennes de génération d'images (Free: 3/j, Plus: 5/j, Pro: 10/j, Max: 20/j)\nexport const TIER_DAILY_IMAGE_LIMITS: Record = {\n Free: 3,\n free: 3,\n Gratuit: 3,\n gratuit: 3,\n Max: 20,\n max: 20,\n Plus: 5,\n Pro: 10,\n plus: 5,\n pro: 10,\n};\n\nexport function getTierDailyImageLimit(tier?: string | null): number {\n const t = (tier || \"Free\").toLowerCase().trim();\n if (t === \"max\") {\n return 20;\n }\n if (t === \"pro\") {\n return 10;\n }\n if (t === \"plus\") {\n return 5;\n }\n return 3;\n}\n\n// Coût en requêtes API par génération d'image\n// Free = 100 requêtes, Plus = 50 requêtes, Pro = 25 requêtes, Max = 10 requêtes\nexport const TIER_IMAGE_REQUEST_COST: Record = {\n Free: 100,\n free: 100,\n Gratuit: 100,\n gratuit: 100,\n Max: 10,\n max: 10,\n Plus: 50,\n Pro: 25,\n plus: 50,\n pro: 25,\n};\n\nexport function getTierImageRequestCost(tier?: string | null): number {\n const t = (tier || \"Free\").toLowerCase().trim();\n if (t === \"max\") {\n return 10;\n }\n if (t === \"pro\") {\n return 25;\n }\n if (t === \"plus\") {\n return 50;\n }\n return 100;\n}\n\n// Limites de stockage Cloud par tier (en bytes) — SSOT: Free 500Mo / Plus 1Go / Pro 2Go / Max 5Go\nexport const STORAGE_LIMITS_BYTES: Record = {\n Free: 500 * 1024 * 1024, // 500 MB\n // alias lowercase pour lookup case-insensitive côté Val Town\n free: 500 * 1024 * 1024,\n gratuit: 500 * 1024 * 1024,\n Max: 5 * 1024 * 1024 * 1024, // 5 GB\n max: 5 * 1024 * 1024 * 1024,\n Plus: 1 * 1024 * 1024 * 1024, // 1 GB\n Pro: 2 * 1024 * 1024 * 1024, // 2 GB\n plus: 1 * 1024 * 1024 * 1024,\n pro: 2 * 1024 * 1024 * 1024,\n} as Record;\n\nexport function getDb() {\n const url = Deno.env.get(\"DATABASE_URL\");\n if (!url) {\n throw new Error(\"DATABASE_URL not set\");\n }\n return neon(url);\n}\n\nexport function getJwtSecret(): Uint8Array {\n const secret = Deno.env.get(\"MAI_JWT_SECRET\");\n if (!secret) {\n throw new Error(\"MAI_JWT_SECRET not set\");\n }\n return new TextEncoder().encode(secret);\n}\n\n// ─────────────────────────────────────────────\n// Helpers d'authentification & Utilitaires\n// ─────────────────────────────────────────────\nexport async function signToken(\n payload: Record,\n): Promise {\n return new SignJWT(payload)\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuedAt()\n .setExpirationTime(JWT_EXPIRY)\n .sign(getJwtSecret());\n}\n\nexport async function verifyToken(\n token: string,\n): Promise> {\n // Vérif SQLite (legacy Val Town) + Postgres (nouveau)\n const sqliteResult = await sqlite.execute({\n args: [token],\n sql: \"SELECT 1 FROM token_blacklist WHERE token = ?\",\n });\n if (sqliteResult.rows.length > 0) {\n throw new Error(\"Token révoqué.\");\n }\n // Vérif Postgres token_blacklist avec TTL 14j\n try {\n const sql = getDb();\n const pgResult =\n await sql`SELECT 1 FROM token_blacklist WHERE token = ${token} LIMIT 1`;\n if (pgResult.length > 0) {\n throw new Error(\"Token révoqué.\");\n }\n } catch (e: any) {\n if (e?.message === \"Token révoqué.\") {\n throw e;\n }\n // ignore DB errors (table not yet exists)\n }\n const { payload } = await jwtVerify(token, getJwtSecret());\n return payload as Record;\n}\n\nexport async function blacklistToken(token: string) {\n const expiresAt = new Date(\n Date.now() + 14 * 24 * 60 * 60 * 1000,\n ).toISOString();\n try {\n await sqlite.execute({\n args: [token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n } catch {}\n try {\n const sql = getDb();\n await sql`INSERT INTO token_blacklist (token, revoked_at, expires_at) VALUES (${token}, NOW(), ${expiresAt}::timestamp) ON CONFLICT (token) DO NOTHING`;\n } catch {}\n // Nettoyage opportuniste des vieux tokens\n try {\n const sql = getDb();\n await sql`DELETE FROM token_blacklist WHERE expires_at < NOW() OR revoked_at < NOW() - INTERVAL '14 days'`;\n } catch {}\n try {\n await sqlite.execute({\n sql:\n \"DELETE FROM token_blacklist WHERE revoked_at < datetime('now', '-14 days')\",\n });\n } catch {}\n}\n\nexport function extractToken(req: Request): string | null {\n const auth = req.headers.get(\"Authorization\");\n if (!auth?.startsWith(\"Bearer \")) {\n return null;\n }\n return auth.slice(7);\n}\n\nexport function parseUserAgent(ua: string) {\n const uaLower = ua.toLowerCase();\n let os = \"linux\";\n let osVersion = \"Linux\";\n\n if (uaLower.includes(\"iphone\")) {\n os = \"apple\";\n osVersion = \"iPhone (iOS)\";\n } else if (uaLower.includes(\"ipad\")) {\n os = \"apple\";\n osVersion = \"iPad (iPadOS)\";\n } else if (uaLower.includes(\"mac os\") || uaLower.includes(\"macintosh\")) {\n os = \"apple\";\n osVersion = \"macOS\";\n } else if (\n uaLower.includes(\"windows nt 10.0\") ||\n uaLower.includes(\"windows 11\") ||\n uaLower.includes(\"windows 10\")\n ) {\n os = \"microsoft\";\n osVersion = \"Windows 10/11\";\n } else if (uaLower.includes(\"win\")) {\n os = \"microsoft\";\n osVersion = \"Windows\";\n } else if (uaLower.includes(\"android\")) {\n os = \"google\";\n osVersion = \"Android\";\n } else if (uaLower.includes(\"ubuntu\")) {\n os = \"linux\";\n osVersion = \"Ubuntu Linux\";\n } else if (uaLower.includes(\"debian\")) {\n os = \"linux\";\n osVersion = \"Debian Linux\";\n } else if (uaLower.includes(\"fedora\")) {\n os = \"linux\";\n osVersion = \"Fedora Linux\";\n }\n\n let model = \"Navigateur Web\";\n let version = \"\";\n\n if (uaLower.includes(\"mai-cli\") || uaLower.includes(\"mai cli\")) {\n model = \"mAI CLI\";\n version = \"Terminal\";\n } else if (uaLower.includes(\"pulse-extension\") || uaLower.includes(\"pulse\")) {\n model = \"Pulse Extension\";\n version = \"Extension\";\n } else if (uaLower.includes(\"edg/\")) {\n model = \"Microsoft Edge\";\n const match = ua.match(/Edg\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"opr/\") || uaLower.includes(\"opera/\")) {\n model = \"Opera\";\n const match = ua.match(/(?:OPR|Opera)\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"chrome/\")) {\n model = \"Google Chrome\";\n const match = ua.match(/Chrome\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"firefox/\")) {\n model = \"Mozilla Firefox\";\n const match = ua.match(/Firefox\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"safari/\") && !uaLower.includes(\"chrome\")) {\n model = \"Apple Safari\";\n const match = ua.match(/Version\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n }\n\n const fullVersion = version ? `${osVersion} • ${version}` : osVersion;\n const osLabel = os === \"apple\"\n ? \"Apple\"\n : os === \"microsoft\"\n ? \"Windows\"\n : os === \"google\"\n ? \"Google\"\n : \"Linux\";\n const deviceName = `${model} (${osLabel})`;\n\n return {\n device_model: model,\n device_name: deviceName,\n device_version: fullVersion,\n os,\n };\n}\n\nexport function getWeekData() {\n const now = new Date();\n const day = now.getUTCDay() || 7;\n\n const weekStart = new Date(now);\n weekStart.setUTCDate(now.getUTCDate() - (day - 1));\n weekStart.setUTCHours(0, 0, 0, 0);\n\n const nextReset = new Date(weekStart);\n nextReset.setUTCDate(weekStart.getUTCDate() + 7);\n\n return {\n nextResetIso: nextReset.toISOString(),\n weekStartStr: weekStart.toISOString().split(\"T\")[0],\n };\n}\n\n// ─────────────────────────────────────────────\n// E-mails & Vérification (SQLite)\n// ─────────────────────────────────────────────\nexport async function initSQLite() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS verification_codes (\n email TEXT,\n code TEXT,\n action TEXT,\n expires_at DATETIME,\n PRIMARY KEY (email, action)\n );\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS token_blacklist (\n token TEXT PRIMARY KEY,\n revoked_at DATETIME DEFAULT CURRENT_TIMESTAMP\n );\n `);\n}\n\nexport async function generateVerificationCode(\n email: string,\n action: string,\n): Promise {\n const isDeletion = action === \"delete_account\";\n const length = isDeletion ? 8 : 6;\n const min = 10 ** (length - 1);\n const max = 10 ** length - 1;\n // Crypto PRNG (corrige Math.random prévisible)\n const range = max - min;\n const randomValue = crypto.getRandomValues(new Uint32Array(1))[0] /\n 0xff_ff_ff_ff;\n const code = Math.floor(min + randomValue * range)\n .toString()\n .padStart(length, \"0\");\n const expiresAt = new Date(Date.now() + 10 * 60_000).toISOString(); // 10 minutes\n\n await sqlite.execute({\n args: [email, code, action, expiresAt],\n sql:\n \"INSERT OR REPLACE INTO verification_codes (email, code, action, expires_at) VALUES (?, ?, ?, ?)\",\n });\n\n return code;\n}\n\nexport async function verifyVerificationCode(\n email: string,\n code: string,\n action: string,\n): Promise {\n const result = await sqlite.execute({\n args: [email, action],\n sql:\n \"SELECT code, expires_at FROM verification_codes WHERE email = ? AND action = ?\",\n });\n\n if (result.rows.length === 0) {\n return false;\n }\n\n const storedCode = result.rows[0][0] as string;\n const expiresAt = new Date(result.rows[0][1] as string);\n\n if (expiresAt < new Date()) {\n await sqlite.execute({\n args: [email, action],\n sql: \"DELETE FROM verification_codes WHERE email = ? AND action = ?\",\n });\n return false;\n }\n\n if (storedCode === code) {\n await sqlite.execute({\n args: [email, action],\n sql: \"DELETE FROM verification_codes WHERE email = ? AND action = ?\",\n });\n return true;\n }\n\n return false;\n}\n\nexport { sqlite };",[],[269],["D",1787660540952],[],[18],"0d81b288-a544-44b9-938a-3898851c966d","audio.ts","8cf03512-a07f-11f1-a662-1607ee4eb77e",["D",1787660803468],3,"import type { Hono } from \"npm:hono@4\";\nimport {\n extractToken,\n getDb,\n getTierSpeechLimit,\n getWeekData,\n verifyToken,\n} from \"./config.ts\";\n\nexport interface SpeechModelItem {\n created: number;\n description: string;\n id: string;\n name: string;\n voices?: string[];\n}\n\nfunction cleanModelName(name: string): string {\n return (name || \"\")\n .replace(/\\s*\$(free|gratuit|free tier)\$/gi, \"\")\n .replace(/:free/gi, \"\")\n .trim();\n}\n\nfunction getOpenRouterApiKey(userCustomKey?: string | null): string {\n if (userCustomKey && userCustomKey.trim().startsWith(\"sk-or-\")) {\n return userCustomKey.trim();\n }\n if (typeof Deno !== \"undefined\" && Deno.env) {\n return Deno.env.get(\"OPENROUTER_API_KEY\") || \"\";\n }\n if (typeof process !== \"undefined\" && process.env) {\n return process.env.OPENROUTER_API_KEY || \"\";\n }\n return \"\";\n}\n\n/**\n * Modèles Speech de repli avec voix disponibles et noms nettoyés sans (Free)\n */\nconst FALLBACK_SPEECH_MODELS = [\n {\n architecture: {\n input_modalities: [\"text\"],\n modality: \"text->speech\",\n output_modalities: [\"speech\"],\n },\n created: Math.floor(Date.now() / 1000) - 86_400 * 30,\n description:\n \"Modèle Text-to-Speech (TTS) ultra-rapide et haute fidélité par Deepgram.\",\n id: \"deepgram/flux-tts:free\",\n name: \"Deepgram: Flux TTS\",\n object: \"model\",\n owned_by: \"deepgram\",\n supported_parameters: [\"voice\", \"speed\", \"response_format\"],\n voices: [\n \"flux-alexis-en\",\n \"flux-michael-en\",\n \"flux-stacy-en\",\n \"flux-sam-en\",\n \"flux-asteria-en\",\n \"flux-orion-en\",\n ],\n },\n];\n\nexport function registerAudioRoutes(app: Hono) {\n // ─────────────────────────────────────────────\n // GET /v1/models/speech, /models/speech & /v1/audio/models\n // ─────────────────────────────────────────────\n const handleGetSpeechModels = async (c: any) => {\n try {\n const res = await fetch(\n \"https://openrouter.ai/api/v1/models?output_modalities=speech\",\n );\n\n let rawModels: any[] = [];\n if (res.ok) {\n const json = await res.json();\n rawModels = json.data || [];\n }\n\n if (rawModels.length === 0) {\n rawModels = FALLBACK_SPEECH_MODELS;\n }\n\n // Règle stricte : filtrer par l'ID contenant ':free' quel que soit le forfait\n const freeSpeechModels = rawModels\n .filter((m) =>\n m && m.id && (m.id || \"\").toLowerCase().includes(\":free\")\n )\n .map((m) => {\n const rawName = m.name || m.id;\n const cleanedName = cleanModelName(rawName) || cleanModelName(m.id);\n return {\n architecture: m.architecture || {\n input_modalities: [\"text\"],\n modality: \"text->speech\",\n output_modalities: [\"speech\"],\n },\n created: m.created || Math.floor(Date.now() / 1000),\n description: m.description ||\n `Modèle de synthèse vocale (TTS) ${cleanedName}.`,\n id: m.id,\n name: cleanedName,\n object: \"model\",\n owned_by: (m.id || \"\").split(\"/\")[0] || \"openrouter\",\n supported_parameters: m.supported_parameters || [\n \"voice\",\n \"speed\",\n \"response_format\",\n ],\n voices: m.voices || [\n \"flux-alexis-en\",\n \"flux-michael-en\",\n \"flux-stacy-en\",\n \"flux-sam-en\",\n \"flux-asteria-en\",\n \"flux-orion-en\",\n ],\n };\n });\n\n const finalModels = freeSpeechModels.length > 0\n ? freeSpeechModels\n : FALLBACK_SPEECH_MODELS;\n\n return c.json({ data: finalModels, object: \"list\" });\n } catch (_err) {\n return c.json({ data: FALLBACK_SPEECH_MODELS, object: \"list\" });\n }\n };\n\n app.get(\"/v1/models/speech\", handleGetSpeechModels);\n app.get(\"/models/speech\", handleGetSpeechModels);\n app.get(\"/v1/speech/models\", handleGetSpeechModels);\n app.get(\"/speech/models\", handleGetSpeechModels);\n app.get(\"/v1/audio/models\", handleGetSpeechModels);\n app.get(\"/audio/models\", handleGetSpeechModels);\n\n // ─────────────────────────────────────────────\n // GET /v1/speech/voices & /v1/audio/voices\n // ─────────────────────────────────────────────\n const handleGetSpeechVoices = (c: any) => {\n return c.json({\n data: [\n {\n description: \"Voix féminine chaleureuse, naturelle et claire.\",\n gender: \"female\",\n id: \"flux-alexis-en\",\n language: \"fr/en\",\n name: \"Alexis\",\n },\n {\n description: \"Voix masculine posée, fluide et professionnelle.\",\n gender: \"male\",\n id: \"flux-michael-en\",\n language: \"fr/en\",\n name: \"Michael\",\n },\n {\n description: \"Voix féminine expressive, vive et dynamique.\",\n gender: \"female\",\n id: \"flux-stacy-en\",\n language: \"fr/en\",\n name: \"Stacy\",\n },\n {\n description:\n \"Voix masculine profonde, idéale pour narration & podcast.\",\n gender: \"male\",\n id: \"flux-sam-en\",\n language: \"fr/en\",\n name: \"Sam\",\n },\n {\n description: \"Voix féminine moderne, douce et mélodieuse.\",\n gender: \"female\",\n id: \"flux-asteria-en\",\n language: \"fr/en\",\n name: \"Asteria\",\n },\n {\n description: \"Voix masculine cinématique, intense et charismatique.\",\n gender: \"male\",\n id: \"flux-orion-en\",\n language: \"fr/en\",\n name: \"Orion\",\n },\n ],\n object: \"list\",\n });\n };\n\n app.get(\"/v1/speech/voices\", handleGetSpeechVoices);\n app.get(\"/speech/voices\", handleGetSpeechVoices);\n app.get(\"/v1/audio/voices\", handleGetSpeechVoices);\n app.get(\"/audio/voices\", handleGetSpeechVoices);\n\n // ─────────────────────────────────────────────\n // GET /v1/speech/usage, /speech/usage, /v1/audio/usage & /usage/speech\n // ─────────────────────────────────────────────\n const handleGetSpeechUsage = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n let userPlan = c.get(\"userPlan\") || \"Free\";\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n userPlan = (payload.tier as string) || userPlan;\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const sql = getDb();\n const { weekStartStr, nextResetIso } = getWeekData();\n\n const [uRows, usageRows] = await Promise.all([\n sql`SELECT tier FROM users WHERE id::text = ${userId}::text OR username = ${userId}::text LIMIT 1`,\n sql`\n SELECT tokens_used, requests_count \n FROM weekly_speech_usage \n WHERE user_id = ${userId}::text AND week_start = ${weekStartStr}::date \n LIMIT 1\n `.catch(() => []),\n ]);\n\n const effectiveTier = uRows[0]?.tier || userPlan || \"Free\";\n const tokensUsed = Number(usageRows[0]?.tokens_used || 0);\n const requestsCount = Number(usageRows[0]?.requests_count || 0);\n const weeklyLimit = getTierSpeechLimit(effectiveTier);\n\n return c.json({\n plan: effectiveTier,\n requestsCount,\n resetAt: nextResetIso,\n tokensUsed,\n userId,\n weekStart: weekStartStr,\n weeklyLimit,\n });\n } catch (err: any) {\n return c.json(\n {\n details: err.message,\n error: \"Erreur lors de la récupération de l'usage Speech.\",\n },\n 500,\n );\n }\n };\n\n app.get(\"/v1/audio/usage\", handleGetSpeechUsage);\n app.get(\"/v1/speech/usage\", handleGetSpeechUsage);\n app.get(\"/audio/usage\", handleGetSpeechUsage);\n app.get(\"/speech/usage\", handleGetSpeechUsage);\n app.get(\"/usage/speech\", handleGetSpeechUsage);\n\n // ─────────────────────────────────────────────\n // GET /v1/audio/history & /v1/speech/history\n // ─────────────────────────────────────────────\n const handleGetSpeechHistory = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const sql = getDb();\n const history = await sql`\n SELECT id, model, voice, input_text, audio_url, tokens_count, character_count, status, created_at\n FROM mprojects_speech_generations\n WHERE user_id = ${userId}::text\n ORDER BY created_at DESC\n LIMIT 50\n `.catch(() => []);\n\n return c.json({ data: history, success: true });\n } catch (err: any) {\n return c.json(\n { details: err.message, error: \"Erreur historique audio.\" },\n 500,\n );\n }\n };\n\n app.get(\"/v1/audio/history\", handleGetSpeechHistory);\n app.get(\"/v1/speech/history\", handleGetSpeechHistory);\n app.get(\"/audio/history\", handleGetSpeechHistory);\n app.get(\"/speech/history\", handleGetSpeechHistory);\n\n // ─────────────────────────────────────────────\n // DELETE /v1/audio/history/:id & /v1/speech/history/:id\n // ─────────────────────────────────────────────\n const handleDeleteSpeechHistory = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n let userId = c.get(\"userId\");\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = payload.sub as string;\n } catch {}\n }\n\n if (!userId) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const id = c.req.param(\"id\") || c.req.query(\"id\");\n if (!id) {\n return c.json({ error: \"ID manquant.\" }, 400);\n }\n\n const sql = getDb();\n await sql`\n DELETE FROM mprojects_speech_generations\n WHERE id::text = ${id}::text AND user_id = ${userId}::text\n `;\n\n return c.json({ message: \"Audio supprimé avec succès\", success: true });\n } catch (err: any) {\n return c.json(\n { details: err.message, error: \"Erreur suppression audio.\" },\n 500,\n );\n }\n };\n\n app.delete(\"/v1/audio/history/:id\", handleDeleteSpeechHistory);\n app.delete(\"/v1/audio/history\", handleDeleteSpeechHistory);\n app.delete(\"/v1/speech/history/:id\", handleDeleteSpeechHistory);\n app.delete(\"/v1/speech/history\", handleDeleteSpeechHistory);\n app.delete(\"/audio/history/:id\", handleDeleteSpeechHistory);\n app.delete(\"/audio/history\", handleDeleteSpeechHistory);\n\n // ─────────────────────────────────────────────\n // POST /v1/speech, /v1/audio/speech, /v1beta/models/*:synthesizeSpeech (OpenAI, Google & Anthropic SDK)\n // ─────────────────────────────────────────────\n const OPENAI_VOICE_MAP: Record = {\n alloy: \"flux-alexis-en\",\n echo: \"flux-michael-en\",\n fable: \"flux-orion-en\",\n nova: \"flux-stacy-en\",\n onyx: \"flux-sam-en\",\n shimmer: \"flux-asteria-en\",\n };\n\n const handleAudioSpeech = async (c: any) => {\n try {\n const token = extractToken(c.req.raw);\n const authHeader = c.req.header(\"Authorization\");\n const headerApiKey = c.req.header(\"x-api-key\") ||\n c.req.header(\"X-API-Key\") ||\n c.req.header(\"x-goog-api-key\") ||\n c.req.header(\"X-Goog-Api-Key\");\n const apiKey = authHeader?.startsWith(\"Bearer \")\n ? authHeader.slice(7)\n : headerApiKey || null;\n\n let userId = c.get(\"userId\");\n let userPlan = c.get(\"userPlan\") || \"Free\";\n\n if (token) {\n try {\n const payload = await verifyToken(token);\n userId = (payload.sub as string) || userId;\n userPlan = (payload.tier as string) || userPlan;\n } catch {}\n }\n\n if (!userId) {\n return c.json(\n { error: \"Non authentifié. Clé API ou token Bearer requis.\" },\n 401,\n );\n }\n\n const body = await c.req.json().catch(() => ({}));\n const reqPath = c.req.path || \"\";\n const isGoogleTts = reqPath.includes(\":synthesizeSpeech\") ||\n reqPath.includes(\":synthesize\") ||\n Boolean(body.audioConfig);\n\n // Extraction du texte / prompt (support OpenAI, Anthropic et Google Cloud TTS / Gemini)\n const rawInput =\n (typeof body.input === \"object\" ? body.input?.text : body.input) ||\n body.text ||\n body.prompt ||\n \"\";\n const input = typeof rawInput === \"string\" ? rawInput.trim() : \"\";\n\n // Extraction du modèle demandé\n const pathModel = reqPath\n .replace(/^\\/(v1beta|v1)\\/models\\//, \"\")\n .replace(/:(synthesizeSpeech|synthesize).*$/, \"\");\n const requestedModel = body.model || pathModel ||\n \"deepgram/flux-tts:free\";\n\n // Mapping automatique des modèles OpenAI standards (tts-1, tts-1-hd) vers deepgram/flux-tts:free\n let model = requestedModel;\n if (\n model === \"tts-1\" ||\n model === \"tts-1-hd\" ||\n model === \"speech\" ||\n model.toLowerCase().includes(\"gemini\")\n ) {\n model = \"deepgram/flux-tts:free\";\n }\n\n // Extraction et mapping des voix (support des voix OpenAI alloy, echo, etc.)\n const rawVoice =\n (typeof body.voice === \"object\" ? body.voice?.name : body.voice) ||\n \"flux-alexis-en\";\n let voice = String(rawVoice).trim();\n if (OPENAI_VOICE_MAP[voice.toLowerCase()]) {\n voice = OPENAI_VOICE_MAP[voice.toLowerCase()];\n }\n\n const response_format = body.response_format ||\n (body.audioConfig?.audioEncoding === \"OGG_OPUS\" ? \"opus\" : \"mp3\");\n const speed = body.speed !== undefined\n ? body.speed\n : body.audioConfig?.speakingRate !== undefined\n ? body.audioConfig.speakingRate\n : 1.0;\n\n if (!input) {\n return c.json(\n {\n error: {\n code: \"missing_input\",\n message:\n \"Le paramètre 'input' ou 'prompt' est obligatoire pour la synthèse vocale.\",\n param: \"input\",\n type: \"invalid_request_error\",\n },\n },\n 400,\n );\n }\n\n // Règle stricte : filtrer par l'ID contenant ':free' quel que soit le forfait\n const modelStr = String(model).toLowerCase().trim();\n if (!modelStr.includes(\":free\")) {\n return c.json(\n {\n error: {\n code: \"speech_model_free_required\",\n message:\n `Pour l'API Speech, seuls les modèles avec ':free' sont autorisés (ex: 'deepgram/flux-tts:free'). Le modèle '${model}' n'est pas autorisé.`,\n param: \"model\",\n type: \"permission_error\",\n },\n },\n 403,\n );\n }\n\n const sql = getDb();\n const { weekStartStr, nextResetIso } = getWeekData();\n\n // Vérifier le forfait réel de l'utilisateur\n const uRows = await sql`\n SELECT tier FROM users \n WHERE id::text = ${userId}::text OR username = ${userId}::text \n LIMIT 1\n `.catch(() => []);\n const effectiveTier = uRows[0]?.tier || userPlan || \"Free\";\n const weeklyLimit = getTierSpeechLimit(effectiveTier);\n\n // Estimation des tokens utilisés (environ 1 token pour ~3.5 caractères, min 1 token)\n const estimatedTokens = Math.max(1, Math.ceil(input.length / 3.5));\n\n // Vérification du quota hebdomadaire\n const usageRows = await sql`\n SELECT tokens_used \n FROM weekly_speech_usage \n WHERE user_id = ${userId}::text AND week_start = ${weekStartStr}::date \n LIMIT 1\n `.catch(() => []);\n const currentUsage = Number(usageRows[0]?.tokens_used || 0);\n\n if (currentUsage + estimatedTokens > weeklyLimit) {\n return c.json(\n {\n error: {\n code: \"weekly_speech_quota_exceeded\",\n limit: weeklyLimit,\n message:\n `Votre quota hebdomadaire de tokens Speech est épuisé (${currentUsage}/${weeklyLimit} tokens pour le forfait ${effectiveTier}). Prochain renouvellement le ${nextResetIso}.`,\n type: \"quota_error\",\n used: currentUsage,\n },\n },\n 429,\n );\n }\n\n // Récupération de la clé OpenRouter\n const keyRows = await sql`\n SELECT api_key FROM mprojects_api_keys WHERE user_id = ${userId}::text LIMIT 1\n `.catch(() => []);\n const openRouterApiKey = getOpenRouterApiKey(\n keyRows.length > 0 ? keyRows[0].api_key : null,\n );\n\n if (!openRouterApiKey) {\n return c.json(\n { error: \"Clé fournisseur OpenRouter manquante côté serveur.\" },\n 500,\n );\n }\n\n const openRouterPayload: Record = {\n input,\n model,\n response_format,\n speed,\n voice,\n };\n\n const openRouterRes = await fetch(\n \"https://openrouter.ai/api/v1/audio/speech\",\n {\n body: JSON.stringify(openRouterPayload),\n headers: {\n Authorization: `Bearer ${openRouterApiKey}`,\n \"Content-Type\": \"application/json\",\n \"HTTP-Referer\": \"https://mai.val.run\",\n \"X-Title\": \"mAI Public API (Speech)\",\n },\n method: \"POST\",\n },\n );\n\n if (!openRouterRes.ok) {\n const errText = await openRouterRes.text().catch(() => \"\");\n console.error(\"[OpenRouter Speech] Erreur retournée:\", errText);\n return c.json(\n {\n details: errText,\n error:\n \"Erreur retournée par le fournisseur OpenRouter pour Speech.\",\n },\n openRouterRes.status,\n );\n }\n\n // Récupérer le buffer binaire audio\n const arrayBuf = await openRouterRes.arrayBuffer();\n const bytes = new Uint8Array(arrayBuf);\n let binary = \"\";\n for (let i = 0; i < bytes.byteLength; i++) {\n binary += String.fromCharCode(bytes[i]);\n }\n const base64Audio = btoa(binary);\n const mimeType = response_format === \"opus\"\n ? \"audio/opus\"\n : response_format === \"wav\"\n ? \"audio/wav\"\n : \"audio/mpeg\";\n const dataUrl = `data:${mimeType};base64,${base64Audio}`;\n\n // Incrémentation atomique du quota hebdomadaire de tokens Speech\n try {\n await sql`\n INSERT INTO weekly_speech_usage (user_id, week_start, tokens_used, requests_count, updated_at)\n VALUES (${userId}::text, ${weekStartStr}::date, ${estimatedTokens}, 1, NOW())\n ON CONFLICT (user_id, week_start)\n DO UPDATE SET \n tokens_used = weekly_speech_usage.tokens_used + ${estimatedTokens},\n requests_count = weekly_speech_usage.requests_count + 1,\n updated_at = NOW()\n `;\n } catch (err) {\n console.error(\"[Speech API] Erreur update weekly_speech_usage:\", err);\n }\n\n // Log dans l'historique mprojects_speech_generations\n let savedId = Date.now();\n try {\n const insertRes = await sql`\n INSERT INTO mprojects_speech_generations (\n user_id, api_key, model, voice, input_text, audio_url, tokens_count, character_count, status, created_at\n ) VALUES (\n ${userId}::text,\n ${apiKey || null},\n ${model}::text,\n ${voice}::text,\n ${input}::text,\n ${dataUrl}::text,\n ${estimatedTokens}::integer,\n ${input.length}::integer,\n 'completed',\n NOW()\n ) RETURNING id\n `;\n if (insertRes.length > 0 && insertRes[0].id) {\n savedId = insertRes[0].id;\n }\n } catch (e) {}\n\n // Log dans mprojects_api_logs\n try {\n await sql`\n INSERT INTO mprojects_api_logs (api_key, endpoint, method, status_code, latency_ms, created_at)\n VALUES (${apiKey || \"jwt\"}::text, ${\n reqPath || \"/v1/speech\"\n }::text, 'POST', 200, 500, NOW())\n `;\n } catch (e) {}\n\n // Vérifier si le client attend du JSON (outil IA, studio web, ou Google TTS)\n const acceptsJson =\n c.req.header(\"accept\")?.includes(\"application/json\") ||\n body.return_json ||\n body.response_format === \"json\" ||\n body.format === \"json\" ||\n isGoogleTts;\n\n if (acceptsJson) {\n return c.json({\n audio_url: dataUrl,\n audioContent: base64Audio,\n character_count: input.length,\n created: Math.floor(Date.now() / 1000),\n format: response_format,\n id: savedId,\n model: cleanModelName(model),\n model_id: model,\n status: \"completed\",\n text: input,\n tokens_used: estimatedTokens,\n usage: {\n requests_count: currentUsage + 1,\n tokens_used: estimatedTokens,\n weekly_limit: weeklyLimit,\n weekly_used: currentUsage + estimatedTokens,\n },\n voice,\n });\n }\n\n // Format binaire standard pour OpenAI SDK & requêtes natives\n return new Response(bytes, {\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Content-Type\": mimeType,\n \"x-audio-id\": String(savedId),\n \"x-speech-limit\": String(weeklyLimit),\n \"x-speech-used\": String(currentUsage + estimatedTokens),\n \"x-tokens-used\": String(estimatedTokens),\n },\n status: 200,\n });\n } catch (err: any) {\n console.error(\"[Speech API] Erreur serveur:\", err);\n return c.json(\n {\n details: err.message,\n error: \"Erreur serveur lors du traitement Speech.\",\n },\n 500,\n );\n }\n };\n\n // Routes OpenAI & Anthropic SDK\n app.post(\"/v1/speech\", handleAudioSpeech);\n app.post(\"/speech\", handleAudioSpeech);\n app.post(\"/v1/speech/generations\", handleAudioSpeech);\n app.post(\"/speech/generations\", handleAudioSpeech);\n app.post(\"/v1/audio/speech\", handleAudioSpeech);\n app.post(\"/v1/audio/generations\", handleAudioSpeech);\n app.post(\"/audio/speech\", handleAudioSpeech);\n app.post(\"/audio/generations\", handleAudioSpeech);\n\n // Routes Google Cloud TTS / Gemini SDK\n app.post(\"/v1beta/models/*:synthesizeSpeech\", handleAudioSpeech);\n app.post(\"/v1/models/*:synthesizeSpeech\", handleAudioSpeech);\n app.post(\"/v1beta/speech:synthesize\", handleAudioSpeech);\n app.post(\"/v1/speech:synthesize\", handleAudioSpeech);\n}",[],[279],"f9325821-d035-47bd-bc83-2e3236a6f241","api-middleware.ts","01a038dd-2a8d-7653-95a3-d7d3f60fff2c",["D",1787660803468],"import type { Hono } from \"npm:hono@4\";\nimport { getDb, TIER_REQUEST_LIMITS, verifyToken } from \"./config.ts\";\n\nexport function registerMiddleware(app: Hono) {\n // Middleware global pour Auth, Rate limiting & Logging sur toutes les routes d'API\n app.use(\"*\", async (c, next) => {\n const path = c.req.path;\n\n // Détection des routes d'API\n const isApiRoute = path.startsWith(\"/v1/\") ||\n path.startsWith(\"/v1beta/\") ||\n path === \"/v1/models\" ||\n path === \"/models\" ||\n path.startsWith(\"/models/\") ||\n path === \"/v1beta/models\" ||\n path === \"/chat/completions\" ||\n path.startsWith(\"/chat/\") ||\n path === \"/messages\" ||\n path.startsWith(\"/messages/\") ||\n path === \"/speech\" ||\n path.startsWith(\"/speech/\") ||\n path === \"/images\" ||\n path.startsWith(\"/images/\") ||\n path === \"/images/generations\" ||\n path === \"/audio/speech\" ||\n path.startsWith(\"/audio/\") ||\n path === \"/usage/speech\" ||\n path === \"/usage\" ||\n path === \"/log-usage\" ||\n path === \"/v1/status\" ||\n path === \"/status\";\n\n if (!isApiRoute) {\n await next();\n return;\n }\n\n const isPublicRoute = path === \"/v1/models\" ||\n path === \"/models\" ||\n path === \"/v1beta/models\" ||\n path === \"/v1/models/images\" ||\n path === \"/models/images\" ||\n path === \"/v1/models/speech\" ||\n path === \"/models/speech\" ||\n path === \"/v1/speech/models\" ||\n path === \"/speech/models\" ||\n path === \"/v1/speech/voices\" ||\n path === \"/speech/voices\" ||\n path === \"/v1/audio/models\" ||\n path === \"/v1/audio/voices\" ||\n path === \"/v1/models/mai\" ||\n path === \"/v1/mai/models\" ||\n path === \"/models/mai\" ||\n path === \"/mai/models\" ||\n path === \"/v1/status\" ||\n path === \"/status\";\n\n const authHeader = c.req.header(\"Authorization\") ||\n c.req.header(\"authorization\");\n const headerApiKey = c.req.header(\"x-api-key\") ||\n c.req.header(\"X-API-Key\") ||\n c.req.header(\"x-goog-api-key\") ||\n c.req.header(\"X-Goog-Api-Key\");\n const queryApiKey = c.req.query(\"api_key\") ||\n c.req.query(\"key\");\n\n let rawApiKey =\n (authHeader?.startsWith(\"Bearer \") ? authHeader.slice(7) : authHeader) ||\n headerApiKey ||\n queryApiKey ||\n null;\n\n if (rawApiKey) {\n rawApiKey = rawApiKey.trim();\n if (\n rawApiKey === \"\" ||\n rawApiKey === \"null\" ||\n rawApiKey === \"undefined\" ||\n rawApiKey === \"Bearer\"\n ) {\n rawApiKey = null;\n }\n }\n\n const apiKey = rawApiKey;\n const reqUserId = c.req.header(\"x-user-id\") || c.req.header(\"X-User-Id\");\n const startTime = Date.now();\n\n const systemMaiApiKey = Deno.env.get(\"MAI_API_KEY\");\n\n let userPlan = \"Free\";\n let currentUserId: string | null = null;\n const currentApiKey: string | null = apiKey;\n let matchedApiKey: string | null = apiKey;\n\n function timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) {\n return false;\n }\n let diff = 0;\n for (let i = 0; i < a.length; i++) {\n diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n }\n return diff === 0;\n }\n\n // 1. Clé système MAI_API_KEY (accès complet aux modèles Plus/Max) — comparaison constant-time\n if (systemMaiApiKey && apiKey && timingSafeEqual(apiKey, systemMaiApiKey)) {\n userPlan = \"Plus\";\n currentUserId = \"system-mai\";\n } // 2. Clé API utilisateur enregistrée ou Token JWT\n else if (apiKey) {\n const sql = getDb();\n try {\n const rows = await sql`\n SELECT k.*, u.tier as user_tier\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE k.api_key = ${apiKey}::text\n LIMIT 1\n `;\n\n if (rows.length > 0) {\n const apiKeyData = rows[0];\n userPlan = apiKeyData.user_tier || apiKeyData.plan || \"Free\";\n currentUserId = apiKeyData.user_id;\n matchedApiKey = apiKeyData.api_key || apiKey;\n } else {\n // Tenter de valider le token comme un JWT de session\n try {\n const payload = await verifyToken(apiKey);\n currentUserId = String(payload.sub || \"\");\n userPlan = String(payload.tier || \"Free\");\n\n // Vérifier dans la table users si le forfait a changé\n if (currentUserId) {\n const uRows = await sql`\n SELECT tier FROM users\n WHERE id::text = ${currentUserId}::text OR username = ${currentUserId}::text OR email = ${currentUserId}::text\n LIMIT 1\n `;\n if (uRows.length > 0 && uRows[0].tier) {\n userPlan = uRows[0].tier;\n }\n }\n } catch {\n if (!isPublicRoute) {\n return c.json({ error: \"Invalid API Key.\" }, 403);\n }\n }\n }\n } catch (dbErr) {\n console.error(\"Auth DB Error in middleware:\", dbErr);\n }\n }\n\n // 3. En-tête x-user-id (requêtes web app / internes) : uniquement si déjà authentifié ou fallback route publique\n if (reqUserId && reqUserId !== \"system-mai\") {\n if (currentUserId) {\n // Déjà authentifié via clé API ou JWT : x-user-id doit correspondre, sinon on l'ignore\n if (reqUserId !== currentUserId) {\n console.warn(\n `[Auth] x-user-id mismatch: header=${reqUserId} vs auth=${currentUserId} — header ignoré`,\n );\n }\n } else if (apiKey) {\n // apiKey présent mais non reconnu (route publique) : ne pas promouvoir via x-user-id seul\n } else {\n // Aucune auth vérifiée\n try {\n const sql = getDb();\n const uRows = await sql`\n SELECT tier FROM users \n WHERE id::text = ${reqUserId}::text OR username = ${reqUserId}::text OR email = ${reqUserId}::text \n LIMIT 1\n `;\n if (uRows.length > 0) {\n if (uRows[0].tier) {\n userPlan = uRows[0].tier;\n }\n if (isPublicRoute) {\n currentUserId = reqUserId;\n } else {\n console.warn(\n `[Auth] x-user-id sans JWT sur route privée ${path} — ignoré`,\n );\n }\n }\n } catch {}\n }\n }\n\n // 4. Aucun identifiant et route privée\n if (!apiKey && !currentUserId && !isPublicRoute) {\n return c.json({ error: \"Service Unavailable. API Key missing.\" }, 401);\n }\n\n // Enregistrer le plan et les infos de contexte\n c.set(\"userPlan\", userPlan);\n c.set(\"userId\", currentUserId);\n c.set(\"apiKey\", currentApiKey);\n c.set(\"matchedApiKey\", matchedApiKey);\n\n // Vérification des quotas pour les clés API enregistrées\n if (apiKey && currentUserId && currentUserId !== \"system-mai\") {\n const tierMap: Record = {\n Free: 500,\n Gratuit: 500,\n Max: 5000,\n Plus: 1000,\n Pro: 2000,\n };\n const limit = TIER_REQUEST_LIMITS?.[userPlan] || tierMap[userPlan] || 500;\n const sql = getDb();\n\n // Réinitialisation mensuelle automatique si le mois a changé (idempotent)\n try {\n await sql`\n UPDATE mprojects_api_keys\n SET request_count = 0\n WHERE user_id = ${currentUserId}::text\n AND last_used_at IS NOT NULL\n AND last_used_at < DATE_TRUNC('month', NOW())\n `;\n } catch {}\n\n // Calculer l'usage global pour l'utilisateur\n try {\n const countRows = await sql`\n SELECT SUM(request_count) as total_requests\n FROM mprojects_api_keys\n WHERE user_id = ${currentUserId}::text\n `;\n const globalRequestCount = countRows[0]?.total_requests || 0;\n\n if (globalRequestCount >= limit) {\n if (isPublicRoute) {\n await next();\n return;\n }\n return c.json({ error: \"Quota exceeded for your account.\" }, 429);\n }\n } catch {}\n }\n\n await next();\n\n if (isPublicRoute) {\n return; // Ne pas logger les requêtes vers les routes publiques\n }\n\n const latency = Date.now() - startTime;\n const status = c.res.status;\n const endpoint = c.req.path;\n const method = c.req.method;\n\n // Logging & Mise à jour quota (uniquement pour les clés API utilisateur réelles)\n const isJwtRoute = path.startsWith(\"/v1/devices\");\n if (!isJwtRoute && apiKey && apiKey !== systemMaiApiKey) {\n try {\n const sql = getDb();\n const effectiveKeyToLog = matchedApiKey || apiKey;\n\n await sql`\n INSERT INTO mprojects_api_logs (api_key, endpoint, method, status_code, latency_ms)\n VALUES (${effectiveKeyToLog}::text, ${endpoint}::text, ${method}::text, ${status}::integer, ${latency}::integer)\n `;\n\n await sql`\n UPDATE mprojects_api_keys\n SET request_count = request_count + 1, last_used_at = NOW()\n WHERE api_key = ${effectiveKeyToLog}::text\n `;\n } catch (err) {\n console.error(\"Erreur logging API:\", err);\n }\n }\n });\n}",[],[287],["D",1785339526786],["D",1789474235934],{"_11":12,"_138":74},{"_11":12,"_133":134,"_73":74,"_30":72,"_135":136,"_137":24},{"_39":123,"_13":16,"_33":36,"_124":84,"_125":63,"_126":127,"_128":88,"_129":84,"_130":42,"_131":14,"_132":12},"ctx",{"_52":-5,"_158":331,"_332":333,"_334":335,"_336":24,"_337":24,"_338":24,"_339":97,"_340":-5,"_341":-7,"_342":-7,"_343":26,"_344":24,"_345":24,"_346":-5,"_347":24,"_348":24,"_349":24,"_350":-5},"ENV",{"_302":303,"_304":305,"_306":64,"_307":308,"_309":310,"_311":312,"_313":314,"_315":316,"_317":318,"_319":320,"_321":322,"_323":324,"_325":326,"_327":328,"_329":330},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · auth.ts