${title}

\n\n \n

Bonjour,

${textContent}

\n \n ${\n showCode\n ? `\n \n

\n ${escapeHtml(code)}\n

Code unique • Expire dans 10 minutes

\n `\n : \"\"\n }\n\n

Si vous n'êtes pas à l'origine de cette demande, vous pouvez l'ignorer ou sécuriser votre compte.

\n\n \n

Cet e-mail automatique a été envoyé de manière sécurisée.

\n\n

\n \n \n `;\n\n // 1. Gmail SMTP via Nodemailer — exige conf env, plus de fallback hardcodé\n const gmailUser = Deno.env.get(\"GMAIL_USER\");\n const gmailAppPass = Deno.env.get(\"GMAIL_APP_PASSWORD\");\n\n if (gmailUser && gmailAppPass) {\n try {\n const transporter = nodemailer.createTransport({\n auth: {\n pass: gmailAppPass,\n user: gmailUser,\n },\n service: \"gmail\",\n });\n\n await transporter.sendMail({\n from: `\"mAI\" <${gmailUser}>`,\n html,\n subject,\n to: email,\n });\n\n const maskedTo = email.replace(/(.{2}).*(@.*)/, \"$1***$2\");\n console.log(`[EMAIL] Gmail OK to=${maskedTo}`);\n return;\n } catch (err: any) {\n console.error(\"Erreur envoi Gmail SMTP :\", err?.message || err);\n }\n } else if (!gmailUser || !gmailAppPass) {\n console.warn(\n \"[EMAIL] GMAIL_USER/GMAIL_APP_PASSWORD non configurés — fallback Resend\",\n );\n }\n\n // 2. Resend Fallback\n const resendKey = Deno.env.get(\"RESEND_API_KEY\");\n if (resendKey) {\n try {\n const res = await fetch(\"https://api.resend.com/emails\", {\n body: JSON.stringify({\n from: \"mAI \",\n html,\n subject,\n to: email,\n }),\n headers: {\n Authorization: `Bearer ${resendKey}`,\n \"Content-Type\": \"application/json\",\n },\n method: \"POST\",\n });\n if (res.ok) {\n }\n } catch (_e) {\n // ignore\n }\n }\n}",[204],"a02005ef-bb15-4108-82d3-53f5aaa46361","devices.ts","01a038dd-2a8e-732c-ae1f-6b315e34fbd3",["D",1787660413598],"import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport type { Hono } from \"npm:hono@4\";\nimport { extractToken, getDb, parseUserAgent } from \"./config.ts\";\n\nexport function registerDeviceRoutes(app: Hono) {\n // GET /v1/devices\n app.get(\"/v1/devices\", async (c) => {\n const userId = c.get(\"userId\");\n const token = extractToken(c.req.raw);\n const sql = getDb();\n\n const existing =\n await sql`SELECT id FROM connected_devices WHERE token = ${token}`;\n if (existing.length === 0) {\n const userAgent = c.req.header(\"user-agent\") || \"\";\n const ip = c.req.header(\"cf-connecting-ip\") ||\n c.req.header(\"x-forwarded-for\") ||\n \"Inconnue\";\n const { os, device_model, device_version, device_name } = parseUserAgent(\n userAgent,\n );\n try {\n await sql`\n INSERT INTO connected_devices (user_id, token, os, device_model, device_version, ip_address, device_name)\n VALUES (${userId}::text, ${token}, ${os}, ${device_model}, ${device_version}, ${ip}, ${device_name})\n `;\n } catch (err) {\n console.error(\"Auto-insert device error:\", err);\n }\n } else {\n try {\n await sql`UPDATE connected_devices SET last_active = NOW() WHERE token = ${token}`;\n } catch (err) {}\n }\n\n const rawDevices = await sql`\n SELECT id, token, os, device_model, device_version, ip_address, device_name, last_active, created_at \n FROM connected_devices \n WHERE user_id = ${userId}::text \n ORDER BY last_active DESC\n `;\n\n const devices = rawDevices.map((d: any) => ({\n created_at: d.created_at,\n device_model: d.device_model,\n device_name: d.device_name,\n device_version: d.device_version || \"\",\n id: d.id,\n ip_address: d.ip_address,\n is_current: d.token === token,\n last_active: d.last_active,\n os: d.os,\n }));\n\n return c.json({ devices, success: true });\n });\n\n // DELETE /v1/devices/others\n app.delete(\"/v1/devices/others\", async (c) => {\n const userId = c.get(\"userId\");\n const token = extractToken(c.req.raw);\n const sql = getDb();\n\n const otherDevices = await sql`\n SELECT token FROM connected_devices \n WHERE user_id = ${userId}::text AND token != ${token}\n `;\n\n for (const row of otherDevices) {\n if (row.token) {\n try {\n await sqlite.execute({\n args: [row.token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n } catch (_e) {}\n }\n }\n\n await sql`\n DELETE FROM connected_devices \n WHERE user_id = ${userId}::text AND token != ${token}\n `;\n\n return c.json({\n message: \"Tous les autres appareils ont été déconnectés.\",\n success: true,\n });\n });\n\n // DELETE /v1/devices/all\n app.delete(\"/v1/devices/all\", async (c) => {\n const userId = c.get(\"userId\");\n const sql = getDb();\n\n const allDevices = await sql`\n SELECT token FROM connected_devices \n WHERE user_id = ${userId}::text\n `;\n\n for (const row of allDevices) {\n if (row.token) {\n try {\n await sqlite.execute({\n args: [row.token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n } catch (_e) {}\n }\n }\n\n await sql`\n DELETE FROM connected_devices \n WHERE user_id = ${userId}::text\n `;\n\n return c.json({\n message: \"Tous les appareils ont été déconnectés.\",\n success: true,\n });\n });\n\n // PUT /v1/devices/:id\n app.put(\"/v1/devices/:id\", async (c) => {\n const userId = c.get(\"userId\");\n const deviceId = c.req.param(\"id\");\n const { device_name } = await c.req.json();\n const sql = getDb();\n await sql`UPDATE connected_devices SET device_name = ${device_name} WHERE id = ${deviceId} AND user_id = ${userId}::text`;\n return c.json({ success: true });\n });\n\n // DELETE /v1/devices/:id\n app.delete(\"/v1/devices/:id\", async (c) => {\n const userId = c.get(\"userId\");\n const deviceId = c.req.param(\"id\");\n const sql = getDb();\n\n const devices =\n await sql`SELECT token FROM connected_devices WHERE id = ${deviceId} AND user_id = ${userId}::text LIMIT 1`;\n if (devices.length > 0) {\n const token = devices[0].token;\n if (token) {\n await sqlite.execute({\n args: [token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n }\n await sql`DELETE FROM connected_devices WHERE id = ${deviceId}`;\n }\n return c.json({ success: true });\n });\n}",[210],"13725841-7068-4a45-abc9-1c28972ac95b","config.ts","01a038dd-2a8e-732c-ae1f-65102eeae66f",["D",1787660413598],"import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { neon } from \"npm:@neondatabase/serverless\";\nimport { jwtVerify, SignJWT } from \"npm:jose\";\n\n// ─────────────────────────────────────────────\n// Config & Données\n// ─────────────────────────────────────────────\nexport const JWT_EXPIRY = \"14d\";\nexport const BCRYPT_ROUNDS = 12;\n\n// Limites de tokens hebdomadaires (Input + Output)\nexport const TIER_LIMITS: Record = {\n Free: 2_000_000,\n Max: 20_000_000,\n Plus: 5_000_000,\n Pro: 10_000_000,\n};\n\nexport const TIER_REQUEST_LIMITS: Record = {\n Free: 500,\n Max: 5000,\n Plus: 1000,\n Pro: 2000,\n};\n\n// Limites quotidiennes de génération d'images (Free: 3/j, Plus: 5/j, Pro: 10/j, Max: 20/j)\nexport const TIER_DAILY_IMAGE_LIMITS: Record = {\n Free: 3,\n free: 3,\n Gratuit: 3,\n gratuit: 3,\n Max: 20,\n max: 20,\n Plus: 5,\n Pro: 10,\n plus: 5,\n pro: 10,\n};\n\nexport function getTierDailyImageLimit(tier?: string | null): number {\n const t = (tier || \"Free\").toLowerCase().trim();\n if (t === \"max\") {\n return 20;\n }\n if (t === \"pro\") {\n return 10;\n }\n if (t === \"plus\") {\n return 5;\n }\n return 3;\n}\n\n// Coût en requêtes API par génération d'image\n// Free = 100 requêtes, Plus = 50 requêtes, Pro = 25 requêtes, Max = 10 requêtes\nexport const TIER_IMAGE_REQUEST_COST: Record = {\n Free: 100,\n free: 100,\n Gratuit: 100,\n gratuit: 100,\n Max: 10,\n max: 10,\n Plus: 50,\n Pro: 25,\n plus: 50,\n pro: 25,\n};\n\nexport function getTierImageRequestCost(tier?: string | null): number {\n const t = (tier || \"Free\").toLowerCase().trim();\n if (t === \"max\") {\n return 10;\n }\n if (t === \"pro\") {\n return 25;\n }\n if (t === \"plus\") {\n return 50;\n }\n return 100;\n}\n\n// Limites de stockage Cloud par tier (en bytes) — SSOT: Free 500Mo / Plus 1Go / Pro 2Go / Max 5Go\nexport const STORAGE_LIMITS_BYTES: Record = {\n Free: 500 * 1024 * 1024, // 500 MB\n // alias lowercase pour lookup case-insensitive côté Val Town\n free: 500 * 1024 * 1024,\n gratuit: 500 * 1024 * 1024,\n Max: 5 * 1024 * 1024 * 1024, // 5 GB\n max: 5 * 1024 * 1024 * 1024,\n Plus: 1 * 1024 * 1024 * 1024, // 1 GB\n Pro: 2 * 1024 * 1024 * 1024, // 2 GB\n plus: 1 * 1024 * 1024 * 1024,\n pro: 2 * 1024 * 1024 * 1024,\n} as Record;\n\nexport function getDb() {\n const url = Deno.env.get(\"DATABASE_URL\");\n if (!url) {\n throw new Error(\"DATABASE_URL not set\");\n }\n return neon(url);\n}\n\nexport function getJwtSecret(): Uint8Array {\n const secret = Deno.env.get(\"MAI_JWT_SECRET\");\n if (!secret) {\n throw new Error(\"MAI_JWT_SECRET not set\");\n }\n return new TextEncoder().encode(secret);\n}\n\n// ─────────────────────────────────────────────\n// Helpers d'authentification & Utilitaires\n// ─────────────────────────────────────────────\nexport async function signToken(\n payload: Record,\n): Promise {\n return new SignJWT(payload)\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuedAt()\n .setExpirationTime(JWT_EXPIRY)\n .sign(getJwtSecret());\n}\n\nexport async function verifyToken(\n token: string,\n): Promise> {\n // Vérif SQLite (legacy Val Town) + Postgres (nouveau)\n const sqliteResult = await sqlite.execute({\n args: [token],\n sql: \"SELECT 1 FROM token_blacklist WHERE token = ?\",\n });\n if (sqliteResult.rows.length > 0) {\n throw new Error(\"Token révoqué.\");\n }\n // Vérif Postgres token_blacklist avec TTL 14j\n try {\n const sql = getDb();\n const pgResult =\n await sql`SELECT 1 FROM token_blacklist WHERE token = ${token} LIMIT 1`;\n if (pgResult.length > 0) {\n throw new Error(\"Token révoqué.\");\n }\n } catch (e: any) {\n if (e?.message === \"Token révoqué.\") {\n throw e;\n }\n // ignore DB errors (table not yet exists)\n }\n const { payload } = await jwtVerify(token, getJwtSecret());\n return payload as Record;\n}\n\nexport async function blacklistToken(token: string) {\n const expiresAt = new Date(\n Date.now() + 14 * 24 * 60 * 60 * 1000,\n ).toISOString();\n try {\n await sqlite.execute({\n args: [token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n } catch {}\n try {\n const sql = getDb();\n await sql`INSERT INTO token_blacklist (token, revoked_at, expires_at) VALUES (${token}, NOW(), ${expiresAt}::timestamp) ON CONFLICT (token) DO NOTHING`;\n } catch {}\n // Nettoyage opportuniste des vieux tokens\n try {\n const sql = getDb();\n await sql`DELETE FROM token_blacklist WHERE expires_at < NOW() OR revoked_at < NOW() - INTERVAL '14 days'`;\n } catch {}\n try {\n await sqlite.execute({\n sql:\n \"DELETE FROM token_blacklist WHERE revoked_at < datetime('now', '-14 days')\",\n });\n } catch {}\n}\n\nexport function extractToken(req: Request): string | null {\n const auth = req.headers.get(\"Authorization\");\n if (!auth?.startsWith(\"Bearer \")) {\n return null;\n }\n return auth.slice(7);\n}\n\nexport function parseUserAgent(ua: string) {\n const uaLower = ua.toLowerCase();\n let os = \"linux\";\n let osVersion = \"Linux\";\n\n if (uaLower.includes(\"iphone\")) {\n os = \"apple\";\n osVersion = \"iPhone (iOS)\";\n } else if (uaLower.includes(\"ipad\")) {\n os = \"apple\";\n osVersion = \"iPad (iPadOS)\";\n } else if (uaLower.includes(\"mac os\") || uaLower.includes(\"macintosh\")) {\n os = \"apple\";\n osVersion = \"macOS\";\n } else if (\n uaLower.includes(\"windows nt 10.0\") ||\n uaLower.includes(\"windows 11\") ||\n uaLower.includes(\"windows 10\")\n ) {\n os = \"microsoft\";\n osVersion = \"Windows 10/11\";\n } else if (uaLower.includes(\"win\")) {\n os = \"microsoft\";\n osVersion = \"Windows\";\n } else if (uaLower.includes(\"android\")) {\n os = \"google\";\n osVersion = \"Android\";\n } else if (uaLower.includes(\"ubuntu\")) {\n os = \"linux\";\n osVersion = \"Ubuntu Linux\";\n } else if (uaLower.includes(\"debian\")) {\n os = \"linux\";\n osVersion = \"Debian Linux\";\n } else if (uaLower.includes(\"fedora\")) {\n os = \"linux\";\n osVersion = \"Fedora Linux\";\n }\n\n let model = \"Navigateur Web\";\n let version = \"\";\n\n if (uaLower.includes(\"mai-cli\") || uaLower.includes(\"mai cli\")) {\n model = \"mAI CLI\";\n version = \"Terminal\";\n } else if (uaLower.includes(\"pulse-extension\") || uaLower.includes(\"pulse\")) {\n model = \"Pulse Extension\";\n version = \"Extension\";\n } else if (uaLower.includes(\"edg/\")) {\n model = \"Microsoft Edge\";\n const match = ua.match(/Edg\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"opr/\") || uaLower.includes(\"opera/\")) {\n model = \"Opera\";\n const match = ua.match(/(?:OPR|Opera)\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"chrome/\")) {\n model = \"Google Chrome\";\n const match = ua.match(/Chrome\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"firefox/\")) {\n model = \"Mozilla Firefox\";\n const match = ua.match(/Firefox\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n } else if (uaLower.includes(\"safari/\") && !uaLower.includes(\"chrome\")) {\n model = \"Apple Safari\";\n const match = ua.match(/Version\\/([0-9.]+)/i);\n if (match) {\n version = `v${match[1].split(\".\")[0]}`;\n }\n }\n\n const fullVersion = version ? `${osVersion} • ${version}` : osVersion;\n const osLabel = os === \"apple\"\n ? \"Apple\"\n : os === \"microsoft\"\n ? \"Windows\"\n : os === \"google\"\n ? \"Google\"\n : \"Linux\";\n const deviceName = `${model} (${osLabel})`;\n\n return {\n device_model: model,\n device_name: deviceName,\n device_version: fullVersion,\n os,\n };\n}\n\nexport function getWeekData() {\n const now = new Date();\n const day = now.getUTCDay() || 7;\n\n const weekStart = new Date(now);\n weekStart.setUTCDate(now.getUTCDate() - (day - 1));\n weekStart.setUTCHours(0, 0, 0, 0);\n\n const nextReset = new Date(weekStart);\n nextReset.setUTCDate(weekStart.getUTCDate() + 7);\n\n return {\n nextResetIso: nextReset.toISOString(),\n weekStartStr: weekStart.toISOString().split(\"T\")[0],\n };\n}\n\n// ─────────────────────────────────────────────\n// E-mails & Vérification (SQLite)\n// ─────────────────────────────────────────────\nexport async function initSQLite() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS verification_codes (\n email TEXT,\n code TEXT,\n action TEXT,\n expires_at DATETIME,\n PRIMARY KEY (email, action)\n );\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS token_blacklist (\n token TEXT PRIMARY KEY,\n revoked_at DATETIME DEFAULT CURRENT_TIMESTAMP\n );\n `);\n}\n\nexport async function generateVerificationCode(\n email: string,\n action: string,\n): Promise {\n const isDeletion = action === \"delete_account\";\n const length = isDeletion ? 8 : 6;\n const min = 10 ** (length - 1);\n const max = 10 ** length - 1;\n // Crypto PRNG (corrige Math.random prévisible)\n const range = max - min;\n const randomValue = crypto.getRandomValues(new Uint32Array(1))[0] /\n 0xff_ff_ff_ff;\n const code = Math.floor(min + randomValue * range)\n .toString()\n .padStart(length, \"0\");\n const expiresAt = new Date(Date.now() + 10 * 60_000).toISOString(); // 10 minutes\n\n await sqlite.execute({\n args: [email, code, action, expiresAt],\n sql:\n \"INSERT OR REPLACE INTO verification_codes (email, code, action, expires_at) VALUES (?, ?, ?, ?)\",\n });\n\n return code;\n}\n\nexport async function verifyVerificationCode(\n email: string,\n code: string,\n action: string,\n): Promise {\n const result = await sqlite.execute({\n args: [email, action],\n sql:\n \"SELECT code, expires_at FROM verification_codes WHERE email = ? AND action = ?\",\n });\n\n if (result.rows.length === 0) {\n return false;\n }\n\n const storedCode = result.rows[0][0] as string;\n const expiresAt = new Date(result.rows[0][1] as string);\n\n if (expiresAt < new Date()) {\n await sqlite.execute({\n args: [email, action],\n sql: \"DELETE FROM verification_codes WHERE email = ? AND action = ?\",\n });\n return false;\n }\n\n if (storedCode === code) {\n await sqlite.execute({\n args: [email, action],\n sql: \"DELETE FROM verification_codes WHERE email = ? AND action = ?\",\n });\n return true;\n }\n\n return false;\n}\n\nexport { sqlite };",[216],"2cbcfd1b-a7ae-47a3-8c90-916ce9ea4ef8","auth.ts","01a038dd-2a8d-7653-95a3-d821d55738e6",["D",1787660413598],"import bcrypt from \"npm:bcryptjs\";\nimport type { Hono } from \"npm:hono@4\";\nimport {\n BCRYPT_ROUNDS,\n extractToken,\n generateVerificationCode,\n getDb,\n parseUserAgent,\n signToken,\n sqlite,\n verifyToken,\n verifyVerificationCode,\n} from \"./config.ts\";\nimport { sendVerificationEmail } from \"./email.ts\";\n\nexport function registerAuthRoutes(app: Hono) {\n // POST /register\n app.post(\"/register\", async (c) => {\n try {\n const { email, username, password } = await c.req.json();\n if (!email || !username || !password) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const sql = getDb();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${email} OR username = ${username} LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Email ou nom d'utilisateur déjà pris.\" }, 400);\n }\n\n const code = await generateVerificationCode(email, \"register\");\n await sendVerificationEmail(email, code, \"register\");\n\n return c.json({ email, status: \"verification_required\", success: true });\n } catch (err: any) {\n console.error(\"Register Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-register\n app.post(\"/verify-register\", async (c) => {\n try {\n const { email, username, password, code } = await c.req.json();\n if (!email || !username || !password || !code) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const isValid = await verifyVerificationCode(email, code, \"register\");\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n const sql = getDb();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${email} OR username = ${username} LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Email ou nom d'utilisateur déjà pris.\" }, 400);\n }\n\n const hash = await bcrypt.hash(password, BCRYPT_ROUNDS);\n\n const result = await sql`\n INSERT INTO users (email, username, password_hash, tier)\n VALUES (${email}, ${username}, ${hash}, 'Free')\n RETURNING id, tier\n `;\n\n const user = result[0];\n const token = await signToken({ sub: user.id, tier: user.tier });\n\n const userAgent = c.req.header(\"user-agent\") || \"\";\n const ip = c.req.header(\"cf-connecting-ip\") ||\n c.req.header(\"x-forwarded-for\") ||\n \"Inconnue\";\n const { os, device_model, device_version, device_name } = parseUserAgent(\n userAgent,\n );\n\n try {\n await sql`\n INSERT INTO connected_devices (user_id, token, os, device_model, device_version, ip_address, device_name)\n VALUES (${user.id}::text, ${token}, ${os}, ${device_model}, ${device_version}, ${ip}, ${device_name})\n `;\n } catch (dbErr) {\n console.error(\"Erreur insertion device:\", dbErr);\n }\n\n return c.json({ success: true, tier: user.tier, token });\n } catch (err: any) {\n console.error(\"Verify Register Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /login\n app.post(\"/login\", async (c) => {\n try {\n const { email, password, identifier } = await c.req.json();\n const loginId = (identifier || email || \"\").trim();\n if (!loginId || !password) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const sql = getDb();\n const users =\n await sql`SELECT id, email, password_hash, tier FROM users WHERE email = ${loginId} OR username = ${loginId} OR phone = ${loginId} LIMIT 1`;\n if (users.length === 0) {\n return c.json({ error: \"Identifiants invalides.\" }, 401);\n }\n\n const user = users[0];\n const match = await bcrypt.compare(password, user.password_hash);\n if (!match) {\n return c.json({ error: \"Identifiants invalides.\" }, 401);\n }\n\n const code = await generateVerificationCode(user.email, \"login\");\n await sendVerificationEmail(user.email, code, \"login\");\n\n return c.json({\n email: user.email,\n status: \"verification_required\",\n success: true,\n });\n } catch (err: any) {\n console.error(\"Login Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-login\n app.post(\"/verify-login\", async (c) => {\n try {\n const { email, code } = await c.req.json();\n if (!email || !code) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const isValid = await verifyVerificationCode(email, code, \"login\");\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n const sql = getDb();\n const users =\n await sql`SELECT id, tier FROM users WHERE email = ${email} LIMIT 1`;\n if (users.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const user = users[0];\n const token = await signToken({ sub: user.id, tier: user.tier });\n\n const userAgent = c.req.header(\"user-agent\") || \"\";\n // Pour les tests en dev, on utilise une IP par défaut\n let ip = c.req.header(\"cf-connecting-ip\") ||\n c.req.header(\"x-forwarded-for\") ||\n c.req.header(\"x-real-ip\") ||\n \"\";\n if (!ip || ip === \"::1\" || ip === \"127.0.0.1\") {\n ip = \"8.8.8.8\"; // IP Google par défaut pour ne pas planter l'API\n } else {\n // Extraire la première IP si on a une liste\n ip = ip.split(\",\")[0].trim();\n }\n const { os, device_model, device_version, device_name } = parseUserAgent(\n userAgent,\n );\n\n let locationStr = \"Lieu inconnu\";\n let countryStr = \"Pays inconnu\";\n try {\n const controller = new AbortController();\n const timeout = setTimeout(() => controller.abort(), 3000);\n const geoRes = await fetch(`https://ip-api.com/json/${ip}`, {\n headers: { \"User-Agent\": \"mAI/1.0\" },\n signal: controller.signal,\n });\n clearTimeout(timeout);\n if (geoRes.ok) {\n const geoData = await geoRes.json();\n if (geoData.status === \"success\") {\n locationStr = `${geoData.city}, ${geoData.country}`;\n countryStr = geoData.country;\n }\n }\n } catch (e) {\n console.error(\"Erreur de géolocalisation:\", e);\n }\n\n // Vérifier si c'est un nouvel appareil ou un nouveau pays\n let isNewDeviceOrLocation = true;\n try {\n const pastDevices = await sql`\n SELECT device_name, location FROM connected_devices \n WHERE user_id = ${user.id}::text\n `;\n if (pastDevices.length > 0) {\n // C'est pas sa toute première connexion\n const knownDevice = pastDevices.some(\n (d) => d.device_name === device_name,\n );\n const knownLocation = pastDevices.some(\n (d) => d.location && d.location.includes(countryStr),\n );\n if (knownDevice && knownLocation) {\n isNewDeviceOrLocation = false;\n }\n } else {\n // Première connexion jamais (donc nouvelle par defaut, ou pas besoin d'alerte? on envoie quand meme)\n isNewDeviceOrLocation = true;\n }\n } catch (e) {\n console.error(e);\n }\n\n try {\n await sql`\n INSERT INTO connected_devices (user_id, token, os, device_model, device_version, ip_address, device_name, location)\n VALUES (${user.id}::text, ${token}, ${os}, ${device_model}, ${device_version}, ${ip}, ${device_name}, ${locationStr})\n `;\n } catch (dbErr) {\n console.error(\"Erreur insertion device:\", dbErr);\n }\n\n if (isNewDeviceOrLocation) {\n // On n'attend pas l'envoi de l'email\n sendVerificationEmail(email, \"\", \"new_login\", {\n device: device_name,\n location: locationStr,\n }).catch(console.error);\n }\n\n return c.json({ success: true, tier: user.tier, token });\n } catch (err: any) {\n console.error(\"Verify Login Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /resend-code\n app.post(\"/resend-code\", async (c) => {\n try {\n const { email, action } = await c.req.json();\n if (!email || !action) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n // Vérifier le rate-limit (1 minute)\n const result = await sqlite.execute({\n args: [email, action],\n sql:\n \"SELECT expires_at FROM verification_codes WHERE email = ? AND action = ?\",\n });\n\n if (result.rows.length > 0) {\n const expiresAt = new Date(result.rows[0][0] as string);\n const now = new Date();\n // Si la date d'expiration est > maintenant + 9 minutes, ça veut dire qu'il a été généré il y a moins d'1 minute.\n const diffMinutes = (expiresAt.getTime() - now.getTime()) / 60_000;\n if (diffMinutes > 9) {\n return c.json(\n { error: \"Veuillez patienter 1 minute avant de renvoyer un code.\" },\n 429,\n );\n }\n }\n\n const code = await generateVerificationCode(email, action);\n await sendVerificationEmail(email, code, action);\n\n return c.json({ success: true });\n } catch (err: any) {\n console.error(\"Resend Code Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /verify-code\n app.post(\"/verify-code\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = String(payload.sub);\n\n const body = await c.req.json();\n const rawCode = body?.code;\n if (!rawCode) {\n return c.json({ error: \"Code requis.\" }, 400);\n }\n\n const inputCode = String(rawCode).trim().toUpperCase();\n const sql = getDb();\n\n let newTier: string | null = null;\n let dbCodeId: number | null = null;\n\n // 1. Recherche dans la table subscription_codes de la base de données\n try {\n const codeRows = await sql`\n SELECT id, code, tier, max_uses, uses_count, is_active, expires_at \n FROM subscription_codes \n WHERE UPPER(code) = UPPER(${inputCode}) \n LIMIT 1\n `;\n\n if (codeRows.length > 0) {\n const row = codeRows[0];\n\n if (!row.is_active) {\n return c.json(\n { error: \"Ce code d'abonnement est désactivé.\" },\n 400,\n );\n }\n\n if (row.expires_at && new Date(row.expires_at) < new Date()) {\n return c.json({ error: \"Ce code d'abonnement a expiré.\" }, 400);\n }\n\n if (\n row.max_uses > 0 &&\n Number(row.uses_count) >= Number(row.max_uses)\n ) {\n return c.json(\n { error: \"Ce code a atteint son quota maximal d'utilisations.\" },\n 400,\n );\n }\n\n // Vérifier si l'utilisateur a déjà activé ce code spécifique\n try {\n const redemptions = await sql`\n SELECT id FROM subscription_code_redemptions \n WHERE code_id = ${row.id} AND user_id = ${userId}::text \n LIMIT 1\n `;\n if (redemptions.length > 0) {\n return c.json(\n {\n error: \"Vous avez déjà débloqué votre forfait avec ce code.\",\n },\n 400,\n );\n }\n } catch (_redErr) {\n // Ignorer si la table de redemptions n'est pas encore créée\n }\n\n newTier = row.tier;\n dbCodeId = row.id;\n }\n } catch (dbErr) {\n console.warn(\n \"Table subscription_codes non accessible, vérification fallback ENV:\",\n dbErr,\n );\n }\n\n // 2. Fallback vers les variables d'environnement si non trouvé en base\n if (!newTier) {\n const upgradeCodes: Record = {};\n\n const plusCode = Deno.env.get(\"MAI_PLUS_CODE\") ||\n Deno.env.get(\"PLUS_CODE\");\n if (plusCode) {\n upgradeCodes[plusCode.trim().toUpperCase()] = \"Plus\";\n }\n\n const proCode = Deno.env.get(\"MAI_PRO_CODE\") ||\n Deno.env.get(\"PRO_CODE\");\n if (proCode) {\n upgradeCodes[proCode.trim().toUpperCase()] = \"Pro\";\n }\n\n const maxCode = Deno.env.get(\"MAI_MAX_CODE\") ||\n Deno.env.get(\"MAX_CODE\");\n if (maxCode) {\n upgradeCodes[maxCode.trim().toUpperCase()] = \"Max\";\n }\n\n newTier = upgradeCodes[inputCode] || null;\n }\n\n if (!newTier) {\n console.log(`[Verify-Code] Code invalide soumis par user=${userId}`);\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n // 3. Mise à jour de l'utilisateur et de ses clés API\n await sql`UPDATE users SET tier = ${newTier} WHERE id::text = ${userId}::text`;\n await sql`UPDATE mprojects_api_keys SET plan = ${newTier} WHERE user_id = ${userId}::text`;\n\n // 4. Incrémentation du compteur et log de l'utilisation en base\n if (dbCodeId) {\n try {\n await sql`\n UPDATE subscription_codes \n SET uses_count = uses_count + 1,\n is_active = CASE WHEN max_uses > 0 AND (uses_count + 1) >= max_uses THEN FALSE ELSE is_active END\n WHERE id = ${dbCodeId}\n `;\n await sql`\n INSERT INTO subscription_code_redemptions (code_id, user_id)\n VALUES (${dbCodeId}, ${userId}::text)\n `;\n } catch (updateErr) {\n console.error(\"Erreur mise à jour usage code:\", updateErr);\n }\n }\n\n // 5. Envoi d'un e-mail de remerciements pour la souscription\n try {\n const userRows =\n await sql`SELECT email, username FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (userRows.length > 0 && userRows[0].email) {\n await sendVerificationEmail(\n userRows[0].email,\n \"\",\n \"subscription_unlocked\",\n {\n tier: newTier,\n username: userRows[0].username,\n },\n );\n }\n } catch (mailErr) {\n console.error(\n \"Erreur envoi email remerciements souscription:\",\n mailErr,\n );\n }\n\n // 6. Nouveau token JWT avec le tier débloqué\n const newToken = await signToken({ sub: userId, tier: newTier });\n\n return c.json({\n message: `Merci d'avoir souscrit au forfait ${newTier} !`,\n success: true,\n tier: newTier,\n token: newToken,\n });\n } catch (err: any) {\n console.error(\"Verify-Code error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /update-profile\n app.post(\"/update-profile\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const body = await c.req.json();\n const {\n username,\n email,\n phone,\n password,\n currentPassword,\n newsletter,\n notify_limits,\n auto_logout_minutes,\n } = body;\n const sql = getDb();\n\n // Vérification obligatoire du mot de passe actuel\n if (!currentPassword) {\n return c.json(\n {\n error:\n \"Le mot de passe actuel est obligatoire pour modifier vos informations.\",\n },\n 400,\n );\n }\n\n const currentUser =\n await sql`SELECT email, password_hash FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const passMatch = await bcrypt.compare(\n currentPassword,\n currentUser[0].password_hash,\n );\n if (!passMatch) {\n return c.json({ error: \"Le mot de passe actuel est incorrect.\" }, 400);\n }\n\n if (username && username.trim()) {\n const cleanUsername = username.trim();\n const existing =\n await sql`SELECT id FROM users WHERE username = ${cleanUsername} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json({ error: \"Ce nom d'utilisateur est déjà pris.\" }, 400);\n }\n await sql`UPDATE users SET username = ${cleanUsername} WHERE id::text = ${userId}::text`;\n }\n\n if (email && email.trim()) {\n const cleanEmail = email.trim();\n const existing =\n await sql`SELECT id FROM users WHERE email = ${cleanEmail} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json(\n { error: \"Cette adresse e-mail est déjà utilisée.\" },\n 400,\n );\n }\n if (cleanEmail !== currentUser[0].email) {\n // Send OTP instead of updating directly\n const code = await generateVerificationCode(\n cleanEmail,\n \"verify_new_email\",\n );\n await sendVerificationEmail(cleanEmail, code, \"verify_new_email\");\n return c.json({\n email: cleanEmail,\n status: \"email_verification_required\",\n success: true,\n });\n }\n }\n\n if (phone !== undefined) {\n const cleanPhone = phone ? phone.trim() : null;\n if (cleanPhone) {\n const existing =\n await sql`SELECT id FROM users WHERE phone = ${cleanPhone} AND id::text != ${userId}::text LIMIT 1`;\n if (existing.length > 0) {\n return c.json(\n {\n error:\n \"Ce numéro de téléphone est déjà associé à un autre compte.\",\n },\n 400,\n );\n }\n }\n await sql`UPDATE users SET phone = ${cleanPhone} WHERE id::text = ${userId}::text`;\n }\n\n if (newsletter !== undefined) {\n await sql`UPDATE users SET newsletter = ${\n Boolean(newsletter)\n } WHERE id::text = ${userId}::text`;\n }\n\n if (notify_limits !== undefined) {\n await sql`UPDATE users SET notify_limits = ${\n Boolean(notify_limits)\n } WHERE id::text = ${userId}::text`;\n }\n\n if (auto_logout_minutes !== undefined) {\n const mins = Number.parseInt(auto_logout_minutes, 10);\n if (!isNaN(mins)) {\n await sql`UPDATE users SET auto_logout_minutes = ${mins} WHERE id::text = ${userId}::text`;\n }\n }\n\n if (password && password.trim()) {\n if (password.length < 6) {\n return c.json(\n { error: \"Le mot de passe doit contenir au moins 6 caractères.\" },\n 400,\n );\n }\n const hash = await bcrypt.hash(password, BCRYPT_ROUNDS);\n await sql`UPDATE users SET password_hash = ${hash} WHERE id::text = ${userId}::text`;\n }\n\n const updatedUser =\n await sql`SELECT username, email, phone, tier, newsletter, notify_limits FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n const user = updatedUser[0];\n\n return c.json({\n email: user?.email,\n newsletter: user?.newsletter,\n notify_limits: user?.notify_limits,\n phone: user?.phone,\n success: true,\n tier: user?.tier,\n username: user?.username,\n });\n } catch {\n return c.json({ error: \"Erreur lors de la mise à jour du profil.\" }, 500);\n }\n });\n\n // POST /verify-new-email\n app.post(\"/verify-new-email\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const { email, code } = await c.req.json();\n if (!email || !code) {\n return c.json({ error: \"Champs manquants.\" }, 400);\n }\n\n const isValid = await verifyVerificationCode(\n email,\n code,\n \"verify_new_email\",\n );\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n const sql = getDb();\n await sql`UPDATE users SET email = ${email.trim()} WHERE id::text = ${userId}::text`;\n\n return c.json({ email: email.trim(), success: true });\n } catch (err: any) {\n console.error(\"verify-new-email Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /request-delete-account\n app.post(\"/request-delete-account\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const sql = getDb();\n const currentUser =\n await sql`SELECT email FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const email = currentUser[0].email;\n const code = await generateVerificationCode(email, \"delete_account\");\n await sendVerificationEmail(email, code, \"delete_account\");\n\n return c.json({ email, success: true });\n } catch (err: any) {\n console.error(\"request-delete-account Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // POST /confirm-delete-account\n app.post(\"/confirm-delete-account\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const { password, code, confirmationText } = await c.req.json();\n if (!password || !code || confirmationText !== \"SUPPRIMER LE COMPTE\") {\n return c.json(\n { error: \"Informations de confirmation invalides.\" },\n 400,\n );\n }\n\n const sql = getDb();\n const currentUser =\n await sql`SELECT email, password_hash FROM users WHERE id::text = ${userId}::text LIMIT 1`;\n if (!currentUser || currentUser.length === 0) {\n return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n }\n\n const passMatch = await bcrypt.compare(\n password,\n currentUser[0].password_hash,\n );\n if (!passMatch) {\n return c.json({ error: \"Mot de passe incorrect.\" }, 400);\n }\n\n const email = currentUser[0].email;\n const isValid = await verifyVerificationCode(\n email,\n code,\n \"delete_account\",\n );\n if (!isValid) {\n return c.json({ error: \"Code invalide ou expiré.\" }, 400);\n }\n\n // Suppression (ou anonymisation)\n await sql`DELETE FROM users WHERE id::text = ${userId}::text`;\n\n // Révoquer le token pour déconnecter immédiatement\n await sqlite.execute({\n args: [token],\n sql: \"INSERT OR IGNORE INTO token_blacklist (token) VALUES (?)\",\n });\n\n return c.json({ success: true });\n } catch (err: any) {\n console.error(\"confirm-delete-account Error:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n\n // GET /api-keys\n app.get(\"/api-keys\", async (c) => {\n try {\n const token = extractToken(c.req.raw);\n if (!token) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n\n const payload = await verifyToken(token);\n const userId = payload.sub as string;\n\n const sql = getDb();\n const keys = await sql`\n SELECT api_key, plan, request_count, created_at, last_used_at \n FROM mprojects_api_keys \n WHERE user_id = ${userId}::text\n `;\n\n return c.json({ keys, success: true });\n } catch (err: any) {\n console.error(\"Erreur API Keys:\", err);\n return c.json({ error: \"Erreur serveur.\" }, 500);\n }\n });\n}",[222],"58886b55-c794-4d43-94b7-87f206cd6fbd","api-middleware.ts","01a038dd-2a8d-7653-95a3-d7d3f60fff2c",2,["D",1787660501912],"import type { Hono } from \"npm:hono@4\";\nimport { getDb, TIER_REQUEST_LIMITS, verifyToken } from \"./config.ts\";\n\nexport function registerMiddleware(app: Hono) {\n // Middleware global pour Auth, Rate limiting & Logging sur toutes les routes d'API\n app.use(\"*\", async (c, next) => {\n const path = c.req.path;\n\n // Détection des routes d'API\n const isApiRoute = path.startsWith(\"/v1/\") ||\n path.startsWith(\"/v1beta/\") ||\n path === \"/v1/models\" ||\n path === \"/models\" ||\n path.startsWith(\"/models/\") ||\n path === \"/v1beta/models\" ||\n path === \"/chat/completions\" ||\n path.startsWith(\"/chat/\") ||\n path === \"/messages\" ||\n path.startsWith(\"/messages/\") ||\n path === \"/speech\" ||\n path.startsWith(\"/speech/\") ||\n path === \"/images\" ||\n path.startsWith(\"/images/\") ||\n path === \"/images/generations\" ||\n path === \"/audio/speech\" ||\n path.startsWith(\"/audio/\") ||\n path === \"/usage/speech\" ||\n path === \"/usage\" ||\n path === \"/log-usage\" ||\n path === \"/v1/status\" ||\n path === \"/status\";\n\n if (!isApiRoute) {\n await next();\n return;\n }\n\n const isPublicRoute = path === \"/v1/models\" ||\n path === \"/models\" ||\n path === \"/v1beta/models\" ||\n path === \"/v1/models/images\" ||\n path === \"/models/images\" ||\n path === \"/v1/models/speech\" ||\n path === \"/models/speech\" ||\n path === \"/v1/speech/models\" ||\n path === \"/speech/models\" ||\n path === \"/v1/speech/voices\" ||\n path === \"/speech/voices\" ||\n path === \"/v1/audio/models\" ||\n path === \"/v1/audio/voices\" ||\n path === \"/v1/models/mai\" ||\n path === \"/v1/mai/models\" ||\n path === \"/models/mai\" ||\n path === \"/mai/models\" ||\n path === \"/v1/status\" ||\n path === \"/status\";\n\n const authHeader = c.req.header(\"Authorization\") ||\n c.req.header(\"authorization\");\n const headerApiKey = c.req.header(\"x-api-key\") ||\n c.req.header(\"X-API-Key\") ||\n c.req.header(\"x-goog-api-key\") ||\n c.req.header(\"X-Goog-Api-Key\");\n const queryApiKey = c.req.query(\"api_key\") ||\n c.req.query(\"key\");\n\n let rawApiKey =\n (authHeader?.startsWith(\"Bearer \") ? authHeader.slice(7) : authHeader) ||\n headerApiKey ||\n queryApiKey ||\n null;\n\n if (rawApiKey) {\n rawApiKey = rawApiKey.trim();\n if (\n rawApiKey === \"\" ||\n rawApiKey === \"null\" ||\n rawApiKey === \"undefined\" ||\n rawApiKey === \"Bearer\"\n ) {\n rawApiKey = null;\n }\n }\n\n const apiKey = rawApiKey;\n const reqUserId = c.req.header(\"x-user-id\") || c.req.header(\"X-User-Id\");\n const startTime = Date.now();\n\n const systemMaiApiKey = Deno.env.get(\"MAI_API_KEY\");\n\n let userPlan = \"Free\";\n let currentUserId: string | null = null;\n const currentApiKey: string | null = apiKey;\n let matchedApiKey: string | null = apiKey;\n\n function timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) {\n return false;\n }\n let diff = 0;\n for (let i = 0; i < a.length; i++) {\n diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n }\n return diff === 0;\n }\n\n // 1. Clé système MAI_API_KEY (accès complet aux modèles Plus/Max) — comparaison constant-time\n if (systemMaiApiKey && apiKey && timingSafeEqual(apiKey, systemMaiApiKey)) {\n userPlan = \"Plus\";\n currentUserId = \"system-mai\";\n } // 2. Clé API utilisateur enregistrée ou Token JWT\n else if (apiKey) {\n const sql = getDb();\n try {\n const rows = await sql`\n SELECT k.*, u.tier as user_tier\n FROM mprojects_api_keys k\n LEFT JOIN users u ON k.user_id = u.id::text OR k.user_id = u.username OR k.user_id = u.email\n WHERE k.api_key = ${apiKey}::text\n LIMIT 1\n `;\n\n if (rows.length > 0) {\n const apiKeyData = rows[0];\n userPlan = apiKeyData.user_tier || apiKeyData.plan || \"Free\";\n currentUserId = apiKeyData.user_id;\n matchedApiKey = apiKeyData.api_key || apiKey;\n } else {\n // Tenter de valider le token comme un JWT de session\n try {\n const payload = await verifyToken(apiKey);\n currentUserId = String(payload.sub || \"\");\n userPlan = String(payload.tier || \"Free\");\n\n // Vérifier dans la table users si le forfait a changé\n if (currentUserId) {\n const uRows = await sql`\n SELECT tier FROM users\n WHERE id::text = ${currentUserId}::text OR username = ${currentUserId}::text OR email = ${currentUserId}::text\n LIMIT 1\n `;\n if (uRows.length > 0 && uRows[0].tier) {\n userPlan = uRows[0].tier;\n }\n }\n } catch {\n if (!isPublicRoute) {\n return c.json({ error: \"Invalid API Key.\" }, 403);\n }\n }\n }\n } catch (dbErr) {\n console.error(\"Auth DB Error in middleware:\", dbErr);\n }\n }\n\n // 3. En-tête x-user-id (requêtes web app / internes) : uniquement si déjà authentifié ou fallback route publique\n if (reqUserId && reqUserId !== \"system-mai\") {\n if (currentUserId) {\n // Déjà authentifié via clé API ou JWT : x-user-id doit correspondre, sinon on l'ignore\n if (reqUserId !== currentUserId) {\n console.warn(\n `[Auth] x-user-id mismatch: header=${reqUserId} vs auth=${currentUserId} — header ignoré`,\n );\n }\n } else if (apiKey) {\n // apiKey présent mais non reconnu (route publique) : ne pas promouvoir via x-user-id seul\n } else {\n // Aucune auth vérifiée\n try {\n const sql = getDb();\n const uRows = await sql`\n SELECT tier FROM users \n WHERE id::text = ${reqUserId}::text OR username = ${reqUserId}::text OR email = ${reqUserId}::text \n LIMIT 1\n `;\n if (uRows.length > 0) {\n if (uRows[0].tier) {\n userPlan = uRows[0].tier;\n }\n if (isPublicRoute) {\n currentUserId = reqUserId;\n } else {\n console.warn(\n `[Auth] x-user-id sans JWT sur route privée ${path} — ignoré`,\n );\n }\n }\n } catch {}\n }\n }\n\n // 4. Aucun identifiant et route privée\n if (!apiKey && !currentUserId && !isPublicRoute) {\n return c.json({ error: \"Service Unavailable. API Key missing.\" }, 401);\n }\n\n // Enregistrer le plan et les infos de contexte\n c.set(\"userPlan\", userPlan);\n c.set(\"userId\", currentUserId);\n c.set(\"apiKey\", currentApiKey);\n c.set(\"matchedApiKey\", matchedApiKey);\n\n // Vérification des quotas pour les clés API enregistrées\n if (apiKey && currentUserId && currentUserId !== \"system-mai\") {\n const tierMap: Record = {\n Free: 500,\n Gratuit: 500,\n Max: 5000,\n Plus: 1000,\n Pro: 2000,\n };\n const limit = TIER_REQUEST_LIMITS?.[userPlan] || tierMap[userPlan] || 500;\n const sql = getDb();\n\n // Réinitialisation mensuelle automatique si le mois a changé (idempotent)\n try {\n await sql`\n UPDATE mprojects_api_keys\n SET request_count = 0\n WHERE user_id = ${currentUserId}::text\n AND last_used_at IS NOT NULL\n AND last_used_at < DATE_TRUNC('month', NOW())\n `;\n } catch {}\n\n // Calculer l'usage global pour l'utilisateur\n try {\n const countRows = await sql`\n SELECT SUM(request_count) as total_requests\n FROM mprojects_api_keys\n WHERE user_id = ${currentUserId}::text\n `;\n const globalRequestCount = countRows[0]?.total_requests || 0;\n\n if (globalRequestCount >= limit) {\n if (isPublicRoute) {\n await next();\n return;\n }\n return c.json({ error: \"Quota exceeded for your account.\" }, 429);\n }\n } catch {}\n }\n\n await next();\n\n if (isPublicRoute) {\n return; // Ne pas logger les requêtes vers les routes publiques\n }\n\n const latency = Date.now() - startTime;\n const status = c.res.status;\n const endpoint = c.req.path;\n const method = c.req.method;\n\n // Logging & Mise à jour quota (uniquement pour les clés API utilisateur réelles)\n const isJwtRoute = path.startsWith(\"/v1/devices\");\n if (!isJwtRoute && apiKey && apiKey !== systemMaiApiKey) {\n try {\n const sql = getDb();\n const effectiveKeyToLog = matchedApiKey || apiKey;\n\n await sql`\n INSERT INTO mprojects_api_logs (api_key, endpoint, method, status_code, latency_ms)\n VALUES (${effectiveKeyToLog}::text, ${endpoint}::text, ${method}::text, ${status}::integer, ${latency}::integer)\n `;\n\n await sql`\n UPDATE mprojects_api_keys\n SET request_count = request_count + 1, last_used_at = NOW()\n WHERE api_key = ${effectiveKeyToLog}::text\n `;\n } catch (err) {\n console.error(\"Erreur logging API:\", err);\n }\n }\n });\n}",[228],"pulls","branches",11,"forks","envVars",{"_242":244,"_245":63},"connections",{"_242":157,"_243":63},"count","unfilledCount",117,"emptyCount",{"_42":227,"_32":228,"_30":229,"_156":-5,"_40":41,"_39":230,"_158":24,"_37":296,"_13":157,"_33":34,"_35":232,"_23":24,"_161":-5,"_260":297,"_26":298},{"_42":221,"_32":222,"_30":223,"_156":-5,"_40":41,"_39":157,"_158":24,"_37":293,"_13":63,"_33":34,"_35":225,"_23":24,"_161":-5,"_260":294,"_26":295},{"_42":215,"_32":216,"_30":217,"_156":-5,"_40":41,"_39":157,"_158":24,"_37":290,"_13":63,"_33":34,"_35":219,"_23":24,"_161":-5,"_260":291,"_26":292},{"_42":209,"_32":210,"_30":211,"_156":-5,"_40":41,"_39":157,"_158":24,"_37":287,"_13":63,"_33":34,"_35":213,"_23":24,"_161":-5,"_260":288,"_26":289},{"_42":203,"_32":204,"_30":205,"_156":-5,"_40":41,"_39":157,"_158":24,"_37":284,"_13":63,"_33":34,"_35":207,"_23":24,"_161":-5,"_260":285,"_26":286},{"_42":197,"_32":198,"_30":199,"_156":-5,"_40":41,"_39":157,"_158":24,"_37":281,"_13":63,"_33":34,"_35":201,"_23":24,"_161":-5,"_260":282,"_26":283},{"_42":191,"_32":192,"_30":193,"_156":-5,"_40":41,"_39":157,"_158":59,"_37":278,"_13":63,"_33":34,"_35":195,"_23":24,"_161":-5,"_260":279,"_26":280},{"_42":184,"_32":185,"_30":186,"_156":-5,"_40":41,"_39":157,"_158":24,"_37":275,"_13":63,"_33":188,"_35":189,"_23":24,"_161":-5,"_260":276,"_26":277},{"_42":178,"_32":179,"_30":180,"_156":-5,"_40":41,"_39":157,"_158":24,"_37":272,"_13":63,"_33":34,"_35":182,"_23":24,"_161":-5,"_260":273,"_26":274},{"_42":175,"_32":27,"_30":31,"_156":-5,"_40":41,"_39":14,"_158":24,"_37":269,"_13":63,"_33":34,"_35":36,"_23":24,"_161":-5,"_260":270,"_26":271},{"_42":169,"_32":170,"_30":171,"_156":-5,"_40":41,"_39":157,"_158":24,"_37":266,"_13":63,"_33":34,"_35":173,"_23":24,"_161":-5,"_260":267,"_26":268},{"_42":163,"_32":164,"_30":165,"_156":-5,"_40":41,"_39":157,"_158":59,"_37":263,"_13":63,"_33":34,"_35":167,"_23":24,"_161":-5,"_260":264,"_26":265},{"_42":153,"_32":154,"_30":155,"_156":-5,"_40":41,"_39":157,"_158":59,"_37":259,"_13":63,"_33":34,"_35":160,"_23":24,"_161":-5,"_260":261,"_26":262},["D",1787660413598],"children",[],[154],["D",1787660413598],[],[164],["D",1787660413598],[],[170],["D",1787660511094],[],[27],["D",1787660413598],[],[179],["D",1787660413598],[],[185],["D",1787660413598],[],[192],["D",1787660413598],[],[198],["D",1787660413598],[],[204],["D",1787660413598],[],[210],["D",1787660413598],[],[216],["D",1787660413598],[],[222],["D",1787660501912],[],[228],["D",1785339526786],["D",1789474235934],{"_102":101,"_110":106},{"_102":101,"_103":104,"_105":106,"_18":55,"_107":108,"_109":24},{"_13":89,"_32":90,"_42":41,"_91":43,"_92":93,"_94":95,"_96":49,"_97":43,"_98":65,"_99":44,"_100":101},"ctx",{"_82":-5,"_130":337,"_338":339,"_340":341,"_342":24,"_343":24,"_344":24,"_345":59,"_346":-5,"_347":-7,"_348":-7,"_349":63,"_350":24,"_351":24,"_352":-5,"_353":24,"_354":24,"_355":24,"_356":-5},"ENV",{"_308":309,"_310":311,"_312":136,"_313":314,"_315":316,"_317":318,"_319":320,"_321":322,"_323":324,"_325":326,"_327":328,"_329":330,"_331":332,"_333":334,"_335":336},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v3