server.mjs

import express from "express";
import expressStaticGzip from "express-static-gzip";
import { readFile } from "fs/promises";
import { createProxyMiddleware } from "http-proxy-middleware";
import https from "https";
import path from "path";

const app = express();

// Define a separate router for routes that need to process body
// because otherwise we have to add a body parser fix to all proxies
const tokenRouter = express.Router();
tokenRouter.use(express.urlencoded({ extended: false }));
tokenRouter.use(express.json());

const __dirname = path.resolve(path.dirname("."));

// New http-proxy-middleware adds may add a slash in the end of the path
// which is recognized as a different path by some servers
// and causes 404 (e.g. /bimtrack/token)
function removeTrailingSlashFromPath(proxyReq) {
    if (proxyReq.path.endsWith("/")) {
        proxyReq.path = proxyReq.path.slice(0, -1);
    }
}

function appendClientSecretToBody(proxyReq, req, res, envVarName) {
    const secret = process.env[envVarName];
    if (!secret) {
        res.writeHead(500, { "Content-Type": "application/json" });
        res.end(JSON.stringify({ error: `Missing ${envVarName}` }));
        proxyReq.destroy();
        return;
    }

    appendToBody(proxyReq, req, { client_secret: secret });
}

// Based on https://github.com/chimurai/http-proxy-middleware/blob/master/recipes/modify-post.md
function appendToBody(proxyReq, req, toAdd) {
    // fixRequestBody(proxyReq, req);

    const body = req.body;
    if (req.method !== "POST" || !body) {
        return;
    }

    const newBody = { ...body, ...toAdd };
    let bodyStr = "";
    switch (req.headers["content-type"]) {
        case "application/json": {
            bodyStr = JSON.stringify(newBody);
            break;
        }
        case "application/x-www-form-urlencoded": {
            bodyStr = Object.entries({ ...body, ...toAdd })
                .map(([key, value]) => encodeURIComponent(key) + "=" + encodeURIComponent(value))
                .join("&");
            break;
        }
        default:
            break;
    }

    if (!bodyStr) {
        return;
    }

    proxyReq.setHeader("content-length", bodyStr.length);

    proxyReq.write(bodyStr);
}

tokenRouter.use(
    "/bimtrack/token",
    createProxyMiddleware({
        target: "https://auth.bimtrackapp.co/connect/token",
        on: {
            proxyReq: (proxyReq, req, res) => {
                removeTrailingSlashFromPath(proxyReq);
                appendClientSecretToBody(proxyReq, req, res, "BIMTRACK_CLIENT_SECRET");
            },
        },
        changeOrigin: true,
    }),
);

app.use(
    "/bimtrack/bcf/2.1",
    createProxyMiddleware({
        router: (req) => {
            const url = new URL(`https://explorer.novorender.com/${req.url}`);
            const server = url.searchParams.get("server") ?? "";
            return server + "/bcf/2.1";
        },
        on: {
            proxyReq: (proxyReq) => removeTrailingSlashFromPath(proxyReq),
        },
        changeOrigin: true,
    }),
);

app.use(
    "/xsitemanage",
    createProxyMiddleware({
        target: "https://api.prod.xsitemanage.com",
        pathRewrite: {
            "^/xsitemanage/": "",
        },
        on: {
            proxyReq: (proxyReq) => removeTrailingSlashFromPath(proxyReq),
        },
        changeOrigin: true,
    }),
);

app.use(
    "/ditio-file",
    createProxyMiddleware({
        target: "https://ditio-api-v3.azurewebsites.net/api/file/",
        pathRewrite: {
            "^/ditio-file": "",
        },
        changeOrigin: true,
    }),
);

app.use(
    "/ditio",
    createProxyMiddleware({
        target: "https://ditio-api-v3.azurewebsites.net",
        pathRewrite: {
            "^/ditio": "",
        },
        on: {
            proxyReq: (proxyReq) => removeTrailingSlashFromPath(proxyReq),
        },
        changeOrigin: true,
    }),
);

app.use(
    "/ditio-machines",
    createProxyMiddleware({
        target: "https://ditio-report-api.azurewebsites.net/api",
        pathRewrite: {
            "^/ditio-machines": "",
        },
        on: {
            proxyReq: (proxyReq) => removeTrailingSlashFromPath(proxyReq),
        },
        changeOrigin: true,
    }),
);

app.use("/omega365", async (req, res) => {
    try {
        const appendUrl = new URL(req.originalUrl.replace(/^\/omega365/, "").replace(/^\//, ""), "https://localhost");
        if (appendUrl.pathname !== "/api/rest/Novorender/EksportObjektDokumentLink") {
            return res.status(400).send("Invalid path");
        }

        const url = new URL("https://nyeveier.pims365.no/" + appendUrl.pathname + appendUrl.search);
        const omegaRes = await fetch(url, {
            headers: {
                authorization: req.headers.authorization,
            },
        });

        if (omegaRes.ok) {
            const cookieHeaders = omegaRes.headers.getSetCookie();
            cookieHeaders.forEach((header) => res.append("set-cookie", header));
            const json = await omegaRes.json();
            res.json(json);
        } else {
            if (omegaRes.status >= 500) {
                res.status(omegaRes.status).send();
            } else {
                res.status(401).send();
            }
        }
    } catch (e) {
        console.warn(e);
        res.status(500).send();
    }
});

tokenRouter.post(
    "/token",
    createProxyMiddleware({
        target: process.env.AUTH_SERVER_URL ?? "https://auth.novorender.com",
        on: {
            proxyReq: (proxyReq, req, res) => {
                appendClientSecretToBody(proxyReq, req, res, "NOVORENDER_CLIENT_SECRET");
            },
        },
        changeOrigin: true,
    }),
);

tokenRouter.use(
    "/jira/token",
    createProxyMiddleware({
        target: "https://auth.atlassian.com/oauth/token",
        on: {
            proxyReq: (proxyReq, req, res) => {
                removeTrailingSlashFromPath(proxyReq);
                appendClientSecretToBody(proxyReq, req, res, "JIRA_CLIENT_SECRET");
            },
        },
        changeOrigin: true,
    }),
);

tokenRouter.use(
    "/bimcollab/token",
    createProxyMiddleware({
        router: (req) => {
            const url = new URL(req.url, "https://localhost");
            const authUrlStr = url.searchParams.get("auth_url");
            const authUrl = new URL(authUrlStr);

            // Check that auth_url ends with bimcollab.com,
            // otherwise somebody may pass their own URL and get the secret
            if (!authUrl.hostname.endsWith(".bimcollab.com")) {
                throw "Invalid auth_url for bimcollab/token, host must end with bimcollab.com";
            }

            return authUrlStr;
        },
        on: {
            proxyReq: (proxyReq, req, res) => {
                const url = new URL(proxyReq.path, `${proxyReq.protocol}//${proxyReq.host}`);
                url.searchParams.delete("auth_url");
                proxyReq.path = url.pathname;

                removeTrailingSlashFromPath(proxyReq);

                appendClientSecretToBody(proxyReq, req, res, "BIMCOLLAB_CLIENT_SECRET");
            },
        },
        changeOrigin: true,
    }),
);

app.use(tokenRouter);

app.use("/*", (_req, res, next) => {
    res.header("Cross-Origin-Opener-Policy", "same-origin");
    res.header("Cross-Origin-Embedder-Policy", "require-corp");
    res.header("Cross-Origin-Resource-Policy", "cross-origin");
    next();
});

app.use("/", express.static(path.resolve(__dirname, "dist")));
app.use(
    "/",
    expressStaticGzip(path.resolve(__dirname, "dist"), {
        enableBrotli: true,
        orderPreference: ["br", "gz"],
    }),
);

app.get("/config.json", (_req, res) => {
    res.json({
        bimCollabClientId: process.env.BIMCOLLAB_CLIENT_ID ?? "",
        bimTrackClientId: process.env.BIMTRACK_CLIENT_ID ?? "",
        jiraClientId: process.env.JIRA_CLIENT_ID ?? "",
        xsiteManageClientId: process.env.XSITEMANAGE_CLIENT_ID ?? "",
        novorenderClientId: process.env.NOVORENDER_CLIENT_ID ?? "",
        dataV2ServerUrl: process.env.DATA_V2_SERVER_URL ?? "",
        authServerUrl: process.env.AUTH_SERVER_URL ?? "",
        assetsUrl: process.env.ASSETS_URL ?? "",
        mixpanelToken: process.env.MIXPANEL_TOKEN ?? "",
    });
});
app.get("/*", function (_req, res) {
    res.sendFile(path.resolve(__dirname, "dist/index.html"));
});

if (process.env.PORT) {
    app.listen(process.env.PORT || 80, () => console.log("Server is listening on port 80 or whatever Azure wants"));
} else if (process.env.RUN_LOCALLY === "true") {
    // Test locally with https://localhost:3000
    // port is important because of some 3rd party auth redirect_uri rules
    try {
        const [key, cert] = await Promise.all([readFile("./localhost.key"), readFile("./localhost.crt")]);

        https.createServer({ key, cert }, app).listen(3000, () => {
            console.log("Server is running on https://localhost:3000");
        });
    } catch (err) {
        console.error(`Failed to start server: ${err}`);
    }
} else {
    https.createServer({}, app).listen(443);
}