Function proxyFetch

src/ssh/SSHAuthProxy.ts:39–98

(
  req: Request,
  nonce: string | null,
)

}

async function proxyFetch(
  req: Request,
  nonce: string | null,
): Promise<Response> {
  if (nonce && req.headers.get('x-auth-nonce') !== nonce) {
    return new Response('Forbidden', { status: 403 })
  }

  const upstreamBase = resolveUpstreamBaseUrl()
  const url = new URL(req.url)
  const upstreamUrl = `${upstreamBase}${url.pathname}${url.search}`

  const authHeaders = resolveAuthHeaders()
  if (Object.keys(authHeaders).length === 0) {
    return new Response(
      JSON.stringify({
        error: 'No API credentials available on local machine',
      }),
      { status: 401, headers: { 'content-type': 'application/json' } },
    )
  }

  const forwardHeaders = new Headers(req.headers)
  for (const [k, v] of Object.entries(authHeaders)) {
    forwardHeaders.set(k, v)
  }
  forwardHeaders.delete('host')
  forwardHeaders.delete('x-auth-nonce')

  logForDebugging(
    `[SSHAuthProxy] ${req.method} ${url.pathname} -> ${upstreamUrl}`,
  )

  try {
    const upstreamRes = await fetch(upstreamUrl, {
      method: req.method,
      headers: forwardHeaders,
      body: req.body,
      // @ts-expect-error Bun supports duplex for streaming request bodies
      duplex: 'half',
    })

    const responseHeaders = new Headers(upstreamRes.headers)
    responseHeaders.delete('content-encoding')
    responseHeaders.delete('content-length')

    return new Response(upstreamRes.body, {
      status: upstreamRes.status,
      statusText: upstreamRes.statusText,
      headers: responseHeaders,
    })
  } catch (err) {
    const message = err instanceof Error ? err.message : String(err)
    logForDebugging(`[SSHAuthProxy] upstream error: ${message}`)
    return new Response(
      JSON.stringify({ error: `Proxy upstream error: ${message}` }),
      { status: 502, headers: { 'content-type': 'application/json' } },
    )