Function handler

website/api/trigger-bundle.ts:16–225

(req: any, res: any)

} from './lib/security.js';

export default async function handler(req: any, res: any) {
    // Only allow POST requests
    if (req.method !== 'POST') {
        return res.status(405).json({ error: 'Method not allowed' });
    }

    // Basic request hardening
    const origin = req.headers?.origin || req.headers?.referer;
    if (!isAllowedOrigin(origin)) {
        return res.status(403).json({
            error: 'Forbidden origin'
        });
    }

    if (!isAuthorizedRequest(req)) {
        return res.status(401).json({
            error: 'Unauthorized request'
        });
    }

    const contentType = req.headers?.['content-type'] || '';
    if (typeof contentType === 'string' && !contentType.includes('application/json')) {
        return res.status(415).json({ error: 'Content-Type must be application/json' });
    }

    const clientIp = getClientIp(req);
    const rateLimitResult = checkRateLimit(clientIp);
    if (!rateLimitResult.allowed) {
        res.setHeader('Retry-After', String(rateLimitResult.retryAfterSeconds));
        return res.status(429).json({
            error: 'Rate limit exceeded. Please retry later.',
            retry_after_seconds: rateLimitResult.retryAfterSeconds
        });
    }

    if (!process.env.GITHUB_TOKEN) {
        return res.status(503).json({
            error: 'Bundle generation service is not configured'
        });
    }

    const rawRepoUrl = req.body.repoUrl;
    const repoUrl = rawRepoUrl ? rawRepoUrl.trim() : rawRepoUrl;

    // Validate input
    if (!repoUrl) {
        return res.status(400).json({ error: 'Repository URL is required' });
    }

    // Validate GitHub URL format
    // Allow optional trailing slash and .git extension
    const githubUrlPattern = /^https?:\/\/(www\.)?github\.com\/([^\/]+)\/([^\/]+)(\.git)?\/?$/;
    const match = repoUrl.match(githubUrlPattern);

    if (!match) {
        return res.status(400).json({
            error: 'Invalid GitHub URL format. Expected: https://github.com/owner/repo'
        });