Function fetchBrandData

server/src/services/brandfetch.ts:172–288

(domain: string)

 * Fetch brand data from Brandfetch API
 */
export async function fetchBrandData(domain: string): Promise<BrandfetchEnrichmentResult> {
  if (!BRANDFETCH_API_KEY) {
    return {
      success: false,
      domain,
      error: 'BRANDFETCH_API_KEY not configured',
    };
  }

  // Normalize domain
  const normalizedDomain = domain.replace(/^https?:\/\//, '').replace(/\/$/, '').toLowerCase();

  // Validate domain to prevent SSRF — only allow valid domain characters
  if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/.test(normalizedDomain)) {
    return {
      success: false,
      domain: normalizedDomain,
      error: 'Invalid domain format',
    };
  }

  // Check cache
  const cached = cache.get(normalizedDomain);
  if (cached && cached.expiresAt > Date.now()) {
    logger.debug({ domain: normalizedDomain }, 'Brandfetch cache hit');
    return { ...cached.data, cached: true };
  }

  for (let attempt = 0; attempt <= BRANDFETCH_MAX_RETRIES; attempt++) {
    try {
      logger.info({ domain: normalizedDomain, attempt }, 'Fetching brand data from Brandfetch');

      // CodeQL: BRANDFETCH_API_URL is from env config, domain is normalized
      const response = await axios.get( // lgtm[js/request-forgery]
        `${BRANDFETCH_API_URL}/domain/${normalizedDomain}`,
        {
          headers: {
            Authorization: `Bearer ${BRANDFETCH_API_KEY}`,
            Accept: 'application/json',
          },
          timeout: BRANDFETCH_TIMEOUT_MS,
          validateStatus: () => true,
          responseType: 'arraybuffer',
        }
      );

      if (response.status === 404) {
        const result: BrandfetchEnrichmentResult = {
          success: false,
          domain: normalizedDomain,
          error: 'Brand not found in Brandfetch',
        };
        // Cache negative results for shorter time
        cache.set(normalizedDomain, { data: result, expiresAt: Date.now() + 5 * 60 * 1000 }); // 5 minutes
        return result;
      }

      if (response.status !== 200) {