Function fetch

apps/petrinaut-website/api/chat.ts:128–227

(request: Request)

 * See https://vercel.com/changelog/node-js-vercel-functions-now-support-fetch-web-handlers
 */
const fetch = async (request: Request): Promise<Response> => {
  if (request.method === "OPTIONS") {
    // We'll always serve this same-origin so we don't need any CORS config
    return new Response(null, { status: 204 });
  }

  if (request.method !== "POST") {
    logChatFailure("Rejected unsupported method", { method: request.method });
    return jsonResponse({ error: "Method not allowed" }, { status: 405 });
  }

  const clientIp = resolveClientIp(request);
  if (process.env.VERCEL_ENV === "production" && !clientIp) {
    // Vercel's edge always sets x-forwarded-for in production. If it isn't
    // present, the request reached us through an unexpected path and we have
    // no way to rate-limit it - reject conservatively rather than fail open.
    logChatFailure("Rejected production request with no resolvable client IP");
    return jsonResponse(
      { error: "Could not determine client IP" },
      { status: 400 },
    );
  }

  if (clientIp && !checkRateLimit(clientIp)) {
    logChatFailure("Rejected rate-limited request", { clientIp });
    return jsonResponse({ error: "Rate limit exceeded" }, { status: 429 });
  }

  const apiKey = process.env.OPENAI_API_KEY;
  if (!apiKey) {
    logChatFailure("Missing OpenAI API key");
    return jsonResponse(
      { error: "OPENAI_API_KEY is not configured" },
      { status: 500 },
    );
  }

  let body: unknown;
  try {
    body = await request.json();
  } catch (error) {
    logChatFailure("Rejected invalid JSON", { error });
    return jsonResponse({ error: "Invalid JSON" }, { status: 400 });
  }

  const parsed = requestSchema.safeParse(body);
  if (!parsed.success) {
    logChatFailure("Rejected invalid chat request", { error: parsed.error });
    return jsonResponse({ error: "Invalid chat request" }, { status: 400 });
  }

  const validatedMessages = await safeValidateUIMessages<UIMessage>({
    messages: parsed.data.messages,
    tools: petrinautAiValidationTools,
  });

  if (!validatedMessages.success) {
    logChatFailure("Rejected invalid chat messages", {