Function onRequest

packages/server/src/api-extension.ts:13515–13698

({ request, response }: { request: IncomingMessage; response: ServerResponse })

  return {
    priority: 100, // Higher priority — API routes run before static file serving
    async onRequest({ request, response }: { request: IncomingMessage; response: ServerResponse }) {
      const url = request.url?.split('?')[0];
      if (!url) return;

      const headerString = (name: string): string | undefined => {
        const value = request.headers[name];
        if (value === undefined) return undefined;
        return Array.isArray(value) ? value.join(', ') : value;
      };
      recordEmbedProbe({
        ts: Date.now(),
        url,
        method: request.method ?? '',
        ua: headerString('user-agent'),
        origin: headerString('origin'),
        referer: headerString('referer'),
        host: headerString('host'),
        remote: request.socket?.remoteAddress,
        secChUa: headerString('sec-ch-ua'),
        secChUaMobile: headerString('sec-ch-ua-mobile'),
        secChUaPlatform: headerString('sec-ch-ua-platform'),
        secFetchSite: headerString('sec-fetch-site'),
        secFetchDest: headerString('sec-fetch-dest'),
        secFetchMode: headerString('sec-fetch-mode'),
        secFetchUser: headerString('sec-fetch-user'),
      });

      if (url.startsWith('/api/')) {
        const origin = request.headers.origin;
        if (origin !== undefined && !isAllowedApiOrigin(origin)) {
          errorResponse(response, 403, 'urn:ok:error:invalid-origin', 'Origin not allowed.', {
            handler: 'api-origin-gate',
          });
          return;
        }
        if (typeof response.setHeader === 'function') {
          if (origin !== undefined) {
            response.setHeader('Access-Control-Allow-Origin', origin);
            response.setHeader('Vary', 'Origin');
          }
          response.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
          response.setHeader(
            'Access-Control-Allow-Headers',
            `Content-Type, Authorization, traceparent, tracestate, baggage, ${CLIENT_VERSION_HEADER.protocol}, ${CLIENT_VERSION_HEADER.runtime}, ${CLIENT_VERSION_HEADER.kind}`,
          );
        }
        if (request.method === 'OPTIONS') {
          response.writeHead(204);
          response.end();
          return;
        }
      }

      if (MUTATING_ROUTES.has(url) || STATE_MUTATING_PREFIXES.some((p) => url.startsWith(p))) {
        const peerAddress = request.socket?.remoteAddress;
        if (peerAddress !== undefined && !isLoopbackAddress(peerAddress)) {
          errorResponse(response, 403, 'urn:ok:error:loopback-required', 'Loopback required.', {
            handler: 'api-mutating-gate',