Function createConnectorApp

cli/src/server.ts:90–744

(expectedToken: string)

}

export function createConnectorApp(expectedToken: string): H3 {
  const state: ConnectorState = {
    session: {
      token: expectedToken,
      connectedAt: 0,
      npmUser: null,
      avatar: null,
    },
    operations: [],
  }

  const app = new H3()

  // Handle CORS for all requests (including preflight)
  app.use((event: H3Event) => {
    const corsResult = handleCors(event, corsOptions)
    if (corsResult !== false) {
      return corsResult
    }
  })

  function validateToken(authHeader: string | null): boolean {
    if (!authHeader) return false
    const token = authHeader.replace('Bearer ', '')
    return token === expectedToken
  }

  app.post('/connect', async (event: H3Event) => {
    const rawBody = await event.req.json()
    const parsed = safeParse(ConnectBodySchema, rawBody)
    if (!parsed.success) {
      throw new HTTPError({ statusCode: 400, message: parsed.error })
    }

    if (parsed.data.token !== expectedToken) {
      throw new HTTPError({ statusCode: 401, message: 'Invalid token' })
    }

    const [npmUser, avatar] = await Promise.all([getNpmUser(), getNpmAvatar()])
    state.session.connectedAt = Date.now()
    state.session.npmUser = npmUser
    state.session.avatar = avatar

    return {
      success: true,
      data: {
        npmUser,
        avatar,
        connectedAt: state.session.connectedAt,
      },
    } satisfies ApiResponse<ConnectorEndpoints['POST /connect']['data']>
  })

  app.get('/state', event => {
    const auth = event.req.headers.get('authorization')
    if (!validateToken(auth)) {
      throw new HTTPError({ statusCode: 401, message: 'Unauthorized' })
    }