#!/usr/bin/env node

const http = require('http');

const https = require('https');

const tls = require('tls');

const { URL } = require('url');

const { HttpsProxyAgent } = require('https-proxy-agent');

const { generateRequestId, sanitizeForLog, logRequest } = require('./logging');

const metrics = require('./metrics');

const rateLimiter = require('./rate-limiter');

let trackTokenUsage;

let trackWebSocketTokenUsage;

let closeLogStream;

try {

({ trackTokenUsage, trackWebSocketTokenUsage, closeLogStream } = require('./token-tracker'));

} catch (err) {

if (err && err.code === 'MODULE_NOT_FOUND') {

trackTokenUsage = () => {};

trackWebSocketTokenUsage = () => {};

closeLogStream = () => {};

} else {

throw err;

}

const limiter = rateLimiter.create();

const MAX_BODY_SIZE = 10 * 1024 * 1024;

const STRIPPED_HEADERS = new Set([

'host',

'authorization',

'proxy-authorization',

'x-api-key',

'forwarded',

'via',

function shouldStripHeader(name) {

const lower = name.toLowerCase();

return STRIPPED_HEADERS.has(lower) || lower.startsWith('x-forwarded-');

const OPENAI_API_KEY = (process.env.OPENAI_API_KEY || '').trim() || undefined;

const ANTHROPIC_API_KEY = (process.env.ANTHROPIC_API_KEY || '').trim() || undefined;

const COPILOT_GITHUB_TOKEN = (process.env.COPILOT_GITHUB_TOKEN || '').trim() || undefined;

const GEMINI_API_KEY = (process.env.GEMINI_API_KEY || '').trim() || undefined;

function normalizeApiTarget(value) {

const OPENAI_API_TARGET = normalizeApiTarget(process.env.OPENAI_API_TARGET) || 'api.openai.com';

const ANTHROPIC_API_TARGET = normalizeApiTarget(process.env.ANTHROPIC_API_TARGET) || 'api.anthropic.com';

const GEMINI_API_TARGET = normalizeApiTarget(process.env.GEMINI_API_TARGET) || 'generativelanguage.googleapis.com';

function normalizeBasePath(rawPath) {

function buildUpstreamPath(reqUrl, targetHost, basePath) {

const OPENAI_API_BASE_PATH = normalizeBasePath(process.env.OPENAI_API_BASE_PATH);

const ANTHROPIC_API_BASE_PATH = normalizeBasePath(process.env.ANTHROPIC_API_BASE_PATH);

const GEMINI_API_BASE_PATH = normalizeBasePath(process.env.GEMINI_API_BASE_PATH);

function deriveCopilotApiTarget() {

const COPILOT_API_TARGET = deriveCopilotApiTarget();

const HTTPS_PROXY = process.env.HTTPS_PROXY || process.env.HTTP_PROXY;

logRequest('info', 'startup', {

message: 'Starting AWF API proxy sidecar',

squid_proxy: HTTPS_PROXY || 'not configured',

api_targets: {

openai: OPENAI_API_TARGET,

anthropic: ANTHROPIC_API_TARGET,

gemini: GEMINI_API_TARGET,

copilot: COPILOT_API_TARGET,

},

api_base_paths: {

openai: OPENAI_API_BASE_PATH || '(none)',

anthropic: ANTHROPIC_API_BASE_PATH || '(none)',

gemini: GEMINI_API_BASE_PATH || '(none)',

},

providers: {

openai: !!OPENAI_API_KEY,

anthropic: !!ANTHROPIC_API_KEY,

gemini: !!GEMINI_API_KEY,

copilot: !!COPILOT_GITHUB_TOKEN,

},

const proxyAgent = HTTPS_PROXY ? new HttpsProxyAgent(HTTPS_PROXY) : undefined;

if (!proxyAgent) {

logRequest('warn', 'startup', { message: 'No HTTPS_PROXY configured, requests will go direct' });

function checkRateLimit(req, res, provider, requestBytes) {

function isValidRequestId(id) {

return typeof id === 'string' && id.length <= 128 && /^[\w\-\.]+$/.test(id);

function proxyRequest(req, res, targetHost, injectHeaders, provider, basePath = '') {

function proxyWebSocket(req, socket, head, targetHost, injectHeaders, provider, basePath = '') {

function healthResponse() {

function handleManagementEndpoint(req, res) {

if (require.main === module) {

// Health port is always 10000 — this is what Docker healthcheck hits

const HEALTH_PORT = 10000;

// OpenAI API proxy (port 10000)

if (OPENAI_API_KEY) {

const server = http.createServer((req, res) => {

if (handleManagementEndpoint(req, res)) return;

const contentLength = parseInt(req.headers['content-length'], 10) || 0;

if (checkRateLimit(req, res, 'openai', contentLength)) return;

proxyRequest(req, res, OPENAI_API_TARGET, {

'Authorization': `Bearer ${OPENAI_API_KEY}`,

}, 'openai', OPENAI_API_BASE_PATH);

});

server.on('upgrade', (req, socket, head) => {

proxyWebSocket(req, socket, head, OPENAI_API_TARGET, {

'Authorization': `Bearer ${OPENAI_API_KEY}`,

}, 'openai', OPENAI_API_BASE_PATH);

});

server.listen(HEALTH_PORT, '0.0.0.0', () => {

logRequest('info', 'server_start', { message: `OpenAI proxy listening on port ${HEALTH_PORT}`, target: OPENAI_API_TARGET });

});

} else {

// No OpenAI key — still need a health endpoint on port 10000 for Docker healthcheck

const server = http.createServer((req, res) => {

if (handleManagementEndpoint(req, res)) return;

res.writeHead(404, { 'Content-Type': 'application/json' });

res.end(JSON.stringify({ error: 'OpenAI proxy not configured (no OPENAI_API_KEY)' }));

});

server.on('upgrade', (req, socket) => {

socket.write('HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\n\r\n');

socket.destroy();

});

server.listen(HEALTH_PORT, '0.0.0.0', () => {

logRequest('info', 'server_start', { message: `Health endpoint listening on port ${HEALTH_PORT} (OpenAI not configured)` });

});