|
| 1 | +import type { NextApiRequest, NextApiResponse } from 'next'; |
| 2 | +import { isAddress } from 'viem'; |
| 3 | + |
| 4 | +const COMPLIANCE_API_URL = process.env.COMPLIANCE_API_URL; |
| 5 | +const COMPLIANCE_SECRET = process.env.COMPLIANCE_SECRET; |
| 6 | + |
| 7 | +type ComplianceApiResponse = { |
| 8 | + result: boolean; |
| 9 | + lastChecked: string; |
| 10 | + nextCheck: string; |
| 11 | +}; |
| 12 | + |
| 13 | +type PreflightResponse = { |
| 14 | + result: boolean; |
| 15 | + nextCheck: string; |
| 16 | +}; |
| 17 | + |
| 18 | +type ErrorResponse = { |
| 19 | + error: string; |
| 20 | +}; |
| 21 | + |
| 22 | +export default async function handler( |
| 23 | + req: NextApiRequest, |
| 24 | + res: NextApiResponse<PreflightResponse | ErrorResponse> |
| 25 | +) { |
| 26 | + if (req.method !== 'GET') { |
| 27 | + return res.status(405).json({ error: 'Method not allowed' }); |
| 28 | + } |
| 29 | + |
| 30 | + const { address } = req.query; |
| 31 | + |
| 32 | + if (!address || typeof address !== 'string') { |
| 33 | + return res.status(400).json({ error: 'Address is required' }); |
| 34 | + } |
| 35 | + |
| 36 | + // Validate address format to prevent SSRF attacks |
| 37 | + // const ethereumAddressRegex = /^0x[a-fA-F0-9]{40}$/; |
| 38 | + if (!isAddress(address)) { |
| 39 | + return res.status(400).json({ error: 'Invalid address format' }); |
| 40 | + } |
| 41 | + |
| 42 | + if (!COMPLIANCE_API_URL || !COMPLIANCE_SECRET) { |
| 43 | + console.error('Compliance API not configured'); |
| 44 | + // Fail open in development if not configured |
| 45 | + if (process.env.NODE_ENV === 'development') { |
| 46 | + return res.status(200).json({ |
| 47 | + result: true, |
| 48 | + nextCheck: new Date(Date.now() + 2 * 60 * 60 * 1000).toISOString(), |
| 49 | + }); |
| 50 | + } |
| 51 | + return res.status(500).json({ error: 'Service unavailable' }); |
| 52 | + } |
| 53 | + |
| 54 | + try { |
| 55 | + // use ?overrideResultStatus=false | true if you want to override the result |
| 56 | + |
| 57 | + const response = await fetch(`${COMPLIANCE_API_URL}/check/${encodeURIComponent(address)}`, { |
| 58 | + method: 'GET', |
| 59 | + headers: { |
| 60 | + 'x-compliance-secret': COMPLIANCE_SECRET, |
| 61 | + }, |
| 62 | + }); |
| 63 | + |
| 64 | + if (!response.ok) { |
| 65 | + if (response.status === 401) { |
| 66 | + console.error('Compliance API: Invalid secret'); |
| 67 | + return res.status(500).json({ error: 'Service configuration error' }); |
| 68 | + } |
| 69 | + if (response.status === 400) { |
| 70 | + return res.status(400).json({ error: 'Invalid address format' }); |
| 71 | + } |
| 72 | + return res.status(500).json({ error: 'Compliance check failed' }); |
| 73 | + } |
| 74 | + |
| 75 | + const data: ComplianceApiResponse = await response.json(); |
| 76 | + |
| 77 | + return res.status(200).json({ |
| 78 | + result: data.result, |
| 79 | + nextCheck: data.nextCheck, |
| 80 | + }); |
| 81 | + } catch (error) { |
| 82 | + console.error('Compliance API error:', error); |
| 83 | + return res.status(500).json({ error: 'Service unavailable' }); |
| 84 | + } |
| 85 | +} |
0 commit comments