feat: rebuild xiteng.site homelab platform

2026-08-12 09:48:25 +08:00
parent 557b0eca33
commit 5b84988789
128 changed files with 14979 additions and 292 deletions
@@ -0,0 +1,53 @@
+import {readFileSync} from "node:fs";
+
+export type ChatIdentity = {issuer: string; sub: string; username: string; name: string; email: string};
+type HeaderReader = Pick<Headers, "get">;
+
+const keyVaultUrl = process.env.KEY_VAULT_URL || "http://ai-gateway:8093";
+const authentikIssuer = process.env.AUTHENTIK_ISSUER || "https://auth.xiteng.site";
+const serviceTokenFile = process.env.KEY_VAULT_TOKEN_FILE || "/run/secrets/portal_gateway_hmac";
+let serviceToken: string | null = null;
+
+function loadServiceToken() {
+  if (!serviceToken) serviceToken = readFileSync(/* turbopackIgnore: true */ serviceTokenFile, "utf8").trim();
+  return serviceToken;
+}
+
+export function identityFromHeaders(headers: HeaderReader): ChatIdentity {
+  const username = headers.get("x-authentik-username")?.trim() || "";
+  const sub = headers.get("x-authentik-uid")?.trim() || "";
+  if (!username || !sub) {
+    const error = new Error("Authenticated user context is required");
+    Object.assign(error, {statusCode: 401});
+    throw error;
+  }
+  return {
+    issuer: authentikIssuer,
+    sub,
+    username,
+    name: headers.get("x-authentik-name")?.trim() || username,
+    email: headers.get("x-authentik-email")?.trim() || ""
+  };
+}
+
+export function keyVaultFetch(
+  pathname: string,
+  identity: ChatIdentity,
+  init: {method?: string; body?: string; headers?: HeadersInit} = {}
+) {
+  const method = init.method || "GET";
+  return fetch(new URL(pathname, keyVaultUrl), {
+    method,
+    headers: {
+      "Accept": "application/json",
+      "Authorization": `Bearer ${loadServiceToken()}`,
+      ...init.headers,
+      "X-Key-Vault-Actor-Issuer": identity.issuer,
+      "X-Key-Vault-Actor-Sub": identity.sub,
+      "X-Key-Vault-Actor-Username": identity.username
+    },
+    body: init.body,
+    cache: "no-store",
+    signal: AbortSignal.timeout(300000)
+  });
+}