diff --git a/go/cmd/orion/main.go b/go/cmd/orion/main.go index d6a5be6..b261048 100644 --- a/go/cmd/orion/main.go +++ b/go/cmd/orion/main.go @@ -6,6 +6,7 @@ import ( "log/slog" "net/http" "os" + "strings" "cloud.google.com/go/firestore" "cloud.google.com/go/storage" @@ -173,6 +174,9 @@ func main() { // Particles mux.Handle("GET /particles/{id}/download", withAuth(h.DownloadParticleMedia)) + // Link metadata + mux.Handle("GET /metadata", withAuth(h.GetLinkMetadata)) + // Depot mux.Handle("POST /depot/upload", withAuth(h.PrepareUpload)) mux.Handle("POST /depot/objects/{id}/confirm", withAuth(h.ConfirmUpload)) @@ -185,8 +189,17 @@ func main() { mux.Handle("GET /waitlist/{email}", withAuth(h.GetWaitlistEntry)) mux.Handle("POST /waitlist/invite", withAuth(h.InviteWaitlistEntrant)) - // nil = allow all origins (Electron app needs it). - muxWithCors := middleware.CORS(nil)(mux) + // CORS_ALLOWED_ORIGINS is a comma-separated whitelist for the web client. + // Empty / unset = allow all + var allowedOrigins []string + if raw := os.Getenv("CORS_ALLOWED_ORIGINS"); raw != "" { + for _, o := range strings.Split(raw, ",") { + if o = strings.TrimSpace(o); o != "" { + allowedOrigins = append(allowedOrigins, o) + } + } + } + muxWithCors := middleware.CORS(allowedOrigins)(mux) addr := fmt.Sprintf("0.0.0.0:%s", port) slog.Info("running server", "addr", addr) diff --git a/go/internal/handler/metadata.go b/go/internal/handler/metadata.go new file mode 100644 index 0000000..5878071 --- /dev/null +++ b/go/internal/handler/metadata.go @@ -0,0 +1,213 @@ +package handler + +import ( + "context" + "errors" + "io" + "log/slog" + "net" + "net/http" + "net/url" + "regexp" + "strings" + "sync" + "time" +) + +// LinkMetadata mirrors the TS shape in +// `js/desktop/src/lib/link-metadata.ts`. The Electron client does this fetch +// in its main process; the web client can't (browser CORS), so it calls this +// endpoint instead. +type LinkMetadata struct { + URL string `json:"url"` + Title *string `json:"title"` + Description *string `json:"description"` + Image *string `json:"image"` + Favicon *string `json:"favicon"` + Domain string `json:"domain"` +} + +const ( + metadataFetchTimeout = 5 * time.Second + metadataMaxBytes = 50 * 1024 + metadataUserAgent = "Mozilla/5.0 (compatible; llink/1.0)" +) + +// In-process cache, unbounded but only successful results are stored. Mirrors +// the Electron-main implementation; URL space is bounded in practice. +var metadataCache sync.Map // map[string]LinkMetadata + +func (h *Handler) GetLinkMetadata(w http.ResponseWriter, r *http.Request) { + raw := r.URL.Query().Get("url") + if raw == "" { + http.Error(w, "url is required", http.StatusBadRequest) + return + } + + parsed, err := url.Parse(raw) + if err != nil || (parsed.Scheme != "http" && parsed.Scheme != "https") || parsed.Host == "" { + http.Error(w, "invalid url", http.StatusBadRequest) + return + } + + if cached, ok := metadataCache.Load(raw); ok { + writeJSON(w, cached) + return + } + + if err := guardSSRF(parsed.Hostname()); err != nil { + // Treat unresolvable / private hosts as "no metadata" rather than 4xx — the + // client treats a null body as a progressive-enhancement miss. + writeJSON(w, nil) + return + } + + meta, err := fetchLinkMetadata(r.Context(), parsed) + if err != nil { + slog.Warn("link metadata fetch failed", "url", raw, "error", err) + writeJSON(w, nil) + return + } + + metadataCache.Store(raw, *meta) + writeJSON(w, meta) +} + +// guardSSRF resolves the host and rejects loopback, private, link-local, and +// unspecified addresses so the endpoint can't be turned into an internal-network +// probe. +func guardSSRF(host string) error { + ips, err := net.LookupIP(host) + if err != nil { + return err + } + if len(ips) == 0 { + return errors.New("no addresses for host") + } + for _, ip := range ips { + if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || + ip.IsLinkLocalMulticast() || ip.IsUnspecified() { + return errors.New("private or local address") + } + } + return nil +} + +func fetchLinkMetadata(ctx context.Context, target *url.URL) (*LinkMetadata, error) { + ctx, cancel := context.WithTimeout(ctx, metadataFetchTimeout) + defer cancel() + + req, err := http.NewRequestWithContext(ctx, http.MethodGet, target.String(), nil) + if err != nil { + return nil, err + } + req.Header.Set("User-Agent", metadataUserAgent) + req.Header.Set("Accept", "text/html") + + resp, err := http.DefaultClient.Do(req) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + if resp.StatusCode < 200 || resp.StatusCode >= 300 { + return nil, errors.New("upstream non-2xx") + } + + body, err := io.ReadAll(io.LimitReader(resp.Body, metadataMaxBytes)) + if err != nil { + return nil, err + } + html := string(body) + + domain := strings.TrimPrefix(target.Hostname(), "www.") + title := firstNonNil(metaContent(html, "og:title"), parseTitle(html)) + description := firstNonNil( + metaContent(html, "og:description"), + metaContent(html, "description"), + ) + image := resolveURL(metaContent(html, "og:image"), target) + favicon := parseFavicon(html, target) + + return &LinkMetadata{ + URL: target.String(), + Title: title, + Description: description, + Image: image, + Favicon: favicon, + Domain: domain, + }, nil +} + +// Regex patterns mirror the JS impl in `js/desktop/src/main.ts` so both clients +// derive the same metadata until the JS path is retired. + +var titleRe = regexp.MustCompile(`(?i)]*>([^<]*)`) + +func parseTitle(html string) *string { + m := titleRe.FindStringSubmatch(html) + if len(m) < 2 { + return nil + } + s := strings.TrimSpace(m[1]) + if s == "" { + return nil + } + return &s +} + +// metaContent finds in either attribute order. +func metaContent(html, prop string) *string { + escaped := regexp.QuoteMeta(prop) + re := regexp.MustCompile( + `(?i)]*(?:property|name)=["']` + escaped + `["'][^>]*content=["']([^"']*)["']` + + `|]*content=["']([^"']*)["'][^>]*(?:property|name)=["']` + escaped + `["']`, + ) + m := re.FindStringSubmatch(html) + if len(m) == 0 { + return nil + } + for _, g := range m[1:] { + if g != "" { + return &g + } + } + return nil +} + +var ( + faviconRe1 = regexp.MustCompile(`(?i)]*rel=["'](?:shortcut )?icon["'][^>]*href=["']([^"']*)["']`) + faviconRe2 = regexp.MustCompile(`(?i)]*href=["']([^"']*)["'][^>]*rel=["'](?:shortcut )?icon["']`) +) + +func parseFavicon(html string, base *url.URL) *string { + for _, re := range []*regexp.Regexp{faviconRe1, faviconRe2} { + if m := re.FindStringSubmatch(html); len(m) >= 2 { + return resolveURL(&m[1], base) + } + } + // Fall back to /favicon.ico + fallback := (&url.URL{Scheme: base.Scheme, Host: base.Host, Path: "/favicon.ico"}).String() + return &fallback +} + +func resolveURL(src *string, base *url.URL) *string { + if src == nil || *src == "" { + return nil + } + parsed, err := url.Parse(*src) + if err != nil { + return src + } + resolved := base.ResolveReference(parsed).String() + return &resolved +} + +func firstNonNil(values ...*string) *string { + for _, v := range values { + if v != nil && *v != "" { + return v + } + } + return nil +} diff --git a/go/k8s/dev/orion.yaml b/go/k8s/dev/orion.yaml index 0596ed6..e6f7b97 100644 --- a/go/k8s/dev/orion.yaml +++ b/go/k8s/dev/orion.yaml @@ -79,6 +79,9 @@ spec: value: "llink://billing/success" - name: "BILLING_CANCEL_URL" value: "llink://billing/cancel" + # Web client origins + - name: "CORS_ALLOWED_ORIGINS" + value: "http://localhost:5173,http://localhost:5174,http://localhost:5175,https://llink.dev.flowy.live" --- diff --git a/go/k8s/prod/orion.yaml b/go/k8s/prod/orion.yaml index aaee2e2..b9b2dd2 100644 --- a/go/k8s/prod/orion.yaml +++ b/go/k8s/prod/orion.yaml @@ -76,6 +76,9 @@ spec: value: "llink://billing/success" - name: "BILLING_CANCEL_URL" value: "llink://billing/cancel" + # Web client origins + - name: "CORS_ALLOWED_ORIGINS" + value: "https://llink.flowy.live" ---