singlexyz/ChatGPT-Next-Web
1
0
Fork 0
forked from XiaoMo/ChatGPT-Next-Web
Code Pull Requests Activity

feat: white url list for openai security

Browse Source
This commit is contained in:
Yidadaa 2023-06-13 00:39:29 +08:00
parent bdb03e07fc
commit 0d4611052e
3 changed files with 29 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
app/api/openai/[...path]/route.ts
View File

@ -1,14 +1,32 @@
import { OpenaiPath } from "@/app/constant";
import { prettyObject } from "@/app/utils/format"; import { prettyObject } from "@/app/utils/format";
import { NextRequest, NextResponse } from "next/server"; import { NextRequest, NextResponse } from "next/server";
import { auth } from "../../auth"; import { auth } from "../../auth";
import { requestOpenai } from "../../common"; import { requestOpenai } from "../../common";
const ALLOWD_PATH = new Set(Object.values(OpenaiPath));
async function handle( async function handle(
req: NextRequest, req: NextRequest,
{ params }: { params: { path: string[] } }, { params }: { params: { path: string[] } },
) { ) {
console.log("[OpenAI Route] params ", params); console.log("[OpenAI Route] params ", params);
const subpath = params.path.join("/");
if (!ALLOWD_PATH.has(subpath)) {
console.log("[OpenAI Route] forbidden path ", subpath);
return NextResponse.json(
{
error: true,
msg: "you are not allowed to request " + subpath,
},
{
status: 403,
},
);
}
const authResult = auth(req); const authResult = auth(req);
if (authResult.error) { if (authResult.error) {
return NextResponse.json(authResult, { return NextResponse.json(authResult, {

13
app/client/platforms/openai.ts
View File

@ -1,4 +1,4 @@
import { REQUEST_TIMEOUT_MS } from "@/app/constant"; import { OpenaiPath, REQUEST_TIMEOUT_MS } from "@/app/constant";
import { useAccessStore, useAppConfig, useChatStore } from "@/app/store"; import { useAccessStore, useAppConfig, useChatStore } from "@/app/store";
import { ChatOptions, getHeaders, LLMApi, LLMUsage } from "../api"; import { ChatOptions, getHeaders, LLMApi, LLMUsage } from "../api";
@ -10,10 +10,6 @@ import {
import { prettyObject } from "@/app/utils/format"; import { prettyObject } from "@/app/utils/format";
export class ChatGPTApi implements LLMApi { export class ChatGPTApi implements LLMApi {
public ChatPath = "v1/chat/completions";
public UsagePath = "dashboard/billing/usage";
public SubsPath = "dashboard/billing/subscription";
path(path: string): string { path(path: string): string {
let openaiUrl = useAccessStore.getState().openaiUrl; let openaiUrl = useAccessStore.getState().openaiUrl;
if (openaiUrl.endsWith("/")) { if (openaiUrl.endsWith("/")) {
@ -55,7 +51,7 @@ export class ChatGPTApi implements LLMApi {
options.onController?.(controller); options.onController?.(controller);
try { try {
const chatPath = this.path(this.ChatPath); const chatPath = this.path(OpenaiPath.ChatPath);
const chatPayload = { const chatPayload = {
method: "POST", method: "POST",
body: JSON.stringify(requestPayload), body: JSON.stringify(requestPayload),
@ -177,14 +173,14 @@ export class ChatGPTApi implements LLMApi {
const [used, subs] = await Promise.all([ const [used, subs] = await Promise.all([
fetch( fetch(
this.path( this.path(
`${this.UsagePath}?start_date=${startDate}&end_date=${endDate}`, `${OpenaiPath.UsagePath}?start_date=${startDate}&end_date=${endDate}`,
), ),
{ {
method: "GET", method: "GET",
headers: getHeaders(), headers: getHeaders(),
}, },
), ),
fetch(this.path(this.SubsPath), { fetch(this.path(OpenaiPath.SubsPath), {
method: "GET", method: "GET",
headers: getHeaders(), headers: getHeaders(),
}), }),
@ -228,3 +224,4 @@ export class ChatGPTApi implements LLMApi {
} as LLMUsage; } as LLMUsage;
} }
} }
export { OpenaiPath };

6
app/constant.ts
View File

@ -45,3 +45,9 @@ export const LAST_INPUT_KEY = "last-input";
export const REQUEST_TIMEOUT_MS = 60000; export const REQUEST_TIMEOUT_MS = 60000;
export const EXPORT_MESSAGE_CLASS_NAME = "export-markdown"; export const EXPORT_MESSAGE_CLASS_NAME = "export-markdown";
export const OpenaiPath = {
ChatPath: "v1/chat/completions",
UsagePath: "dashboard/billing/usage",
SubsPath: "dashboard/billing/subscription",
};