Show mutual scores from friends

src/server/serve.ts

@@ -32,6 +32,42 @@ function readOptionalPathFile(): string | undefined {
 const chatRequestDatabase =
 	Deno.env.get("CHAT_REQUEST_DATABASE")?.trim() || readOptionalPathFile();
 
+function isSafeProxyPath(path: string): boolean {
+	if (!path) return false;
+	if (!path.startsWith("/")) return false;
+	if (path.includes("://")) return false;
+	if (path.includes("\\") || path.includes("\r") || path.includes("\n")) return false;
+	return true;
+}
+
+async function proxyApiRequest(req: Request, upstreamBase: string): Promise<Response> {
+	const url = new URL(req.url);
+	const path = url.searchParams.get("path") ?? "";
+	if (!isSafeProxyPath(path)) {
+		return new Response("Invalid path\n", { status: 400 });
+	}
+	const upstream = new URL(`${upstreamBase}${path}`);
+	for (const [key, value] of url.searchParams.entries()) {
+		if (key === "path") continue;
+		upstream.searchParams.append(key, value);
+	}
+	try {
+		const upstreamRes = await fetch(upstream, { method: "GET" });
+		const headers = new Headers();
+		const contentType = upstreamRes.headers.get("content-type");
+		if (contentType) headers.set("content-type", contentType);
+		headers.set("cache-control", "no-store");
+		return new Response(upstreamRes.body, {
+			status: upstreamRes.status,
+			statusText: upstreamRes.statusText,
+			headers,
+		});
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return new Response(`Proxy request failed: ${message}\n`, { status: 502 });
+	}
+}
+
 function isChatRequestFilename(pathname: string): boolean {
 	const base = pathname.split("/").pop() ?? "";
 	return base === "ChatRequest.json" || base === "database.json";
@@ -39,6 +75,12 @@ function isChatRequestFilename(pathname: string): boolean {
 
 Deno.serve({ port, hostname: "127.0.0.1" }, async (req) => {
 	const url = new URL(req.url);
+	if (req.method === "GET" && url.pathname === "/api/beatleader") {
+		return proxyApiRequest(req, "https://api.beatleader.com");
+	}
+	if (req.method === "GET" && url.pathname === "/api/beatsaver") {
+		return proxyApiRequest(req, "https://api.beatsaver.com");
+	}
 	if (req.method === "GET" && chatRequestDatabase && isChatRequestFilename(url.pathname)) {
 		try {
 			let text = await Deno.readTextFile(chatRequestDatabase);