// Copyright(C) 2025-2026 Advanced Micro Devices, Inc. All rights reserved. // SPDX-License-Identifier: MIT /** * GAIA SDK Documentation Proxy Server * * Auth proxy for Mintlify-hosted documentation with access code protection. * Proxies authenticated requests to the Mintlify site. * * Environment Variables: * DOCS_AUTH_ENABLED - Set to 'true' to require access code * DOCS_ACCESS_CODE - The access code users must enter * MINTLIFY_URL - The Mintlify site URL (default: https://amd-gaia.ai) * PORT - Server port (default: 3000) */ require('dotenv').config(); const express = require('express'); const rateLimit = require('express-rate-limit'); const { createProxyMiddleware } = require('http-proxy-middleware'); const cookieParser = require('cookie-parser'); const crypto = require('crypto'); const url = require('url'); const app = express(); const PORT = process.env.PORT || 3000; // Configuration const AUTH_ENABLED = process.env.DOCS_AUTH_ENABLED === 'true'; const ACCESS_CODE = process.env.DOCS_ACCESS_CODE || ''; const MINTLIFY_URL = process.env.MINTLIFY_URL || 'https://amd-gaia.ai'; const COOKIE_SECRET = process.env.COOKIE_SECRET || crypto.randomBytes(32).toString('hex'); const COOKIE_NAME = 'gaia_docs_auth'; const COOKIE_MAX_AGE = 7 * 24 * 60 * 60 * 1000; // 7 days // Server-side redirect storage (nonce -> { url, expires }) // Redirect URLs are stored server-side to prevent user-controlled data in redirects const pendingRedirects = new Map(); const NONCE_MAX_AGE = 10 * 60 * 1000; // 10 minutes // Middleware app.use(cookieParser(COOKIE_SECRET)); app.use(express.urlencoded({ extended: true })); // Generate auth token from access code function generateToken(code) { return crypto.createHmac('sha256', COOKIE_SECRET).update(code).digest('hex'); } // Verify auth token function verifyToken(token) { if (!ACCESS_CODE) return false; const expected = generateToken(ACCESS_CODE); return token === expected; } // Sanitize redirect URL to prevent open redirect attacks function sanitizeRedirect(url) { // Must start with / but not // (protocol-relative URLs) if (url && typeof url === 'string' && url.startsWith('/') && !url.startsWith('//')) { return url; } return '/'; } // Store a redirect URL server-side and return a nonce for form submission function storeRedirect(redirectUrl) { const nonce = crypto.randomBytes(16).toString('hex'); const safeUrl = sanitizeRedirect(redirectUrl); pendingRedirects.set(nonce, { url: safeUrl, expires: Date.now() + NONCE_MAX_AGE }); // Clean up expired nonces for (const [key, value] of pendingRedirects) { if (Date.now() > value.expires) { pendingRedirects.delete(key); } } return nonce; } // Retrieve and consume a stored redirect URL by nonce function consumeRedirect(nonce) { if (!nonce || typeof nonce !== 'string') return '/'; const entry = pendingRedirects.get(nonce); if (entry && Date.now() <= entry.expires) { pendingRedirects.delete(nonce); return entry.url; } return '/'; } // HTML-escape a string to prevent XSS function escapeHtml(str) { return str .replace(/&/g, '&') .replace(/"/g, '"') .replace(/'/g, ''') .replace(//g, '>'); } // Login page HTML - uses nonce (not redirect URL) in form to prevent open redirect function getLoginPage(nonce) { const safeNonce = escapeHtml(nonce); return ` GAIA SDK Documentation - Access Required

GAIA SDK Documentation

This documentation is access-restricted. Please enter the access code to continue.

`; } // Health check endpoint (must be before auth middleware) app.get('/health', (req, res) => { res.status(200).json({ status: 'ok', auth: AUTH_ENABLED, target: MINTLIFY_URL }); }); // Auth middleware function authMiddleware(req, res, next) { // Skip auth if disabled if (!AUTH_ENABLED) { return next(); } // Skip auth for login/logout routes and health check if (req.path.startsWith('/auth/') || req.path === '/health') { return next(); } // Check for valid auth cookie const token = req.signedCookies[COOKIE_NAME]; if (token && verifyToken(token)) { return next(); } // Store redirect URL server-side and use nonce in form const originalUrl = req.originalUrl || req.url || '/'; const nonce = storeRedirect(originalUrl); res.status(401).send(getLoginPage(nonce).replace('{{ERROR}}', '')); } // Rate limit login attempts const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, // 15 minutes max: 10, // limit each IP to 10 login attempts per windowMs message: 'Too many login attempts. Please try again later.', standardHeaders: true, legacyHeaders: false, }); // General per-IP rate limiter for all auth endpoints (not just /login). // Defined here so it can be applied to every auth route below, closing the // "missing rate-limiting" CodeQL alert on /auth/logout and // /auth/login-error which would otherwise accept unlimited requests. const rateLimitStore = new Map(); const RATE_LIMIT_WINDOW = 60 * 1000; // 1 minute const RATE_LIMIT_MAX = 100; // max requests per window per IP function rateLimiter(req, res, next) { const ip = req.ip || req.connection.remoteAddress; const now = Date.now(); const record = rateLimitStore.get(ip) || { count: 0, resetAt: now + RATE_LIMIT_WINDOW }; if (now > record.resetAt) { record.count = 0; record.resetAt = now + RATE_LIMIT_WINDOW; } record.count++; rateLimitStore.set(ip, record); if (record.count > RATE_LIMIT_MAX) { return res.status(429).send('Too Many Requests'); } next(); } // Login handler app.post('/auth/login', loginLimiter, rateLimiter, (req, res) => { const { code, nonce } = req.body; if (code === ACCESS_CODE) { // Set signed cookie const token = generateToken(code); res.cookie(COOKIE_NAME, token, { signed: true, httpOnly: true, secure: process.env.NODE_ENV === 'production', maxAge: COOKIE_MAX_AGE, sameSite: 'lax' }); // Server-side redirect target. Instead of validating the user-supplied // pathname and forwarding it (which CodeQL's // js/server-side-unvalidated-url-redirection analyzer can't prove safe), // we maintain an explicit allowlist of post-login destinations and // round-trip the incoming pathname through it. Anything that doesn't // exactly match a known-safe path falls back to '/'. const ALLOWED_POST_LOGIN_PATHS = new Set([ '/', '/index.html', ]); const target = consumeRedirect(nonce); const parsed = url.parse(target || ''); const pathname = parsed.pathname || '/'; // Block open-redirects and traversal before the allowlist check. const structurallySafe = !parsed.host && !parsed.protocol && pathname.startsWith('/') && !pathname.startsWith('//') && !pathname.split('/').includes('..'); const resolvedPath = structurallySafe && ALLOWED_POST_LOGIN_PATHS.has(pathname) ? pathname : '/'; res.redirect(303, resolvedPath); } else { // Retrieve the original redirect URL and re-store with a new nonce for retry const originalRedirect = consumeRedirect(nonce); const newNonce = storeRedirect(originalRedirect); res.redirect(`/auth/login-error?nonce=${newNonce}`); } }); // Login error handler (uses nonce to retrieve redirect URL) app.get('/auth/login-error', rateLimiter, (req, res) => { // Retrieve redirect URL from server-side storage and re-store for the form const originalRedirect = consumeRedirect(req.query.nonce); const newNonce = storeRedirect(originalRedirect); const errorHtml = '

Invalid access code. Please try again.

'; res.status(401).send(getLoginPage(newNonce).replace('{{ERROR}}', errorHtml)); }); // Logout handler app.get('/auth/logout', rateLimiter, (req, res) => { res.clearCookie(COOKIE_NAME); res.redirect('/'); }); // Apply rate limiter before auth middleware for every other route app.use(rateLimiter); // Apply auth middleware app.use(authMiddleware); // Proxy to Mintlify site (after auth) const proxyMiddleware = createProxyMiddleware({ target: MINTLIFY_URL, changeOrigin: true, secure: true, // Don't modify the path pathRewrite: null, // Handle proxy errors on: { error: (err, req, res) => { console.error('Proxy error:', err.message); res.status(502).send('Documentation temporarily unavailable. Please try again later.'); }, proxyReq: (proxyReq, req, res) => { // Remove cookies from proxied request (Mintlify doesn't need our auth cookies) proxyReq.removeHeader('cookie'); } } }); app.use('/', proxyMiddleware); // Start server app.listen(PORT, () => { console.log(`GAIA Docs Proxy running on port ${PORT}`); console.log(`Proxying to: ${MINTLIFY_URL}`); console.log(`Auth protection: ${AUTH_ENABLED ? 'ENABLED' : 'DISABLED'}`); if (AUTH_ENABLED && !ACCESS_CODE) { console.warn('WARNING: Auth is enabled but DOCS_ACCESS_CODE is not set!'); } });

​Telegram Adapter

Telegram Adapter