server.js

const { createServer } = require('http')
const { parse } = require('url')
const path = require('path')
const next = require('next')
const WebSocket = require('ws')
const { createClient: createDgClient } = require('@deepgram/sdk')
const {
  verifySessionGrant,
  buildDeepgramListenUrl,
  MAX_BUFFERED_FRAMES,
} = require('./lib/security/sessionGrantCompat.cjs')

const dev = process.env.NODE_ENV !== 'production'
const hostname = 'localhost'
const port = parseInt(process.env.PORT || '3000', 10)

const app = next({ dev, hostname, port })
const handle = app.getRequestHandler()

app.prepare().then(async () => {
  const server = createServer((req, res) => {
    const parsed = parse(req.url, true)
    handle(req, res, parsed)
  })

  const wss = new WebSocket.Server({ noServer: true })

  let nextUpgradeHandler = null
  if (typeof app.getUpgradeHandler === 'function') {
    nextUpgradeHandler = await app.getUpgradeHandler()
  }

  server.on('upgrade', (req, socket, head) => {
    const { pathname, query } = parse(req.url, true)

    if (pathname !== '/api/deepgram/proxy') {
      if (nextUpgradeHandler) {
        nextUpgradeHandler(req, socket, head)
      } else {
        socket.destroy()
      }
      return
    }

    const session = (query && query.session) || req.headers['x-ms-session']
    const sessionCheck = verifySessionGrant(session, 'deepgram')
    if (!sessionCheck.ok) {
      socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n')
      socket.destroy()
      return
    }

    wss.handleUpgrade(req, socket, head, async (browserWs) => {
      const apiKey = process.env.DEEPGRAM_API_KEY

      if (!apiKey) {
        console.error('[deepgram proxy] DEEPGRAM_API_KEY not configured')
        browserWs.close(1011, 'DEEPGRAM_API_KEY not configured')
        return
      }

      let wsToken = apiKey
      try {
        const dgClient = createDgClient(apiKey)
        const { result, error } = await dgClient.auth.grantToken()
        if (!error && result?.access_token) {
          wsToken = result.access_token
        } else {
          console.warn('[deepgram proxy] grantToken failed, falling back to raw key')
        }
      } catch (e) {
        console.warn('[deepgram proxy] grantToken threw:', e.message)
      }

      const dgUrl = buildDeepgramListenUrl(req.url)
      console.log('[deepgram proxy] opening upstream:', dgUrl.replace(/\?.*/, '?...'))

      const dgWs = new WebSocket(dgUrl, {
        headers: { Authorization: `Token ${wsToken}` },
      })

      const bufferedMessages = []
      let isDgOpen = false

      browserWs.on('message', (data) => {
        if (isDgOpen && dgWs.readyState === WebSocket.OPEN) {
          dgWs.send(data)
        } else if (bufferedMessages.length < MAX_BUFFERED_FRAMES) {
          bufferedMessages.push(data)
        } else {
          browserWs.close(1008, 'buffer overflow')
          dgWs.close()
        }
      })

      dgWs.on('open', () => {
        console.log('[deepgram proxy] upstream connected')
        isDgOpen = true
        while (bufferedMessages.length > 0) {
          const msg = bufferedMessages.shift()
          if (dgWs.readyState === WebSocket.OPEN) dgWs.send(msg)
        }
      })

      dgWs.on('message', (data) => {
        if (browserWs.readyState !== WebSocket.OPEN) return
        const text = typeof data === 'string' ? data : data.toString('utf8')
        browserWs.send(text)
      })

      function cleanup() {
        if (dgWs.readyState < WebSocket.CLOSING) dgWs.close()
        if (browserWs.readyState < WebSocket.CLOSING) browserWs.close()
      }

      dgWs.on('close', cleanup)
      dgWs.on('error', (err) => {
        console.error('[deepgram proxy] upstream error:', err.message)
        cleanup()
      })

      dgWs.on('unexpected-response', (_req, res) => {
        let body = ''
        res.on('data', chunk => { body += chunk })
        res.on('end', () => {
          console.error('[deepgram proxy] upstream rejected:', res.statusCode, body.slice(0, 500))
          browserWs.close(1011, 'upstream rejected')
        })
      })

      browserWs.on('close', cleanup)
      browserWs.on('error', (err) => {
        console.error('[deepgram proxy] browser error:', err.message)
        cleanup()
      })
    })
  })

  server.on('error', (err) => {
    if (err.code === 'EADDRINUSE') {
      console.error(
        `[server] Port ${port} is already in use. Stop the other dev server (Ctrl+C) or run: Get-NetTCPConnection -LocalPort ${port} | % { Stop-Process -Id $_.OwningProcess -Force }`
      )
    } else {
      console.error('[server] listen error:', err.message)
    }
  })

  server.listen(port, () => {
    console.log(`> Ready on http://${hostname}:${port}`)
  })
})