geoapify-mcp-server/src/middleware/auth.js

Geoapify API MCP Server for location-based services - 一键部署的地理位置服务

const { logger } = require('../utils/logger.js');

const validateApiKey = (req, res, next) => {
  // 检查API密钥
  const apiKey = req.headers['x-api-key'] || 
                 req.headers['authorization']?.replace('Bearer ', '') ||
                 req.query.apiKey ||
                 req.body.apiKey;

  // 如果配置了MCP_API_KEY，则验证客户端密钥
  if (process.env.MCP_API_KEY) {
    if (!apiKey) {
      logger.warn('Missing API key', { ip: req.ip, url: req.url });
      return res.status(401).json({
        success: false,
        error: 'Unauthorized',
        message: 'API key is required'
      });
    }

    if (apiKey !== process.env.MCP_API_KEY) {
      logger.warn('Invalid API key', { ip: req.ip, url: req.url, providedKey: apiKey?.substring(0, 8) + '...' });
      return res.status(401).json({
        success: false,
        error: 'Unauthorized',
        message: 'Invalid API key'
      });
    }
  }

  // 检查IP白名单
  if (process.env.ALLOWED_IPS) {
    const allowedIPs = process.env.ALLOWED_IPS.split(',').map(ip => ip.trim());
    const clientIP = req.ip || req.connection.remoteAddress;
    
    if (!allowedIPs.includes(clientIP) && !allowedIPs.includes('*')) {
      logger.warn('IP not allowed', { ip: clientIP, url: req.url });
      return res.status(403).json({
        success: false,
        error: 'Forbidden',
        message: 'IP address not allowed'
      });
    }
  }

  // 记录访问
  logger.info('API access', {
    ip: req.ip,
    method: req.method,
    url: req.url,
    userAgent: req.get('User-Agent')
  });

  next();
};

const optionalAuth = (req, res, next) => {
  // 可选的认证中间件，不会阻止请求
  const apiKey = req.headers['x-api-key'] || 
                 req.headers['authorization']?.replace('Bearer ', '') ||
                 req.query.apiKey ||
                 req.body.apiKey;

  if (apiKey) {
    req.authenticated = apiKey === process.env.MCP_API_KEY;
  } else {
    req.authenticated = !process.env.MCP_API_KEY; // 如果没有设置密钥要求，则认为已认证
  }

  next();
};

module.exports = { validateApiKey, optionalAuth };