starr-philproperties/apps/api/middleware/mediaGuard.middleware.js

/***********************************************************************************************************************************************************************
 * File Name: mediaGuard.middleware.js
 * Type of Program: Middleware
 * Description: Blocks non-browser clients from accessing protected media stream endpoints.
 *              Checks:
 *                1. User-Agent blocklist  — cURL, wget, python, httpie, etc.
 *                2. Origin / Referer      — must be present (browser always sends at least one)
 *                3. Allowed origin        — must match APP_ORIGIN env (prevents hotlinking)
 * Author: rgrgogu
 * Date Created: Jun. 12, 2026
 ***********************************************************************************************************************************************************************/
"use strict";

const R = require("../utils/response.util");

const UA_BLOCKLIST = [
  "curl", "wget", "python-requests", "python-urllib",
  "axios", "httpie", "insomnia", "postman", "thunder client",
  "go-http-client", "java/", "ruby", "php/", "perl/",
];

const APP_ORIGIN = process.env.FRONTEND_URL ?? "http://localhost:5173";

module.exports = function mediaGuard(req, res, next) {
  const ua       = (req.headers["user-agent"] ?? "").toLowerCase();
  const origin   = req.headers["origin"]  ?? "";
  const referer  = req.headers["referer"] ?? "";

  // ── 1. Block known non-browser user-agents ────────────────────────────────
  if (UA_BLOCKLIST.some((b) => ua.includes(b))) {
    return R.error(res, "Forbidden.", 403);
  }

  // ── 2. No UA at all → almost certainly a script ──────────────────────────
  if (!ua) {
    return R.error(res, "Forbidden.", 403);
  }

  // ── 3. Must have at least Origin or Referer (browsers always send one) ───
  if (!origin && !referer) {
    return R.error(res, "Forbidden.", 403);
  }

  // ── 4. Origin must match app origin (blocks hotlinking from other sites) ─
  if (origin && origin !== APP_ORIGIN) {
    return R.error(res, "Forbidden.", 403);
  }

  next();
};