SKILL HUB 技能治理與知識化平台架構

const EXCLUDE_PATTERNS = [
  /node_modules\//i,
  /\.env.*/i,
  /\.git\//i,
  /dist\//i,
  /build\//i,
  /venv\//i,
  /\.venv\//i,
  /tmp\//i
];

async function filterAndPack(files) {
  const zip = new JSZip();
  let totalSize = 0;

  for (const file of files) {
    const isExcluded = EXCLUDE_PATTERNS.some(regex => regex.test(file.path));
    if (isExcluded) continue; // Exclude node_modules, env keys, etc.

    totalSize += file.size;
    if (totalSize > 4 * 1024 * 1024) {
      throw new Error("封裝檔案大小超過 4 MB same-origin 安全上限，請縮減封裝或改走大型檔案上傳流程。");
    }
    zip.file(file.path, file.content);
  }
  return await zip.generateAsync({ type: "blob" });
}

async function distillSkill(skillMarkdown, retryCount = 0) {
  // Truncate to avoid timeout for exceptionally large markdown files
  const maxLines = 300;
  const lines = skillMarkdown.split('\n');
  const truncatedMarkdown = lines.slice(0, maxLines).join('\n');
  
  try {
    const response = await axios.post(
      process.env.VIBEHUB_OPENAI_COMPAT_BASE_URL + '/chat/completions',
      {
        model: 'gpt-5-mini', // Fallback model preset
        messages: [
          { role: 'system', content: 'You are an expert AI competency extractor. Extract JSON conforming to the knowledge_profile schema.' },
          { role: 'user', content: `Extract from this SKILL.md:\n\n${truncatedMarkdown}` }
        ],
        temperature: 0.1
      },
      { timeout: parseInt(process.env.AZURE_OPENAI_REQUEST_TIMEOUT_MS) || 90000 }
    );
    return JSON.parse(response.data.choices[0].message.content);
  } catch (error) {
    if (retryCount < 2) {
      console.warn(`AI Ingestion timeout/error. Retrying... (${retryCount + 1})`);
      return distillSkill(skillMarkdown, retryCount + 1);
    }
    return {
      expectedOutcomes: ["請手動填寫預期成果"],
      triggerConditions: ["請手動填寫觸發條件"],
      prerequisites: ["請手動填寫前置要求"]
    };
  }
}

export function middleware(req) {
  const sessionToken = req.cookies.get("vibehub-session")?.value;
  
  // Fail-closed protection: if Supabase variables are missing, deny request with 503
  if (!process.env.SUPABASE_URL || !process.env.SUPABASE_SERVICE_ROLE_KEY) {
    console.error("Critical Security: Supabase keys are missing. Triggering fail-closed.");
    return new Response(JSON.stringify({ error: "Service unavailable due to internal security posture." }), { status: 503 });
  }

  // Validate session path
  if (!sessionToken) {
    return new Response(JSON.stringify({ error: "Unauthorized access. Session expired." }), { status: 401 });
  }
  
  return next();
}

async function logTelemetry(req, eventData) {
  const { toolId, eventName, actorId } = eventData;

  const { data: tool } = await supabase.from("tools").select("author_id").eq("id", toolId).single();
  const { data: actor } = await supabase.from("users").select("role").eq("id", actorId).single();

  if (actorId === tool.author_id || actor.role === "admin") {
    console.log("Telemetry bypassed: self-interaction or admin audit trail.");
    return;
  }

  await supabase.from("telemetry_logs").insert({
    tool_id: toolId,
    event_name: eventName,
    actor_id: actorId,
    timestamp: new Date().toISOString()
  });
}