feedback.js

// Vercel serverless handler that takes user feedback from the app and files
// it as a GitHub issue tagged `user-feedback`. Token is read server-side so
// it's never shipped to the browser.
//
// Hardening: same-origin enforced, 3 requests/min per IP. The browser-side
// modal renders themed copy for both the 429 and 403 cases.
//
// Env:
//   GITHUB_TOKEN     - personal access token with `repo` (or `public_repo` for
//                      public repos) scope. REQUIRED.
//   GITHUB_REPO      - "owner/repo" string. Defaults to the project repo.
//   GITHUB_LABEL     - issue label. Defaults to `user-feedback`.
//   ALLOWED_ORIGINS  - optional comma-separated origin allowlist (see _security.js).

import { enforceGate } from './_security.js';

const DEFAULT_REPO = 'JacobMitchell088/swipe-date';
const DEFAULT_LABEL = 'user-feedback';
const MAX_TITLE = 120;
const MAX_TEXT = 4000;
const RATE_LIMIT = 3;            // requests per window
const RATE_WINDOW_MS = 60_000;   // 60s — keeps drive-by spammers off the issue tracker

function clip(s, max) {
  if (typeof s !== 'string') return '';
  const t = s.trim();
  return t.length > max ? t.slice(0, max) : t;
}

async function readJsonBody(req) {
  // Vercel Node runtime usually populates req.body; the dev middleware
  // passes us a pre-parsed object on req.body too. Fall back to streaming
  // raw bytes off the request just in case.
  if (req.body && typeof req.body === 'object') return req.body;
  if (typeof req.body === 'string') {
    try { return JSON.parse(req.body); } catch { return {}; }
  }
  const chunks = [];
  for await (const chunk of req) chunks.push(chunk);
  if (!chunks.length) return {};
  try { return JSON.parse(Buffer.concat(chunks).toString('utf8')); }
  catch { return {}; }
}

export default async function handler(req, res) {
  if (req.method !== 'POST') {
    res.status(405).json({ error: 'method-not-allowed' });
    return;
  }
  if (
    !enforceGate(req, res, {
      limit: RATE_LIMIT,
      windowMs: RATE_WINDOW_MS,
      bucket: 'feedback',
    })
  ) {
    return; // enforceGate already wrote the response
  }
  // Optional honeypot: clients can include a `_hp` field; bots tend to fill
  // every form field they see. If it's non-empty we accept the 200 (so the bot
  // thinks it worked) but skip the GitHub call entirely.
  const honeypot = req.body && typeof req.body === 'object' ? req.body._hp : '';
  if (typeof honeypot === 'string' && honeypot.trim().length > 0) {
    res.status(200).json({ ok: true });
    return;
  }
  const token = process.env.GITHUB_TOKEN;
  if (!token) {
    res.status(500).json({ error: 'no-token' });
    return;
  }
  const repo = process.env.GITHUB_REPO || DEFAULT_REPO;
  const label = process.env.GITHUB_LABEL || DEFAULT_LABEL;

  const body = await readJsonBody(req);
  const rating = Number.isFinite(body.rating)
    ? Math.max(0, Math.min(5, Math.round(body.rating)))
    : 0;
  const title = clip(body.title, MAX_TITLE);
  const description = clip(body.description, MAX_TEXT);
  const contact = clip(body.contact, 200);

  // The client enforces "at least one thing entered" but defend the API
  // boundary too — empty submissions become noise in the issue tracker.
  if (!rating && !title && !description && !contact) {
    res.status(400).json({ error: 'empty' });
    return;
  }

  const stars = rating
    ? '★'.repeat(rating) + '☆'.repeat(5 - rating)
    : '— no rating —';
  const issueTitle = title
    || (rating ? `Feedback: ${rating}★` : 'User feedback');
  const lines = [
    `**Rating:** ${stars}${rating ? ` (${rating}/5)` : ''}`,
    '',
  ];
  if (description) {
    lines.push('**Feedback**', '', description, '');
  }
  if (contact) {
    lines.push(`**Contact:** ${contact}`);
  }
  lines.push('', '_submitted via in-app feedback button_');

  try {
    const upstream = await fetch(
      `https://api.github.com/repos/${repo}/issues`,
      {
        method: 'POST',
        headers: {
          Authorization: `Bearer ${token}`,
          Accept: 'application/vnd.github+json',
          'X-GitHub-Api-Version': '2022-11-28',
          'User-Agent': 'swipe-date-feedback',
          'Content-Type': 'application/json',
        },
        body: JSON.stringify({
          title: issueTitle,
          body: lines.join('\n'),
          labels: [label],
        }),
      },
    );
    const text = await upstream.text();
    if (!upstream.ok) {
      res.status(upstream.status).json({
        error: `github-${upstream.status}`,
        detail: text.slice(0, 500),
      });
      return;
    }
    const data = JSON.parse(text);
    res.status(200).json({ ok: true, url: data.html_url, number: data.number });
  } catch (err) {
    res.status(502).json({ error: 'network', detail: String(err) });
  }
}