KI-Chatbot mit Google Gemini

// Einfacher In-Memory Store für Rate-Limiting (wird bei Neustarts zurückgesetzt)
let requestStore = {};

export default {
  async fetch(request, env) {
    // CORS Preflight-Anfrage (OPTIONS) behandeln
    if (request.method === 'OPTIONS') {
      return handleOptions(request, env);
    }

    // Origin-Check 
    // Erlaubte Domains aus Environment Variables lesen
    const allowedOrigins = env.ALLOWED_ORIGINS ? env.ALLOWED_ORIGINS.split(',').map(o => o.trim()) : [];
    
    const origin = request.headers.get('Origin');
    
    // Prüfe ob Origin erlaubt ist (nur wenn Origins konfiguriert sind)
    if (origin && allowedOrigins.length > 0 && !allowedOrigins.includes(origin)) {
      return new Response('Unerlaubte Herkunft', { 
        status: 403,
        headers: getCorsHeaders(env, origin, allowedOrigins)
      });
    }

    // Nur POST-Anfragen für die Chat-Logik erlauben
    if (request.method !== 'POST') {
      return new Response('Methode nicht erlaubt', { 
        status: 405,
        headers: getCorsHeaders(env, origin, allowedOrigins)
      });
    }

    // Einfaches Rate-Limiting ohne KV
    const clientIP = request.headers.get('CF-Connecting-IP') || 'unknown';
    const now = Date.now();
    
    // Bereinige alte Einträge (älter als 1 Minute)
    for (const [ip, data] of Object.entries(requestStore)) {
      if (now - data.timestamp > 60000) {
        delete requestStore[ip];
      }
    }
    
    // Zähle Anfragen dieser IP in den letzten 60 Sekunden
    let requestCount = 0;
    for (const [ip, data] of Object.entries(requestStore)) {
      if (ip === clientIP && now - data.timestamp < 60000) {
        requestCount += data.count;
      }
    }
    
    // Prüfe das Limit (20 Anfragen pro Minute)
    if (requestCount >= 20) {
      return new Response(JSON.stringify({ 
        error: 'Rate limit exceeded. Bitte versuche es in einer Minute erneut.' 
      }), {
        status: 429,
        headers: { 
          'Content-Type': 'application/json', 
          ...getCorsHeaders(env, origin, allowedOrigins) 
        },
      });
    }
    
    // Speichere diese Anfrage
    if (!requestStore[clientIP]) {
      requestStore[clientIP] = { count: 1, timestamp: now };
    } else {
      requestStore[clientIP].count += 1;
      requestStore[clientIP].timestamp = now;
    }

    // Hauptlogik für die Chat-Nachricht
    try {
      const { message } = await request.json();
      if (!message) {
        return new Response(JSON.stringify({ error: 'Nachricht fehlt im Body' }), {
          status: 400,
          headers: { 
            'Content-Type': 'application/json', 
            ...getCorsHeaders(env, origin, allowedOrigins) 
          },
        });
      }

      const googleApiUrl = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${env.GEMINI_API_KEY}`;
      
      const apiResponse = await fetch(googleApiUrl, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
          contents: [{ parts: [{ text: message }] }],
        }),
      });

      if (!apiResponse.ok) {
        const errorData = await apiResponse.json();
        return new Response(JSON.stringify({ error: `Fehler von der Google API: ${errorData.error?.message || 'Unbekannter Fehler'}` }), {
          status: apiResponse.status,
          headers: { 
            'Content-Type': 'application/json', 
            ...getCorsHeaders(env, origin, allowedOrigins) 
          },
        });
      }

      const apiData = await apiResponse.json();
      
      if (!apiData.candidates || apiData.candidates.length === 0) {
        const blockReason = apiData.promptFeedback?.blockReason || 'Unbekannter Grund';
        return new Response(JSON.stringify({ reply: `Ich kann darauf leider nicht antworten. Grund: ${blockReason}` }), {
            headers: { 
              'Content-Type': 'application/json', 
              ...getCorsHeaders(env, origin, allowedOrigins) 
            },
        });
      }

      const botReply = apiData.candidates[0].content.parts[0].text;
      
      return new Response(JSON.stringify({ reply: botReply }), {
        headers: { 
          'Content-Type': 'application/json', 
          ...getCorsHeaders(env, origin, allowedOrigins) 
        },
      });

    } catch (error) {
      return new Response(JSON.stringify({ error: 'Ein interner Fehler im Worker ist aufgetreten.' }), {
        status: 500,
        headers: { 
          'Content-Type': 'application/json', 
          ...getCorsHeaders(env, origin, allowedOrigins) 
        },
      });
    }
  },
};

function getCorsHeaders(env, origin, allowedOrigins = null) {
  if (!allowedOrigins) {
    allowedOrigins = env.ALLOWED_ORIGINS ? env.ALLOWED_ORIGINS.split(',').map(o => o.trim()) : [];
  }
  
  // Wenn keine Origins konfiguriert sind, erlaube alle (nur für Entwicklung!)
  if (allowedOrigins.length === 0) {
    return {
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'POST, OPTIONS',
      'Access-Control-Allow-Headers': 'Content-Type',
    };
  }
  
  // Prüfe ob die anfragende Origin erlaubt ist
  const allowOrigin = origin && allowedOrigins.includes(origin) ? origin : allowedOrigins[0];
  
  return {
    'Access-Control-Allow-Origin': allowOrigin,
    'Access-Control-Allow-Methods': 'POST, OPTIONS',
    'Access-Control-Allow-Headers': 'Content-Type',
  };
}

function handleOptions(request, env) {
  const origin = request.headers.get('Origin');
  const allowedOrigins = env.ALLOWED_ORIGINS ? env.ALLOWED_ORIGINS.split(',').map(o => o.trim()) : [];
  
  if (
    origin &&
    request.headers.get('Access-Control-Request-Method') !== null &&
    request.headers.get('Access-Control-Request-Headers') !== null
  ) {
    return new Response(null, { 
      headers: getCorsHeaders(env, origin, allowedOrigins) 
    });
  } else {
    return new Response(null, { 
      headers: { 
        'Allow': 'POST, OPTIONS',
        ...getCorsHeaders(env, origin, allowedOrigins)
      } 
    });
  }
}