gated

Co-authored-by: Copilot <copilot@github.com>

server.js

@@ -0,0 +1,73 @@
+import express from 'express';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import dotenv from 'dotenv';
+
+dotenv.config();
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const app = express();
+app.use(express.json());
+
+// Serve static frontend files from Vite build
+app.use(express.static(path.join(__dirname, 'dist')));
+
+// Secure credentials from environment variables, or fallback to defaults
+const VALID_USER = process.env.APP_USERNAME || 'admin';
+const VALID_PASS = process.env.APP_PASSWORD || 'souschef';
+const GEMINI_API_KEY = process.env.VITE_GEMINI_API_KEY || process.env.GEMINI_API_KEY;
+
+app.post('/api/login', (req, res) => {
+  const { username, password } = req.body;
+  if (username === VALID_USER && password === VALID_PASS) {
+    res.json({ success: true });
+  } else {
+    res.status(401).json({ error: 'Invalid credentials' });
+  }
+});
+
+app.post('/api/generate', async (req, res) => {
+  const { username, password, userPrompt, systemPrompt } = req.body;
+
+  if (username !== VALID_USER || password !== VALID_PASS) {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+
+  if (!GEMINI_API_KEY) {
+    return res.status(500).json({ error: 'API key not configured on server' });
+  }
+
+  try {
+    const resp = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${GEMINI_API_KEY}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        systemInstruction: { parts: [{ text: systemPrompt }] },
+        contents: [{ parts: [{ text: userPrompt }] }],
+        generationConfig: { responseMimeType: "application/json" }
+      })
+    });
+
+    const data = await resp.json();
+
+    if (!resp.ok) {
+      throw new Error(data.error?.message || `API error ${resp.status}`);
+    }
+
+    res.json(data);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// For any other route, send the frontend
+app.get('*', (req, res) => {
+  res.sendFile(path.join(__dirname, 'dist', 'index.html'));
+});
+
+const PORT = process.env.PORT || 80;
+app.listen(PORT, () => {
+  console.log(`Secure proxy server running on port ${PORT}`);
+});