APIs for AI Apps: REST, Server-Sent Events, WebSockets, and Authentication

event: token
data: {"text":"Hel"}
 
event: token
data: {"text":"lo"}
 
event: done
data: {}
 

/** Format one Server-Sent Event. Data is JSON-encoded, so it never contains a raw newline. */
export function sseEvent(event: string, data: unknown): string {
  return `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
}
 
export const SSE_HEADERS = {
  "Content-Type": "text/event-stream; charset=utf-8",
  "Cache-Control": "no-cache, no-transform",
  "X-Accel-Buffering": "no", // ask nginx-style proxies not to buffer the stream
} as const;

import { SSE_HEADERS, sseEvent } from "../../../lib/sse";
 
export async function GET(request: Request) {
  const encoder = new TextEncoder();
 
  const stream = new ReadableStream<Uint8Array>({
    async start(controller) {
      for (let n = 5; n > 0; n--) {
        if (request.signal.aborted) return controller.close(); // the client disconnected
        controller.enqueue(encoder.encode(sseEvent("tick", { n })));
        await new Promise((resolve) => setTimeout(resolve, 500));
      }
      controller.enqueue(encoder.encode(sseEvent("done", {})));
      controller.close();
    },
  });
 
  return new Response(stream, { headers: SSE_HEADERS });
}

export interface SSEMessage {
  event: string;
  data: string;
}
 
/** Parse a text/event-stream response body into events (handles chunks split mid-event). */
export async function* readSSE(response: Response): AsyncGenerator<SSEMessage> {
  if (!response.ok || !response.body) throw new Error(`Stream failed with HTTP ${response.status}`);
  const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
  let buffer = "";
 
  while (true) {
    const { value, done } = await reader.read();
    if (done) return;
    buffer += value.replace(/\r\n/g, "\n");
 
    let boundary = buffer.indexOf("\n\n");
    while (boundary !== -1) {
      const raw = buffer.slice(0, boundary);
      buffer = buffer.slice(boundary + 2);
      boundary = buffer.indexOf("\n\n");
 
      let event = "message";
      const data: string[] = [];
      for (const line of raw.split("\n")) {
        if (line.startsWith(":")) continue; // comment, often used as a keep-alive heartbeat
        if (line.startsWith("event:")) event = line.slice(6).trim();
        else if (line.startsWith("data:")) data.push(line.slice(5).replace(/^ /, ""));
      }
      if (data.length > 0) yield { event, data: data.join("\n") };
    }
  }
}

import { readSSE } from "./lib/read-sse.ts";
 
// Run your Next.js dev server first, then: node try-countdown.ts
const response = await fetch("http://localhost:3000/api/countdown");
for await (const message of readSSE(response)) {
  console.log(message.event, JSON.parse(message.data));
  if (message.event === "done") break;
}

import { createHmac, timingSafeEqual } from "node:crypto";
import { cookies } from "next/headers";
 
const COOKIE = "session";
const MAX_AGE = 60 * 60 * 24 * 7; // 7 days
 
function secret(): string {
  const value = process.env.SESSION_SECRET;
  if (!value || value.length < 32) throw new Error("SESSION_SECRET must be set to at least 32 random characters");
  return value;
}
 
const sign = (payload: string) => createHmac("sha256", secret()).update(payload).digest("base64url");
 
export function createSessionToken(userId: string): string {
  const payload = Buffer.from(JSON.stringify({ sub: userId, exp: Math.floor(Date.now() / 1000) + MAX_AGE })).toString("base64url");
  return `${payload}.${sign(payload)}`;
}
 
export function verifySessionToken(token: string | undefined): string | null {
  if (!token) return null;
  const [payload, signature] = token.split(".");
  if (!payload || !signature) return null;
  const expected = Buffer.from(sign(payload));
  const actual = Buffer.from(signature);
  // Constant-time comparison, so timing does not reveal how much of the signature matched.
  if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) return null;
  const { sub, exp } = JSON.parse(Buffer.from(payload, "base64url").toString()) as { sub: string; exp: number };
  return exp > Date.now() / 1000 ? sub : null;
}
 
export async function setSession(userId: string) {
  (await cookies()).set(COOKIE, createSessionToken(userId), {
    httpOnly: true, // JavaScript in the page cannot read it
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax", // not sent on cross-site POSTs, which blocks most CSRF
    path: "/",
    maxAge: MAX_AGE,
  });
}
 
export async function getUserId(): Promise<string | null> {
  return verifySessionToken((await cookies()).get(COOKIE)?.value);
}

import { getUserId } from "../../../lib/session";
 
export async function GET() {
  const userId = await getUserId();
  if (!userId) return Response.json({ error: "Not signed in" }, { status: 401 });
  return Response.json({ userId });
}