security: add api key auth middleware and ssrf protection

src/routes/scrape.ts

@@ -1,11 +1,14 @@
 import { Router, Request, Response } from "express";
 import { extractNavLinks } from "../services/scraper";
+import { checkApiKey } from "../middlewares/auth";
+import { isSafeUrl } from "../utils/ssrf";
 
 export const scrapeRoute = Router();
 
 /**
  * POST /scrape
  * Body: { "url": "https://firma.com" }
+ * Headers: x-api-key: <API_KEY> (or Authorization: Bearer <API_KEY>)
  *
  * Response:
  * {
@@ -17,7 +20,7 @@ export const scrapeRoute = Router();
  *   ]
  * }
  */
-scrapeRoute.post("/", async (req: Request, res: Response) => {
+scrapeRoute.post("/", checkApiKey, async (req: Request, res: Response) => {
   const { url } = req.body as { url?: string };
 
   if (!url) {
@@ -25,10 +28,18 @@ scrapeRoute.post("/", async (req: Request, res: Response) => {
   }
 
   // Basit URL validasyonu
-  try { new URL(url); } catch {
+  try { 
+    new URL(url); 
+  } catch {
     return res.status(400).json({ error: "Geçersiz URL formatı" });
   }
 
+  // SSRF Koruması & Yerel Ağ Engellemesi
+  const safe = await isSafeUrl(url);
+  if (!safe) {
+    return res.status(400).json({ error: "Güvensiz veya geçersiz hedef URL." });
+  }
+
   try {
     const links = await extractNavLinks(url);
 
@@ -44,3 +55,4 @@ scrapeRoute.post("/", async (req: Request, res: Response) => {
     });
   }
 });
+