api-server.ts

#!/usr/bin/env bun
/**
 * api-server.ts
 * HTTP API server for Sora 2 video generation with authentication
 *
 * Usage:
 *   AUTH_TOKEN=your-secret-token bun run api-server.ts
 *
 * Environment variables:
 *   OPENAI_API_KEY=sk-...
 *   AUTH_TOKEN=your-auth-token
 *   PORT=3000 (optional, defaults to 3000)
 */

import path from "node:path";
import fs from "node:fs/promises";

interface VideoRequest {
  prompt: string;
  duration?: number;
  orientation?: "portrait" | "landscape";
  image?: string; // base64 encoded image
  seed?: number;
  model?: string;
}

interface VideoJob {
  id: string;
  status: "queued" | "processing" | "completed" | "failed";
  progress?: number;
  videoUrl?: string;
  error?: string;
  createdAt: Date;
  completedAt?: Date;
  request: VideoRequest;
}

// In-memory job storage (in production, use a database)
const jobs = new Map<string, VideoJob>();

// Configuration
const API_KEY = process.env.OPENAI_API_KEY;
const AUTH_TOKEN = process.env.AUTH_TOKEN || "default-token-change-me";
const PORT = process.env.PORT || 3000;

if (!API_KEY) {
  console.error("❌ Missing OPENAI_API_KEY in environment.");
  process.exit(1);
}

if (AUTH_TOKEN === "default-token-change-me") {
  console.warn("⚠️  Using default AUTH_TOKEN. Set a secure token in production!");
}

// Helper functions
function validateAuthToken(req: Request): boolean {
  const authHeader = req.headers.get("Authorization");
  if (!authHeader || !authHeader.startsWith("Bearer ")) {
    return false;
  }
  const token = authHeader.slice(7);
  return token === AUTH_TOKEN;
}

function generateJobId(): string {
  return `job_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
}

async function createSoraVideo(jobId: string, request: VideoRequest) {
  const job = jobs.get(jobId)!;

  try {
    // Update job status
    job.status = "processing";
    job.progress = 0;

    // Map parameters
    const orientation = (request.orientation || "landscape").toLowerCase();
    const size = orientation === "portrait" ? "720x1280" : "1280x720";
    const duration = request.duration || 8;
    const seconds = duration.toString();
    const model = request.model || "sora-2";

    // Build payload
    const payload: Record<string, unknown> = {
      model,
      prompt: request.prompt,
      size,
      seconds,
    };

    if (request.seed !== undefined) {
      payload.seed = request.seed;
    }

    if (request.image) {
      payload.input_reference = request.image;
    }

    // Create video job with OpenAI
    const createRes = await fetch("https://api.openai.com/v1/videos", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify(payload),
    });

    if (!createRes.ok) {
      throw new Error(`OpenAI API error: ${await createRes.text()}`);
    }

    const created = await createRes.json() as any;
    const openaiJobId = created.id || created.video_id;

    if (!openaiJobId) {
      throw new Error("No job ID returned from OpenAI");
    }

    // Poll for completion
    while (true) {
      const statusRes = await fetch(`https://api.openai.com/v1/videos/${openaiJobId}`, {
        headers: { Authorization: `Bearer ${API_KEY}` },
      });

      if (!statusRes.ok) {
        throw new Error(`Failed to check status: ${await statusRes.text()}`);
      }

      const state = await statusRes.json() as any;
      const status = state.status;

      // Update progress
      if (typeof state.progress === "number") {
        job.progress = state.progress;
      }

      // Check for completion
      if (["completed", "succeeded", "complete"].includes(status)) {
        // Get video content
        const contentRes = await fetch(`https://api.openai.com/v1/videos/${openaiJobId}/content`, {
          headers: { Authorization: `Bearer ${API_KEY}` },
        });

        if (contentRes.ok) {
          // Save video to output directory
          const outdir = path.resolve(process.cwd(), "out");
          await fs.mkdir(outdir, { recursive: true });

          const videoPath = path.join(outdir, `${jobId}.mp4`);
          await Bun.write(videoPath, contentRes);

          job.videoUrl = `/videos/${jobId}.mp4`;
          job.status = "completed";
          job.completedAt = new Date();
          job.progress = 100;
        } else {
          throw new Error("Failed to download video content");
        }
        break;
      }

      // Check for failure
      if (["failed", "error", "cancelled", "canceled"].includes(status)) {
        throw new Error(state.error?.message || "Video generation failed");
      }

      // Wait before next poll
      await Bun.sleep(5000);
    }
  } catch (error: any) {
    job.status = "failed";
    job.error = error.message;
    job.completedAt = new Date();
  }
}

// API Routes
Bun.serve({
  port: PORT,
  async fetch(req: Request) {
    const url = new URL(req.url);
    const method = req.method;
    const path = url.pathname;

    // CORS headers
    const corsHeaders = {
      "Access-Control-Allow-Origin": "*",
      "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
      "Access-Control-Allow-Headers": "Content-Type, Authorization",
    };

    // Handle preflight
    if (method === "OPTIONS") {
      return new Response(null, { status: 204, headers: corsHeaders });
    }

    // Health check (no auth required)
    if (path === "/health" && method === "GET") {
      return Response.json({ status: "ok", timestamp: new Date() }, {
        headers: corsHeaders,
      });
    }

    // All other endpoints require authentication
    if (!validateAuthToken(req)) {
      return Response.json(
        { error: "Unauthorized. Include 'Authorization: Bearer <token>' header" },
        { status: 401, headers: corsHeaders }
      );
    }

    // POST /api/videos - Create a new video generation job
    if (path === "/api/videos" && method === "POST") {
      try {
        const body = await req.json() as VideoRequest;

        // Validate required fields
        if (!body.prompt) {
          return Response.json(
            { error: "Missing required field: prompt" },
            { status: 400, headers: corsHeaders }
          );
        }

        // Validate duration
        if (body.duration && ![4, 8, 12].includes(body.duration)) {
          return Response.json(
            { error: "Duration must be 4, 8, or 12 seconds" },
            { status: 400, headers: corsHeaders }
          );
        }

        // Create job
        const jobId = generateJobId();
        const job: VideoJob = {
          id: jobId,
          status: "queued",
          createdAt: new Date(),
          request: body,
        };
        jobs.set(jobId, job);

        // Start async video generation
        createSoraVideo(jobId, body);

        return Response.json(
          {
            jobId,
            status: "queued",
            message: "Video generation started",
          },
          { status: 202, headers: corsHeaders }
        );
      } catch (error: any) {
        return Response.json(
          { error: error.message || "Invalid request" },
          { status: 400, headers: corsHeaders }
        );
      }
    }

    // GET /api/videos/:id - Get job status
    if (path.startsWith("/api/videos/") && method === "GET") {
      const jobId = path.slice(12);
      const job = jobs.get(jobId);

      if (!job) {
        return Response.json(
          { error: "Job not found" },
          { status: 404, headers: corsHeaders }
        );
      }

      return Response.json(
        {
          id: job.id,
          status: job.status,
          progress: job.progress,
          videoUrl: job.videoUrl,
          error: job.error,
          createdAt: job.createdAt,
          completedAt: job.completedAt,
          request: job.request,
        },
        { headers: corsHeaders }
      );
    }

    // GET /api/videos - List all jobs
    if (path === "/api/videos" && method === "GET") {
      const jobList = Array.from(jobs.values()).map(job => ({
        id: job.id,
        status: job.status,
        progress: job.progress,
        createdAt: job.createdAt,
        completedAt: job.completedAt,
        prompt: job.request.prompt,
      }));

      return Response.json(
        {
          jobs: jobList,
          total: jobList.length,
        },
        { headers: corsHeaders }
      );
    }

    // GET /videos/:filename - Serve video files
    if (path.startsWith("/videos/") && method === "GET") {
      const filename = path.slice(8);
      const videoPath = path.join(process.cwd(), "out", filename);

      try {
        const file = Bun.file(videoPath);
        if (await file.exists()) {
          return new Response(file, {
            headers: {
              ...corsHeaders,
              "Content-Type": "video/mp4",
              "Content-Disposition": `inline; filename="${filename}"`,
            },
          });
        }
      } catch (error) {
        // File not found
      }

      return Response.json(
        { error: "Video not found" },
        { status: 404, headers: corsHeaders }
      );
    }

    // DELETE /api/videos/:id - Cancel/delete a job
    if (path.startsWith("/api/videos/") && method === "DELETE") {
      const jobId = path.slice(12);
      const job = jobs.get(jobId);

      if (!job) {
        return Response.json(
          { error: "Job not found" },
          { status: 404, headers: corsHeaders }
        );
      }

      // Delete video file if it exists
      if (job.videoUrl) {
        const videoPath = path.join(process.cwd(), "out", `${jobId}.mp4`);
        try {
          await fs.unlink(videoPath);
        } catch (error) {
          // File might not exist
        }
      }

      jobs.delete(jobId);

      return Response.json(
        { message: "Job deleted successfully" },
        { headers: corsHeaders }
      );
    }

    // 404 for unknown routes
    return Response.json(
      { error: "Not found" },
      { status: 404, headers: corsHeaders }
    );
  },
});

console.log(`
🚀 Sora 2 API Server running on http://localhost:${PORT}

Authentication: Bearer ${AUTH_TOKEN.slice(0, 8)}...

Endpoints:
  GET    /health                 - Health check (no auth)
  POST   /api/videos             - Create video generation job
  GET    /api/videos/:id         - Get job status
  GET    /api/videos             - List all jobs
  DELETE /api/videos/:id         - Delete job
  GET    /videos/:filename.mp4   - Download video

Example:
  curl -X POST http://localhost:${PORT}/api/videos \\
    -H "Authorization: Bearer ${AUTH_TOKEN}" \\
    -H "Content-Type: application/json" \\
    -d '{"prompt": "A beautiful sunset over the ocean"}'
`);