Access & keys

// server.js — Node 18+, Express
import express from 'express';

const app = express();
const API = 'https://api.offendersearch.app';
// Only the map read routes are passed through.
const READ = /^\/(viewport|groups\/[^/]+|records\/[^/]+)$/;

app.use('/v1/map', express.json(), async (req, res) => {
  const isRead = req.method === 'GET' && READ.test(req.path);
  const isArea = req.method === 'POST' && req.path === '/area';
  if (!isRead && !isArea) return res.sendStatus(404);
  // Check here that the caller is signed in to YOUR app.

  const headers = { 'X-API-Key': process.env.OFFENDERSEARCH_KEY };
  const etag = req.get('If-None-Match');
  if (etag) headers['If-None-Match'] = etag;
  // Optional: your own id for the signed-in user.
  if (req.user) headers['X-End-User'] = String(req.user.id);
  const init = { method: req.method, headers };
  if (isArea) {
    headers['Content-Type'] = 'application/json';
    init.body = JSON.stringify(req.body);
  }

  const query = req.originalUrl.split('?')[1];
  const url = API + '/v1/map' + req.path + (query ? '?' + query : '');
  const upstream = await fetch(url, init);

  res.status(upstream.status);
  for (const name of ['content-type', 'etag', 'cache-control', 'retry-after']) {
    const value = upstream.headers.get(name);
    if (value) res.set(name, value);
  }
  res.send(Buffer.from(await upstream.arrayBuffer()));
});

app.listen(3000);

# server.py — Flask
import os

import requests
from flask import Flask, Response, abort, request

app = Flask(__name__)
API = "https://api.offendersearch.app"
# Only the map read routes are passed through.
READ = ("viewport", "groups/", "records/")
KEEP = ("Content-Type", "ETag", "Cache-Control", "Retry-After")


@app.route("/v1/map/<path:rest>", methods=["GET", "POST"])
def map_proxy(rest):
    is_read = request.method == "GET" and rest.startswith(READ)
    is_area = request.method == "POST" and rest == "area"
    if not (is_read or is_area):
        abort(404)
    # Check here that the caller is signed in to YOUR app.

    headers = {"X-API-Key": os.environ["OFFENDERSEARCH_KEY"]}
    etag = request.headers.get("If-None-Match")
    if etag:
        headers["If-None-Match"] = etag

    upstream = requests.request(
        request.method,
        f"{API}/v1/map/{rest}",
        params=request.args,
        json=request.get_json() if is_area else None,
        headers=headers,
        timeout=20,
    )
    passed = {h: upstream.headers[h] for h in KEEP if h in upstream.headers}
    return Response(
        upstream.content, status=upstream.status_code, headers=passed
    )

curl -X POST https://api.offendersearch.app/v1/keys \
  -H "Authorization: Bearer $DASHBOARD_SESSION" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Store locator map",
    "kind": "map_publishable",
    "allowedOrigins": [
      "https://example.com",
      "https://*.example.com",
      "http://localhost:8000"
    ]
  }'

curl -X PUT https://api.offendersearch.app/v1/keys/KEY_ID/origins \
  -H "Authorization: Bearer $DASHBOARD_SESSION" \
  -H "Content-Type: application/json" \
  -d '{"allowedOrigins": ["https://example.com"]}'