Split server concerns into focused modules (#5)

Co-authored-by: Jamie Parr <JamieP-205@users.noreply.github.com>

Author: JamieP-205

v2/README.md

@@ -104,7 +104,11 @@ Manual CLI production deploys are reserved for recovery or a controlled migratio
 
 - `app.js` - public chat, multi-chat controls, admin drafting and conversation management
 - `netlify/functions/_context.js` - pack validation, audience filtering and ranking
-- `netlify/functions/_lib.js` - authentication, providers, Blobs, migration and API routes
+- `netlify/functions/_lib.js` - API route coordination, Blobs access and migration
+- `netlify/functions/_http.js` and `_security.js` - request validation,
+  cookie parsing and password primitives
+- `netlify/functions/_memory.js`, `_provider.js` and `_prompts.js` -
+  visitor memory, provider adapters and persona policy
 - `tools/build-private-context.js` - local private-pack builder
 - `test/` - authentication, context, privacy and deployment tests
 

v2/netlify/functions/_http.js

@@ -0,0 +1,103 @@
+class HttpError extends Error {
+  constructor(statusCode, message) {
+    super(message);
+    this.name = "HttpError";
+    this.statusCode = statusCode;
+  }
+}
+
+function json(statusCode, body, extraHeaders = {}) {
+  return {
+    statusCode,
+    headers: {
+      "Content-Type": "application/json; charset=utf-8",
+      "Cache-Control": "no-store, max-age=0",
+      "X-Content-Type-Options": "nosniff",
+      ...extraHeaders
+    },
+    body: JSON.stringify(body)
+  };
+}
+
+function parseBody(event, maxBytes = 64_000) {
+  const raw = String(event.body || "");
+  if (Buffer.byteLength(raw, "utf8") > maxBytes) {
+    throw new HttpError(413, "Request is too large.");
+  }
+  try {
+    return raw ? JSON.parse(raw) : {};
+  } catch {
+    throw new HttpError(400, "Request body must be valid JSON.");
+  }
+}
+
+function requireMethod(event, method) {
+  if (event.httpMethod !== method) {
+    throw new HttpError(405, `Use ${method} for this endpoint.`);
+  }
+}
+
+function sameOriginOk(event) {
+  const origin = event.headers.origin || event.headers.Origin;
+  if (!origin) return true;
+  try {
+    return new URL(origin).host === (event.headers.host || event.headers.Host);
+  } catch {
+    return false;
+  }
+}
+
+function requireWriteRequest(event) {
+  requireMethod(event, "POST");
+  if (!sameOriginOk(event)) {
+    throw new HttpError(403, "Origin check failed.");
+  }
+}
+
+function cleanText(value, max = 1_000) {
+  return String(value ?? "")
+    .replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, "")
+    .trim()
+    .slice(0, max);
+}
+
+function normaliseUsername(value) {
+  return cleanText(value, 24).toLowerCase();
+}
+
+function validUsername(value) {
+  return /^[a-z0-9_]{3,24}$/.test(value)
+    && value !== "jamie"
+    && !value.startsWith("guest_");
+}
+
+function parseCookies(header) {
+  const cookies = {};
+  for (const part of String(header || "").split(";")) {
+    const index = part.indexOf("=");
+    if (index < 1) continue;
+    const name = part.slice(0, index).trim();
+    if (!name) continue;
+    const rawValue = part.slice(index + 1).trim();
+    try {
+      cookies[name] = decodeURIComponent(rawValue);
+    } catch {
+      // A malformed cookie should invalidate that value, not crash the API.
+    }
+  }
+  return cookies;
+}
+
+module.exports = {
+  HttpError,
+  cleanText,
+  json,
+  normaliseUsername,
+  parseBody,
+  parseCookies,
+  requireMethod,
+  requireWriteRequest,
+  sameOriginOk,
+  validUsername
+};
+