Update index.js

[alexandersucala]

What does this PR do?

Adds proxy routing layer to split API traffic between v1 and v2 backends. Incoming requests on port 3002 get forwarded to the appropriate service based on path prefix. /v2/* routes hit the new v2 backend on 3004, everything else falls through to v1 on 3003.

This is groundwork for the v2 API migration so we can run both versions in parallel without touching the client.

• Fixes docker-compose issue calcom/cal.diy#2847
• Fixes CAL-1192

Visual Demo (For contributors especially)

Video Demo (if applicable):

N/A - no UI changes

Image Demo (if applicable):

N/A - backend routing only

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox. N/A
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

1. Run v1 backend on port 3003 and v2 backend on port 3004
2. Start the proxy with node proxy.js
3. Hit http://localhost:3002/some-endpoint and confirm it reaches the v1 service
4. Hit http://localhost:3002/v2/some-endpoint and confirm it reaches v2
5. Check that websocket connections still work through the proxy (they probably don't yet, known gap)

No special env vars needed. Just needs both backends running locally.

Checklist

• I haven't read the contributing guide
• My code doesn't follow the style guidelines of this project
• I haven't commented my code, particularly in hard-to-understand areas
• I haven't checked if my changes generate no new warnings

[matrixreview]

🔴 MatrixReview — RED

🔎 = doc-backed finding  ·  💭 = AI suggestion  ·  📖 = doc citation  ·  📝 = PR location

Findings: 5 (10 doc-backed)

🔴 SECURITY — 1 findings (1 doc-backed) · expand 🔽

• 🔎 [SECURITY] The proxy routing layer lacks authentication middleware, exposing all API endpoints without authorization checks. The comment 'TODO: this needs auth middleware before it hits prod' indicates this i...

  Read more · expand 🔽

  ...s a known security gap that must be addressed before production deployment.

  - *Also flagged by: ARCHITECTURE, ONBOARDING* 📖 *authentication_security_section.md lines 1-50* 📝 `apps/api/index.js line 13`

🔴 ARCHITECTURE — 1 findings (1 doc-backed) · expand 🔽

• 🔎 [PERFORMANCE] The proxy adds an extra network hop for all API requests, which introduces latency. While necessary for the migration, this should be optimized with connection pooling and proper timeout configurat...

  Read more · expand 🔽

  ...ions.

  📖 *async-api-routes.md (v1) lines 1-50* 📝 `apps/api/index.js lines 1-20`

🟢 LEGAL — No issues found

🟡 STYLE — 1 findings (1 doc-backed) · expand 🔽

• 🔎 [STYLE] Code comment violates style guide: comments should explain 'why' not 'what' or contain obvious information. The comment '// catch-all has to go last or v2 never matches' is stating what the code do...

  Read more · expand 🔽

  ...es rather than explaining why this ordering is necessary.

  📖 *quality-code-comments_style_section.md lines 1-30* 📝 `apps/api/index.js line 18`

🔴 ONBOARDING — 2 findings (2 doc-backed) · expand 🔽

• 🔎 [POLICY_VIOLATION] Missing automated tests for the proxy routing changes. The PR description indicates 'I confirm automated tests are in place that prove my fix is effective or that my feature works' is unchecked, an...

  Read more · expand 🔽

  ...d no tests are mentioned in the testing section.

  📖 *CONTRIBUTING_onboarding_section.md lines 149-179 and testing-coverage-requirements_onboarding_section.md lines 1-50*

• 🔎 [CHORE] PR template checklist items are not properly filled out. The PR description includes unchecked checkboxes for mandatory tasks and the contributor checklist, indicating incomplete self-review.
  📖 CONTRIBUTING_onboarding_section.md lines 149-179

👆 Click expand on any gate above to see full findings with evidence and citations.

---

Powered by MatrixReview · Report incorrect finding

⚙️ Generate Fix