Build and connect your first custom rule engine

mkdir email-redactor && cd email-redactor
npm init -y && npm pkg set type=module
npm install express

import express from 'express';

const app = express();
app.use(express.json({ limit: '16mb' })); // matches the gateway's body cap

const SECRET = process.env.RULE_ENGINE_SECRET ?? 'change-me';

app.post('/inspect', (req, res) => {
  // Authenticate before doing any work.
  if (req.headers['x-api-key'] !== SECRET) {
    return res.status(401).json({ error: 'unauthorized' });
  }

  const { metadata, body } = req.body;
  const result = body?.result;
  const email = /\b[\w.+-]+@[\w.-]+\.[A-Za-z]{2,}\b/g; // defined per-call: no shared lastIndex

  // Pull text out of the result — a content envelope or a plain string.
  const text =
    typeof result === 'string'
      ? result
      : Array.isArray(result?.content)
        ? result.content.filter((c) => c?.type === 'text').map((c) => c.text).join('\n')
        : null;

  if (!text || !email.test(text)) {
    return res.json({ type: 'pass', comment: 'no email found' });
  }

  // Rebuild the result with emails redacted, keeping the SAME id.
  const redacted = text.replace(email, '[REDACTED EMAIL]');
  const newResult =
    typeof result === 'string'
      ? redacted
      : { ...result, content: result.content.map((c) => (c?.type === 'text' ? { ...c, text: redacted } : c)) };

  res.json({
    type: 'modify',
    comment: 'redacted email address(es)',
    modifiedPayload: { body: { jsonrpc: '2.0', id: metadata.requestId, result: newResult } },
  });
});

app.listen(3000, () => console.log('rule engine on :3000'));

ngrok http 3000