Comfy-Org / Comfy-Org/registry-web

feat: add server-to-server auth for persisting auto-translated node content

Open
#258 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
17
Forks
12
PR merge metrics
No merged PRs in 30d

Description

## Context

PR #257 adds ISR + async auto-translation of node descriptions via OpenAI. Currently, translations are only cached in Vercel CDN (`s-maxage=3600`) but **not persisted to the database** via `POST /nodes/{nodeId}/translations`.

## Problem

The translations API requires Firebase user auth (`Bearer `). The server-side API route (`/api/translate-node`) has no user session, so it cannot authenticate with the backend to persist translations.

## Proposed Solution

Add a **service account / API key** mechanism to the registry backend that allows the frontend server to write translations without a user session.

Options:
1. **Backend API key**: A dedicated `X-API-Key` or `Authorization: Bearer ` for server-to-server translation writes
2. **Firebase service account**: Use Firebase Admin SDK with a service account to generate tokens server-side
3. **Separate endpoint**: `POST /nodes/{nodeId}/translations/auto` that accepts a shared secret instead of user auth

## Why this matters

Without persistence, every ISR revalidation re-translates the same content via OpenAI, wasting API credits. With persistence:
- Translate once → stored in `node.translations[locale]` in the DB
- Subsequent ISR builds read the stored translation (no OpenAI call)
- Publishers can override auto-translations via the translation editor (PR #179)

## Related

- PR #257 — ISR + auto-translation (current implementation)
- PR #179 — Node translation editor UI
- `POST /nodes/{nodeId}/translations` — existing backend endpoint
- `node.translations` field — already in the Node schema

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the /api/translate-node route, the existing POST /nodes/{nodeId}/translations endpoint, and the node.translations schema field. Compare the proposed authentication options and related PRs #257 and #179; done means server-side translation writes persist successfully without a Firebase user session and later ISR requests can reuse them.

Written by the indexing model from the issue text.

Assessment

Tech stack
firebase, typescript
Domain
api, authentication, backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.