154 lines
3.5 KiB
JavaScript
154 lines
3.5 KiB
JavaScript
const express = require("express");
|
|
const cors = require("cors");
|
|
const helmet = require("helmet");
|
|
const morgan = require("morgan");
|
|
const swaggerUi = require("swagger-ui-express");
|
|
const swaggerJsdoc = require("swagger-jsdoc");
|
|
const routes = require("./app/routes/routes");
|
|
const db = require("./app/models");
|
|
const path = require("path");
|
|
const cookieParser = require("cookie-parser");
|
|
const sanitizeInput = require("./app/utils/sanitizeInput");
|
|
require("dotenv").config();
|
|
|
|
const app = express();
|
|
|
|
// REQUIRED for HSTS when behind proxy (AWS ALB / Nginx / Cloudflare)
|
|
app.set("trust proxy", 1);
|
|
|
|
const isLocal = process.env.NODE_ENV === "development";
|
|
|
|
// GLOBAL MIDDLEWARE (body parsing)
|
|
app.use(express.json());
|
|
app.use(cookieParser());
|
|
|
|
// HELMET
|
|
app.use(
|
|
helmet({
|
|
contentSecurityPolicy: false,
|
|
})
|
|
);
|
|
|
|
// prevent framing (clickjacking protection)
|
|
app.use(
|
|
helmet.frameguard({
|
|
action: "deny",
|
|
})
|
|
);
|
|
|
|
//HSTS (ENABLE FOR UAT + PROD)
|
|
if (!isLocal) {
|
|
app.use(
|
|
helmet.hsts({
|
|
maxAge: 31536000, // 1 year
|
|
includeSubDomains: true,
|
|
preload: true,
|
|
})
|
|
);
|
|
}
|
|
|
|
app.use(morgan("dev"));
|
|
app.use(sanitizeInput);
|
|
|
|
const allowedOrigins = process.env.ALLOWED_ORIGINS
|
|
? process.env.ALLOWED_ORIGINS.split(",").map(origin => origin.trim())
|
|
: [];
|
|
app.use(cors({
|
|
origin: allowedOrigins,
|
|
credentials: true
|
|
}));
|
|
|
|
console.log("is production = " + process.env.NODE_ENV === "production");
|
|
console.log("allowedOrigins = " + allowedOrigins);
|
|
|
|
app.use((req, res, next) => {
|
|
console.log("Origin from header = " + req.headers.origin);
|
|
if (allowedOrigins.includes(req.headers.origin)) {
|
|
console.log("Origin set = " + req.headers.origin);
|
|
res.header("Access-Control-Allow-Origin", req.headers.origin);
|
|
}
|
|
res.header("Access-Control-Allow-Credentials", "true");
|
|
res.header(
|
|
"Access-Control-Allow-Headers",
|
|
"Content-Type, Authorization, APP_SIGNATURE, x-app-signature"
|
|
);
|
|
res.header(
|
|
"Access-Control-Allow-Methods",
|
|
"GET, POST, PUT, PATCH, DELETE, OPTIONS"
|
|
);
|
|
|
|
if (req.method === "OPTIONS") {
|
|
return res.sendStatus(200);
|
|
}
|
|
next();
|
|
});
|
|
|
|
|
|
|
|
|
|
// Swagger setup
|
|
const swaggerOptions = {
|
|
definition: {
|
|
openapi: "3.0.0",
|
|
info: {
|
|
title: "FCSC IPI Survey",
|
|
version: "1.0.0",
|
|
description: "Federal Competitiveness and Statistics Centre (FCSC) - Industrial Production Index (IPI)",
|
|
},
|
|
components: {
|
|
securitySchemes: {
|
|
// Optional: Still support Bearer for Swagger-only testing
|
|
bearerAuth: {
|
|
type: "http",
|
|
scheme: "bearer",
|
|
bearerFormat: "JWT",
|
|
},
|
|
appSignature: {
|
|
type: "apiKey",
|
|
in: "header",
|
|
name: "x-app-signature"
|
|
}
|
|
},
|
|
},
|
|
},
|
|
apis: ["./app/routes/*.js"],
|
|
};
|
|
|
|
const swaggerDocs = swaggerJsdoc(swaggerOptions);
|
|
|
|
app.use(
|
|
"/api-docs",
|
|
swaggerUi.serve,
|
|
swaggerUi.setup(swaggerDocs, {
|
|
swaggerOptions: {
|
|
withCredentials: true, // 🔥 VERY IMPORTANT
|
|
},
|
|
})
|
|
);
|
|
|
|
|
|
// Routes
|
|
app.use("/api", routes);
|
|
|
|
|
|
apis: [path.join(__dirname, "app/routes/*.js")],
|
|
|
|
app.get("/api/test", (req, res) => {
|
|
res.json({ status: "success", message: "Test API working fine 🚀" });
|
|
});
|
|
|
|
//deployment route
|
|
const deploymentController = require("./app/controllers/deployment.controller");
|
|
app.post("/deploy", deploymentController.deployment);
|
|
|
|
// Sync DB
|
|
// db.sequelize.sync({ alter: true }).then(() => {
|
|
// console.log("✅ Database connected & synced.");
|
|
// });
|
|
|
|
// Start server
|
|
const PORT = process.env.PORT || 5000;
|
|
app.listen(PORT, () => {
|
|
console.log(`🚀 Server running on port ${PORT}`);
|
|
});
|