89 lines
2.3 KiB
JavaScript
89 lines
2.3 KiB
JavaScript
const express = require('express');
|
|
const helmet = require('helmet');
|
|
const xss = require('xss-clean');
|
|
const mongoSanitize = require('express-mongo-sanitize');
|
|
const compression = require('compression');
|
|
const cors = require('cors');
|
|
const passport = require('passport');
|
|
const httpStatus = require('http-status');
|
|
const config = require('./config/config');
|
|
const morgan = require('./config/morgan');
|
|
const { jwtStrategy } = require('./config/passport');
|
|
const { authLimiter } = require('./middlewares/rateLimiter');
|
|
const routes = require('./routes/v1');
|
|
const { errorConverter, errorHandler } = require('./middlewares/error');
|
|
const ApiError = require('./utils/ApiError');
|
|
const bodyParser = require('body-parser');
|
|
|
|
const app = express();
|
|
|
|
if (config.env !== 'test') {
|
|
app.use(morgan.successHandler);
|
|
app.use(morgan.errorHandler);
|
|
}
|
|
|
|
// Middleware to parse JSON bodies
|
|
// app.use(bodyParser.json());
|
|
app.use(bodyParser.json({ limit: '10mb' }));
|
|
|
|
// set security HTTP headers
|
|
app.use(helmet());
|
|
|
|
// parse json request body
|
|
app.use(express.json());
|
|
|
|
// parse urlencoded request body
|
|
app.use(express.urlencoded({ extended: true }));
|
|
|
|
// sanitize request data
|
|
app.use(xss());
|
|
app.use(mongoSanitize());
|
|
|
|
// gzip compression
|
|
app.use(compression());
|
|
|
|
// enable cors
|
|
app.use(cors());
|
|
app.options('*', cors());
|
|
|
|
//# Need to implement
|
|
// const allowedOrigins = process.env.CORS_ALLOWED_ORIGINS.split(',');
|
|
// const corsOptions = {
|
|
// origin: function (origin, callback) {
|
|
// // Allow requests with no origin (like mobile apps, curl requests)
|
|
// if (!origin) return callback(null, true);
|
|
// if (allowedOrigins.indexOf(origin) !== -1) {
|
|
// callback(null, true);
|
|
// } else {
|
|
// callback(new Error('Not allowed by CORS'));
|
|
// }
|
|
// }
|
|
// };
|
|
// app.use(cors(corsOptions));
|
|
// app.use(cors());
|
|
|
|
// jwt authentication
|
|
app.use(passport.initialize());
|
|
passport.use('jwt', jwtStrategy);
|
|
|
|
// limit repeated failed requests to auth endpoints
|
|
if (config.env === 'production') {
|
|
app.use('/v1/auth', authLimiter);
|
|
}
|
|
|
|
// v1 api routes
|
|
app.use('/', routes);
|
|
|
|
// send back a 404 error for any unknown api request
|
|
app.use((req, res, next) => {
|
|
next(new ApiError(httpStatus.NOT_FOUND, 'Not found'));
|
|
});
|
|
|
|
// convert error to ApiError, if needed
|
|
app.use(errorConverter);
|
|
|
|
// handle error
|
|
app.use(errorHandler);
|
|
|
|
module.exports = app;
|