-
Notifications
You must be signed in to change notification settings - Fork 0
/
app.js
143 lines (114 loc) · 3.53 KB
/
app.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
const path = require('path');
const express = require('express');
const morgan = require('morgan');
const rateLimit = require('express-rate-limit');
const helmet = require('helmet');
const mongoSanitize = require('express-mongo-sanitize');
const xss = require('xss-clean');
const hpp = require('hpp');
const cookieParser = require('cookie-parser');
const compression = require('compression');
const cors = require('cors');
const AppError = require('./utils/appError');
const globalErrorHandler = require('./controllers/errorController');
const tourRouter = require('./routes/tourRoutes');
const userRouter = require('./routes/userRoutes');
const reviewRouter = require('./routes/reviewRoutes');
const bookingRouter = require('./routes/bookingRoutes');
const bookingController = require('./controllers/bookingController');
const viewRouter = require('./routes/viewRoutes');
const app = express();
app.enable('trust proxy');
app.set('view engine', 'pug');
app.set('views', path.join(__dirname, 'views'));
// 1) GLOBAL MIDDLEWARES
// Implement CORS
// Access-Control-Allow-Origin * (everything)
app.use(cors());
// api.natours.com front-end natours.com
// app.use(
// cors({
// // Allows your api to some pages
// origin: 'https://www.natours.com',
// })
// );
// Options is just an HTTTP Method, like GET, POST, PATCH...
app.options('*', cors());
// Allows only in one route
// app.options('/api/v1/tours/:id', cors());
// Serving static files
app.use(express.static(path.join(__dirname, 'public')));
// Set security HTTTP headers
app.use(helmet());
app.use(
helmet.contentSecurityPolicy({
directives: {
defaultSrc: ["'self'", 'https:', 'http:', 'data:', 'ws:', 'blob:'],
baseUri: ["'self'"],
fontSrc: ["'self'", 'https:', 'http:', 'data:'],
scriptSrc: ["'self'", 'https:', 'http:', 'blob:', "'unsafe-inline'"],
styleSrc: ["'self'", 'https:', 'http:', "'unsafe-inline'"],
},
})
);
// Development login
if (process.env.NODE_ENV === 'development') {
app.use(morgan('dev'));
}
// Limit requests from same API
const limiter = rateLimit({
max: 100,
windowMs: 60 * 60 * 1000,
message: 'Too many requests from this IP, please try again in an hour.',
});
app.use('/api', limiter);
app.post(
'/webhook-checkout',
express.raw({ type: 'application/json' }),
bookingController.webhookCheckout
);
// Body parser, reading data from body into req.body
app.use(express.json({ limit: '10kb' }));
app.use(express.urlencoded({ extended: true, limit: '10kb' }));
app.use(cookieParser());
app.use((req, res, next) => {
next();
});
// Data sanitization against NoSQL query injection
app.use(mongoSanitize());
// Data sanitization against XSS
app.use(xss());
// Compresse all the text to send to clients
app.use(compression());
// Test middleware
app.use((req, res, next) => {
req.requestTime = new Date().toISOString();
// console.log(req.cookies);
next();
});
app.use(
hpp({
whitelist: [
'duration',
'ratingsQuantity',
'ratingsAverage',
'maxGroupSize',
'difficulty',
'price',
],
})
);
// 3) ROUTES
app.use('/', viewRouter);
app.use('/api/v1/tours', tourRouter);
app.use('/api/v1/users', userRouter);
app.use('/api/v1/reviews', reviewRouter);
app.use('/api/v1/bookings', bookingRouter);
app.all('*', (req, res, next) => {
// const err = new Error(`Can't find ${req.originalUrl} in this server`);
// err.status = 'fail';
// err.statusCode = 404;
next(new AppError(`Can't find ${req.originalUrl} in this server`, 404));
});
app.use(globalErrorHandler);
module.exports = app;