Paddy
17ca6399e0
New /feedback API domain backed by its own FEEDBACK_DB, mirroring the Calendar domain's router -> service -> DB pool layering: - Public endpoints (no auth): eligible-events listing, event config, submission with honeypot + rate limiting (in-memory + DB backstop). - Admin endpoints (session-header auth, reusing Calendar's users/sessions via a swappable feedback.auth.ts boundary): events/songs/questions CRUD, bulk reorder/assignment, aggregated reporting, CSV export. - Schema in sql/feedback/001_init.sql (8 tables), applied and verified against the real FEEDBACK_DB. - 64 Jest tests covering validation, auth, rate limiting, CSV escaping, and report aggregation (pure functions, no DB needed). Includes fixes from a security review: path traversal defense doesn't apply here (that's the frontend proxy, separate repo), but the rate-limiter cluster does - recordSubmission now counts every processed request (not just successful ones), the in-memory Map evicts empty entries instead of growing unbounded, FEEDBACK_IP_SALT is required at boot instead of silently degrading to unsalted hashing, and submission answer/rating arrays are capped and de-duplicated to bound insert amplification. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
111 lines
2.8 KiB
TypeScript
111 lines
2.8 KiB
TypeScript
import express from 'express';
|
|
import * as http from 'http';
|
|
import * as dotenv from 'dotenv';
|
|
import swaggerUi from 'swagger-ui-express';
|
|
import swaggerJSDoc from 'swagger-jsdoc';
|
|
import logger from './src/middleware/logger';
|
|
|
|
// Router imports
|
|
import {calendarRouter} from './src/models/calendar/Calendar.router';
|
|
import {feedbackRouter} from './src/models/feedback/Feedback.router';
|
|
|
|
|
|
let cors = require('cors');
|
|
|
|
dotenv.config();
|
|
|
|
if (!process.env.PORT) {
|
|
logger.error('No port');
|
|
process.exit(1);
|
|
}
|
|
|
|
const port: number = parseInt(process.env.PORT, 10);
|
|
|
|
const app: express.Application = express();
|
|
const server: http.Server = http.createServer(app);
|
|
|
|
// Behind Plesk's nginx, req.ip is the proxy unless we trust the forwarded header.
|
|
// Verify the resolved client IP is correct in staging before relying on it
|
|
// (used by the feedback rate limiter).
|
|
app.set('trust proxy', 1);
|
|
|
|
// here we are adding middleware to parse all incoming requests as JSON
|
|
app.use(express.json());
|
|
|
|
// Configure CORS
|
|
let allowedHosts = [
|
|
'https://www.nachklang.art',
|
|
'https://calendar.nachklang.art',
|
|
'https://feedback.nachklang.art'
|
|
];
|
|
const isDev = process.env.NODE_ENV !== 'production';
|
|
const localhostRegex = /^http:\/\/localhost:\d+$/;
|
|
app.use(cors({
|
|
allowedHeaders: ['Content-Type', 'X-Session-Id', 'X-Session-Key'],
|
|
origin: function (origin: any, callback: any) {
|
|
// Allow requests with no origin
|
|
if (!origin) return callback(null, true);
|
|
|
|
// Any localhost port is fine outside production - dev servers pick
|
|
// whatever port is free (Next.js falls back from 3000 if it's taken).
|
|
if (isDev && localhostRegex.test(origin)) {
|
|
return callback(null, true);
|
|
}
|
|
|
|
// Block requests with wrong origin
|
|
if (allowedHosts.indexOf(origin) === -1) {
|
|
return callback(new Error('The CORS policy doesn\'t allow access for your origin.'), false);
|
|
}
|
|
|
|
// Allow all other requests
|
|
return callback(null, true);
|
|
}
|
|
}));
|
|
|
|
// Swagger documentation
|
|
const swaggerDefinition = {
|
|
openapi: '3.0.0',
|
|
info: {
|
|
title: 'Nachklang e.V. REST API',
|
|
version: '0.1.0',
|
|
license: {
|
|
name: 'Licensed Under MIT',
|
|
url: 'https://spdx.org/licenses/MIT.html'
|
|
},
|
|
contact: {
|
|
name: 'Nachklang e.V.',
|
|
url: 'https://www.nachklang.art'
|
|
}
|
|
}
|
|
};
|
|
|
|
const options = {
|
|
swaggerDefinition,
|
|
// Paths to files containing OpenAPI definitions
|
|
apis: [
|
|
'./src/models/**/*.interface.ts',
|
|
'./src/models/**/*.router.ts'
|
|
]
|
|
};
|
|
|
|
const swaggerSpec = swaggerJSDoc(options);
|
|
|
|
app.use(
|
|
'/docs',
|
|
swaggerUi.serve,
|
|
swaggerUi.setup(swaggerSpec)
|
|
);
|
|
|
|
// Add routers
|
|
app.use('/calendar', calendarRouter);
|
|
app.use('/feedback', feedbackRouter);
|
|
|
|
// this is a simple route to make sure everything is working properly
|
|
app.get('/', (req: express.Request, res: express.Response) => {
|
|
res.status(200).send('Welcome to the Nachklang e.V. REST API!');
|
|
});
|
|
|
|
server.listen(port, () => {
|
|
logger.info('Server listening on Port ' + port);
|
|
});
|