From 2eb9edee696918ee83c9a57af186b4e6417ab566 Mon Sep 17 00:00:00 2001 From: Stephan <57194608+stephan418@users.noreply.github.com> Date: Mon, 16 May 2022 15:38:22 +0200 Subject: [PATCH 1/3] Only create default admin when in development mode --- src/app.ts | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/src/app.ts b/src/app.ts index 39dcc0f..83da103 100644 --- a/src/app.ts +++ b/src/app.ts @@ -19,21 +19,26 @@ require("dotenv").config(); // Load dotenv config const app = express(); -if (process.env.NODE_ENV === "development") { - logger.info("Using development mode"); -} - async function main() { - // Dev - await prisma.admin.upsert({ - where: { id: 1 }, - create: { - name: "admin", - password: await argon2.hash("test", { type: argon2.argon2id }), - permission_level: "ELEVATED", - }, - update: {}, - }); + if (process.env.NODE_ENV === "development") { + logger.info("Using development mode"); + logger.warning( + "This mode should not be used in any production-near environment as it is significantly less secure than the production mode" + ); + + // TODO: How should you login to the prod server by default? Maybe random password? + await prisma.admin.upsert({ + where: { id: 1 }, + create: { + name: "admin", + password: await argon2.hash("test", { type: argon2.argon2id }), + permission_level: "ELEVATED", + }, + update: {}, + }); + } else { + logger.info("Using production mode"); + } // Todo: Everything From 645baf1f8aa06dffb0cfbe9473b04c0b5b4a0bfe Mon Sep 17 00:00:00 2001 From: Stephan <57194608+stephan418@users.noreply.github.com> Date: Tue, 17 May 2022 15:42:50 +0200 Subject: [PATCH 2/3] Add cors --- README.md | 1 + package.json | 4 +++- src/app.ts | 15 +++++++++++++++ 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 24171fb..b4b469e 100644 --- a/README.md +++ b/README.md @@ -14,4 +14,5 @@ Before Runningthis on you local machine some things have to be setup DOMAIN: THE DOMAIN NAME OF THE SERVER MAILPASSWORD: THE PASSWORD FOR THE MAIL ACCOUNT DEV: SWITCH FOR DEV MODE AFFECTS EMAIL SERVER + ALLOW_ORIGIN: ORIGIN OF THE PRODUCTION CLIENT (FOR CORS) ``` diff --git a/package.json b/package.json index d247c39..b21172b 100644 --- a/package.json +++ b/package.json @@ -20,6 +20,7 @@ "homepage": "https://github.com/detleph/server#readme", "dependencies": { "@prisma/client": "^3.3.0", + "@types/cors": "^2.8.12", "@types/handlebars": "^4.1.0", "@types/jsonwebtoken": "^8.5.5", "@types/mjml": "^4.7.0", @@ -27,10 +28,11 @@ "@types/nodemailer": "^6.4.4", "@types/redis": "^2.8.32", "argon2": "^0.28.2", + "cors": "^2.8.5", "dotenv": "^10.0.0", "express": "^4.17.1", - "handlebars": "^4.7.7", "express-async-errors": "^3.1.1", + "handlebars": "^4.7.7", "jsonwebtoken": "^8.5.1", "mjml": "^4.11.0", "nanoid": "^3.3.3", diff --git a/src/app.ts b/src/app.ts index 83da103..58762fe 100644 --- a/src/app.ts +++ b/src/app.ts @@ -3,6 +3,7 @@ import prisma from "./lib/prisma"; import eventRouter from "./Routes/event.routes"; import adminAuthRouter from "./Routes/admin_auth.routes"; import argon2 from "argon2"; +import cors from "cors"; import adminRouter from "./Routes/admin.routes"; import organisationRouter from "./Routes/organisation.routes"; import groupRouter from "./Routes/group.routes"; @@ -36,8 +37,22 @@ async function main() { }, update: {}, }); + + // Allow all CORS requests + app.use(cors()); } else { logger.info("Using production mode"); + + // Configure cors + app.use( + cors({ + origin: process.env.ALLOW_ORIGIN, + allowedHeaders: ["Content-Type", "Authorization"], + preflightContinue: false, + methods: ["GET", "PUT", "PATCH", "POST", "DELETE"], + optionsSuccessStatus: 204, + }) + ); } // Todo: Everything From 3ec5f924296fc36778da4b66454f5fe3b3580072 Mon Sep 17 00:00:00 2001 From: Stephan <57194608+stephan418@users.noreply.github.com> Date: Tue, 17 May 2022 16:16:26 +0200 Subject: [PATCH 3/3] Add controllers for 404 and the root endpoint --- src/Middleware/error/defaultRoutes.ts | 27 +++++++++++++++++++++++++++ src/app.ts | 5 +++++ 2 files changed, 32 insertions(+) create mode 100644 src/Middleware/error/defaultRoutes.ts diff --git a/src/Middleware/error/defaultRoutes.ts b/src/Middleware/error/defaultRoutes.ts new file mode 100644 index 0000000..4a15997 --- /dev/null +++ b/src/Middleware/error/defaultRoutes.ts @@ -0,0 +1,27 @@ +import { Request, Response } from "express"; + +// Only called when no other route matches +export function notFoundHandler(req: Request, res: Response) { + return res.status(404).json({ + type: "error", + payload: { + message: `The ${req.method} HTTP method is implemented for '${req.path}'`, + _links: [ + { + rel: "root", + href: "/api", + }, + ], + }, + }); +} + +export function rootHandler(req: Request, res: Response) { + return res.status(200).json({ + type: "success", + payload: { + message: "Detleph event API", + detail: "This is the API for the Detleph event system", + }, + }); +} diff --git a/src/app.ts b/src/app.ts index 58762fe..749116d 100644 --- a/src/app.ts +++ b/src/app.ts @@ -12,6 +12,7 @@ import roleSchemaRouter from "./Routes/role_schema.routes"; import defaultErrorHandler from "./Middleware/error/handler"; import logger from "./Middleware/error/logger"; import debugLogger from "./Middleware/debug/logger"; +import { notFoundHandler, rootHandler } from "./Middleware/error/defaultRoutes"; // Set up async error handling require("express-async-errors"); @@ -79,9 +80,13 @@ async function main() { app.use("/api/role-schemas", roleSchemaRouter); + app.get("/", rootHandler); + // Error handling app.use(defaultErrorHandler); // Not working + app.use(notFoundHandler); + app.listen(process.env.PORT, () => { logger.info(`Listening on port ${process.env.PORT}`); });