-
Notifications
You must be signed in to change notification settings - Fork 0
/
app.js
99 lines (84 loc) · 2.51 KB
/
app.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
const express = require("express");
const morgan = require("morgan");
const rateLimit = require("express-rate-limit");
const helmet = require("helmet");
const mongoSanitize = require("express-mongo-sanitize");
const xss = require("xss-clean");
const path = require("path");
const swaggerUi = require("swagger-ui-express");
const swaggerDocument = require("./swagger.json");
const hpp = require("hpp");
const cors = require("cors");
const bodyParser = require("body-parser");
const cookieParser = require("cookie-parser");
const compression = require("compression");
const tourRouter = require("./routes/tourRoute");
const authRouter = require("./routes/authRoute");
const userRouter = require("./routes/userRoute");
const reviewRouter = require("./routes/reviewRoute");
const viewRouter = require("./routes/viewRoute");
const bookingRouter = require("./routes/bookingRoute");
const bookingController = require("./controllers/BookingController");
const { errorMiddleware } = require("./middlewares/errorMiddleware");
const app = express();
app.use(cors());
app.options("*", cors());
app.enable("trust-proxy");
app.set("view engine", "pug");
app.set("views", path.join(__dirname, "views"));
// set security HTTP headers
app.use(helmet());
// compress response
app.use(compression());
const limiter = rateLimit({
max: 100,
windowMs: 60 * 60 * 1000,
message: "Too many request",
});
// rate limiter
app.use("/api", limiter);
app.use(
"/webhook-checkout",
bodyParser.raw({ type: "*/*" }),
bookingController.webhookCheckout
); // the request is not coming back as JSON
// serve static files
app.use(express.static(`${__dirname}/public`));
// sanitize input against NoSQL query injection
app.use(mongoSanitize());
// data sanitization
app.use(xss());
app.use(express.json({ limit: "10kb" }));
app.use(cookieParser());
app.use(
hpp({
whitelist: [
"duration",
"ratingsQuantity",
"ratingsAverage",
"price",
"difficulty",
"maxGroupSize",
],
})
);
app.use(morgan("dev"));
app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerDocument));
app.use("/api/v1/tours", tourRouter);
app.use("/api/v1/users", userRouter);
app.use("/api/v1/auth", authRouter);
app.use("/api/v1/reviews", reviewRouter);
app.use("/api/v1/bookings", bookingRouter);
app.use("/", viewRouter);
app.all(
"*",
(req, res, next) => {
const err = new Error(`Can't find ${req.originalUrl}`);
console.log(err.stack);
err.status = "fail";
err.statusCode = 404;
next(err);
},
errorMiddleware
);
module.exports = app;