136 lines
4.6 KiB
JavaScript
136 lines
4.6 KiB
JavaScript
const express = require('express');
|
|
const helmet = require('helmet');
|
|
const rateLimit = require('express-rate-limit');
|
|
const { createSessionMiddleware, requireAuth } = require('./middleware/session');
|
|
const { registerLimiter, loginLimiter, routes: authRoutes } = require('./routes/auth');
|
|
const { routes: characterRoutes } = require('./routes/character');
|
|
const { routes: huntRoutes } = require('./routes/hunt');
|
|
const { routes: zonesRoutes } = require('./routes/zones');
|
|
const { routes: combatLogRoutes } = require('./routes/combatLog');
|
|
const { routes: inventoryRoutes } = require('./routes/inventory');
|
|
const { routes: shopRoutes } = require('./routes/shop');
|
|
const { routes: expeditionRoutes } = require('./routes/expeditions');
|
|
const { routes: leaderboardRoutes } = require('./routes/leaderboard');
|
|
const { routes: heroProfileRoutes } = require('./routes/heroProfile');
|
|
const { AppError } = require('./utils/errors');
|
|
|
|
// General API rate limiter: 120 req/min per IP (SECURITY.md).
|
|
const apiLimiter = rateLimit({
|
|
windowMs: 60 * 1000, // 1 minute
|
|
max: process.env.NODE_ENV === 'test' ? 1000 : 120,
|
|
message: { ok: false, error: { code: 'RATE_LIMITED', message: 'Too many requests. Try again later.' } },
|
|
});
|
|
|
|
function createApp() {
|
|
const app = express();
|
|
|
|
// Security headers
|
|
app.use(helmet());
|
|
|
|
// Trust proxy (for rate limiting behind reverse proxy)
|
|
app.set('trust proxy', 1);
|
|
|
|
// JSON body parser with small limit
|
|
app.use(express.json({ limit: '10kb' }));
|
|
|
|
// Session middleware
|
|
app.use(createSessionMiddleware());
|
|
|
|
// Static files
|
|
app.use(express.static('public'));
|
|
|
|
// Health endpoint (no auth)
|
|
app.get('/api/health', (_req, res) => {
|
|
res.json({ ok: true });
|
|
});
|
|
|
|
// Auth routes (public)
|
|
app.post('/api/auth/register', registerLimiter, authRoutes.postRegister);
|
|
app.post('/api/auth/login', loginLimiter, authRoutes.postLogin);
|
|
|
|
// Auth routes (require session)
|
|
app.post('/api/auth/logout', requireAuth, authRoutes.postLogout);
|
|
app.get('/api/auth/me', requireAuth, authRoutes.getMe);
|
|
|
|
// General API rate limiter (applies to all non-auth routes below)
|
|
app.use('/api', apiLimiter);
|
|
|
|
// Character routes (require session)
|
|
app.post('/api/character', requireAuth, characterRoutes.postCharacter);
|
|
app.get('/api/character', requireAuth, characterRoutes.getCharacter);
|
|
|
|
// Hunt routes (require session)
|
|
app.post('/api/hunt', requireAuth, huntRoutes.postHunt);
|
|
|
|
// Zone routes (require session)
|
|
app.get('/api/zones', requireAuth, zonesRoutes.getZones);
|
|
|
|
// Combat log routes (require session)
|
|
app.get('/api/combat-log', requireAuth, combatLogRoutes.getCombatLog);
|
|
|
|
// Inventory routes (require session)
|
|
app.get('/api/inventory', requireAuth, inventoryRoutes.getInventory);
|
|
app.post('/api/inventory/equip', requireAuth, inventoryRoutes.postEquip);
|
|
app.post('/api/inventory/unequip', requireAuth, inventoryRoutes.postUnequip);
|
|
app.post('/api/inventory/use', requireAuth, inventoryRoutes.postUse);
|
|
|
|
// Shop routes (require session)
|
|
app.get('/api/shop', requireAuth, shopRoutes.getShop);
|
|
app.post('/api/shop/buy', requireAuth, shopRoutes.postBuy);
|
|
app.post('/api/shop/sell', requireAuth, shopRoutes.postSell);
|
|
|
|
// Expedition routes (require session)
|
|
app.get('/api/expeditions/defs', requireAuth, expeditionRoutes.getDefs);
|
|
app.post('/api/expeditions/start', requireAuth, expeditionRoutes.postStart);
|
|
app.get('/api/expeditions/active', requireAuth, expeditionRoutes.getActive);
|
|
app.post('/api/expeditions/claim', requireAuth, expeditionRoutes.postClaim);
|
|
|
|
// Leaderboard route (require session)
|
|
app.get('/api/leaderboard', requireAuth, leaderboardRoutes.getLeaderboard);
|
|
|
|
// Hero profile route (public, no session required)
|
|
app.get('/api/heroes/:name', heroProfileRoutes.getHeroProfile);
|
|
|
|
// Central error handler
|
|
app.use((err, _req, res, _next) => {
|
|
// Log stack traces server-side only
|
|
if (err.stack) {
|
|
console.error(err.stack);
|
|
}
|
|
|
|
if (err instanceof AppError) {
|
|
return res.status(err.status).json({
|
|
ok: false,
|
|
error: {
|
|
code: err.code,
|
|
message: err.message,
|
|
},
|
|
});
|
|
}
|
|
|
|
// Check for Zod-like validation errors
|
|
if (err.name === 'ZodError' || (err.errors && Array.isArray(err.errors))) {
|
|
return res.status(400).json({
|
|
ok: false,
|
|
error: {
|
|
code: 'VALIDATION_ERROR',
|
|
message: 'Request validation failed.',
|
|
},
|
|
});
|
|
}
|
|
|
|
// Generic error
|
|
res.status(500).json({
|
|
ok: false,
|
|
error: {
|
|
code: 'INTERNAL_ERROR',
|
|
message: 'Something went wrong.',
|
|
},
|
|
});
|
|
});
|
|
|
|
return app;
|
|
}
|
|
|
|
module.exports = { createApp };
|