app.js

const path = require("path");
const express = require("express");
const morgan = require("morgan");
const rateLimit = require("express-rate-limit");
const helmet = require("helmet");
const csp = require("express-csp");
const mongoSanitize = require("express-mongo-sanitize");
const xss = require("xss-clean");
const hpp = require("hpp");
const cookieParser = require("cookie-parser");
const compression = require("compression");
const cors = require("cors");

const AppError = require("./utils/appError");
const globalErrorHandler = require("./controllers/errorController");
const tourRouter = require("./routes/tourRoutes");
const userRouter = require("./routes/userRoutes");
const reviewRouter = require("./routes/reviewRoutes");
const bookingRouter = require("./routes/bookingRoutes");
const bookingController = require("./controllers/bookingController");
const viewRouter = require("./routes/viewRoutes");

// Start express app
const app = express();

app.enable("trust proxy");

// View engine
app.set("view engine", "pug");
// using path to avoid using slashes
app.set("views", path.join(__dirname, "views"));

// 1) GLOBAL Middlewares
// Implement CORS (enabling cross-origin resource sharing, to allow API to be called from outside the api)
// only works on simple requests (get, post)
app.use(cors());
// Access-Control-Allow-Origin *

// Example: the backend on:api.natours.com, and front-end on natours.com, we then allow only our front-end to access
// app.use(
//   cors({
//     origin: "https://www.natours.com",
//   })
// );
// HTTP method sent by the browser for non-simple requests to deal with cors, so in here * refers to all routes
app.options("*", cors());
// app.options("/api/v1/tours/:id", cors());

// Serving static files
app.use(express.static(path.join(__dirname, "public")));

// we need to put it first to make sure it is used with the http headers
// Set security http headers
// !!!! setting { contentSecurityPolicy: false } actually defeats the purpose of helmet, just keep it for dev, remove it on deployment
app.use(helmet());
csp.extend(app, {
  policy: {
    directives: {
      "default-src": ["self"],
      "style-src": ["self", "unsafe-inline", "https:"],
      "font-src": ["self", "https://fonts.gstatic.com"],
      "script-src": [
        "self",
        "unsafe-inline",
        "data",
        "blob",
        "https://js.stripe.com",
        "https://*.mapbox.com",
        "https://*.cloudflare.com/",
        "https://bundle.js:8828",
        "ws://localhost:56558/",
      ],
      "worker-src": [
        "self",
        "unsafe-inline",
        "data:",
        "blob:",
        "https://*.stripe.com",
        "https://*.mapbox.com",
        "https://*.cloudflare.com/",
        "https://bundle.js:*",
        "ws://localhost:*/",
      ],
      "frame-src": [
        "self",
        "unsafe-inline",
        "data:",
        "blob:",
        "https://*.stripe.com",
        "https://*.mapbox.com",
        "https://*.cloudflare.com/",
        "https://bundle.js:*",
        "ws://localhost:*/",
      ],
      "img-src": [
        "self",
        "unsafe-inline",
        "data:",
        "blob:",
        "https://*.stripe.com",
        "https://*.mapbox.com",
        "https://*.cloudflare.com/",
        "https://bundle.js:*",
        "ws://localhost:*/",
      ],
      "connect-src": [
        "self",
        "unsafe-inline",
        "data:",
        "blob:",
        // "wss://<HEROKU-SUBDOMAIN>.herokuapp.com:<PORT>/",
        "https://*.stripe.com",
        "https://*.mapbox.com",
        "https://*.cloudflare.com/",
        "https://bundle.js:*",
        "ws://localhost:*/",
      ],
    },
  },
});
// Development logging
if (process.env.NODE_ENV === "development") {
  app.use(morgan("dev"));
}

// Limit requests from same API
const limiter = rateLimit({
  max: 100,
  windowMs: 60 * 60 * 1000,
  message: "Too many requests from this IP, please try again in an hour",
});

app.use("/api", limiter);

// Why define it here instead of in the booking router? because the stripe function that will read the body needs the body in a raw form (not in JSON)
app.post(
  "/webhook-checkout",
  express.raw({ type: "application/json" }),
  bookingController.webhookCheckout
);

// Body parser, reading data from the body into req.body. For security measures, req.body is limited here to 10 kilobytes
app.use(
  express.json({
    limit: "10kb",
  })
);

// Cookie parser, to get access to cookies
app.use(cookieParser());

// HTML form parser, extended:true allows to send some complex data.
app.use(express.urlencoded({ extended: true, limit: "10kb" }));

// Data sanitization against NoSQL query injection
app.use(mongoSanitize());

// Data sanitization against XXS
app.use(xss());

// Prevent parameter pollution using hpp package
app.use(
  hpp({
    whitelist: [
      "duration",
      "ratingsAverage",
      "ratingsQuantity",
      "maxGroupSize",
      "difficulty",
      "price",
    ],
  })
);

// app.use((req, res, next) => {
//   console.log("Hello from the middleware!");
//   next();
// });

// A compression middleware to compress text responses sent to the client
app.use(compression());

// Testing middleware
app.use((req, res, next) => {
  req.requestTime = new Date().toISOString();
  // console.log(req.headers);
  // console.log(req.cookies);

  next();
});

//  2) Route Handlers
// moved to the routes files

//  3) Routes
app.use("/", viewRouter);
app.use("/api/v1/tours", tourRouter);
app.use("/api/v1/users", userRouter);
app.use("/api/v1/reviews", reviewRouter);
app.use("/api/v1/bookings", bookingRouter);

app.all("*", (req, res, next) => {
  // res.status(404).json({
  //   status: "fail",
  //   message: `Can't find ${req.originalUrl} on this server!`,
  // });

  // const err = new Error(`Can't find ${req.originalUrl} on this server!`);
  // err.status = "fail";
  // err.statusCode = 404;

  next(new AppError(`Can't find ${req.originalUrl} on this server!`, 404));
});

// the global error handler that will receive and next() that contains an error
app.use(globalErrorHandler);

//  4) Start Server
// moved to server.js

module.exports = app;