1+ import cookieParser from "cookie-parser" ;
2+ import cors from "cors"
3+ import express from "express"
4+ import helmet from "helmet" ;
5+ import session from "express-session" ;
6+ import { API_PREFIX , APP_NAME } from "./src/constants.js" ;
7+ import webPush from 'web-push' ;
8+ import { globalAuthCheck } from "./src/middlewares/authMiddleware.js" ;
9+
10+
11+
12+
13+ const app = express ( ) ;
14+
15+
16+ // 1. Core Express Settings & Trust Proxy (Highest Priority)
17+ // These don't directly process requests but configure Express's behavior
18+ app . set ( 'view engine' , 'ejs' ) ;
19+ app . set ( 'trust proxy' , 1 ) ; // Essential when behind a reverse proxy like Nginx
20+
21+ // 2. Security & Basic Request Parsing (Early - before anything else relies on parsed data)
22+ // These should generally come before most other middleware to apply security
23+ // and parse basic request components like cookies and body.
24+
25+ app . use ( helmet ( {
26+ contentSecurityPolicy : false // Reconsider enabling this if possible for better security
27+ } ) ) ;
28+
29+ app . use ( cors ( {
30+ origin : process . env . CORS_ORIGIN ,
31+ credentials : true
32+ } ) ) ;
33+
34+ app . use ( cookieParser ( ) ) ; // Parses cookies from the request headers
35+
36+ // 3. Session Middleware (Relies on cookies, so comes after cookieParser)
37+ app . use (
38+ session ( {
39+ secret : process . env . SESSION_SECRET ,
40+ resave : false ,
41+ saveUninitialized : false ,
42+ cookie : {
43+ secure : process . env . NODE_ENV === "production" ,
44+ httpOnly : true ,
45+ maxAge : 15 * 24 * 60 * 60 * 1000 ,
46+ sameSite : 'Strict' ,
47+ } ,
48+ } )
49+ ) ;
50+
51+
52+
53+ // 4. Body Parsers (Relies on raw request body, comes after session if session needs body)
54+ // These should come before any routes or middleware that need to access req.body
55+ app . use ( express . json ( {
56+ limit : "100mb" // Adjust as needed, 200MB is very large
57+ } ) ) ;
58+ app . use ( express . urlencoded ( { extended : true , limit : "20kb" } ) ) ;
59+
60+ // 5. Static File Serving (Critical: Should come *before* any authentication or rate limiting
61+ // if you want public assets to be served without those checks)
62+ app . use ( express . static ( "public" ) ) ;
63+
64+ // Your custom full URL middleware (doesn't change req/res much, so flexible)
65+ app . use ( ( req , res , next ) => {
66+ var fullUrl = req . protocol + '://' + req . get ( 'host' ) + req . originalUrl ;
67+ // You might want to actually *do* something with fullUrl here, like logging it
68+ next ( ) ;
69+ } ) ;
70+
71+
72+
73+ // 8. Global Variable/Local Setup (Can be flexible, but often useful before auth or routes)
74+ // This middleware populates res.locals, which is good to have before rendering views
75+ // or if subsequent middleware/routes might use these locals.
76+ app . use ( ( req , res , next ) => {
77+ res . locals . websiteName = APP_NAME ;
78+ res . locals . request = req ;
79+ res . locals . data = { } ;
80+ res . locals . messages = { } ;
81+ res . locals . message = { text : null , type : null } ;
82+ res . locals . fields = { } ;
83+ res . locals . ogData = null ;
84+
85+
86+ const path = req . originalUrl . split ( '?' ) [ 0 ] ;
87+ const cleanedPath = path . replace ( / \/ p \/ [ a - f 0 - 9 ] { 24 } / , '' ) ;
88+ const titleParts = cleanedPath . replace ( / ^ \/ + / , '' ) . split ( '/' ) ;
89+ const generatedTitle = titleParts
90+ . map ( part => part . charAt ( 0 ) . toUpperCase ( ) + part . slice ( 1 ) . toLowerCase ( ) )
91+ . join ( ' ' ) || APP_NAME ;
92+ res . locals . websiteTitle = generatedTitle ;
93+
94+ next ( ) ;
95+ } ) ;
96+
97+ // 9. Global Authentication/Authorization (Should come before routes that require auth)
98+ // This is where globalAuthCheck fits well. It runs for all requests that haven't
99+ // been handled by static files, before they hit your specific API or page routes.
100+ app . use ( globalAuthCheck ) ;
101+
102+ // log the requests
103+
104+ // 10. Web Push Setup (This is a setup, not a middleware, so placement doesn't affect request flow)
105+ // It only sets up details for future web push operations, not processing incoming requests.
106+ webPush . setVapidDetails (
107+ 'mailto:panditprogrammer@gmail.com' ,
108+ process . env . WEB_PUSH_VAPID_PUBLIC_KEY ,
109+ process . env . WEB_PUSH_VAPID_PRIVATE_KEY
110+ ) ;
111+
112+
113+
114+
115+ //--------------- routes -----------------
116+ import userRouter from "./src/routes/userRoutes.js" ;
117+ import utilityRouter from "./src/routes/utilityRoutes.js" ;
118+ import notificationRouter from "./src/routes/notificationRoutes.js" ;
119+ import pagesRouter from "./src/routes/pagesRoutes.js" ;
120+ import postRouter from "./src/routes/postRoutes.js" ;
121+ import friendRequestRouter from "./src/routes/friendRequestRoutes.js" ;
122+ import chatMessageRouter from "./src/routes/chatMessageRoutes.js" ;
123+
124+ app . use ( `/` , pagesRouter ) ;
125+
126+ // Register routes
127+ app . use ( `/users` , userRouter ) ;
128+ app . use ( `/notifications` , notificationRouter ) ;
129+
130+
131+ // api for mobile
132+ app . use ( `${ API_PREFIX } , friendRequestRouter ) ;
133+ app . use ( `${ API_PREFIX } , chatMessageRouter ) ;
134+
135+ app . use ( `${ API_PREFIX } , postRouter ) ;
136+ app . use ( `${ API_PREFIX } , userRouter ) ;
137+ app . use ( `${ API_PREFIX } , utilityRouter ) ;
138+ app . use ( `${ API_PREFIX } , notificationRouter ) ;
139+
140+
141+
142+
143+ // app.use(errorHandler);
144+ export default app ;
0 commit comments