feat(core): add pre-parser route hook for raw body access

Routes matching `*.preroute.js` are mounted before body parsing and
CSRF middleware, allowing handlers like Stripe webhooks to access the
raw request body for signature verification.

Closes #3242

Author: PierreBrisorgueil

config/assets.js

@@ -4,6 +4,7 @@ export default {
   allYaml: 'modules/*/doc/*.yml',
   mongooseModels: 'modules/*/models/*.mongoose.js',
   sequelizeModels: 'modules/*/models/*.sequelize.js',
+  preRoutes: 'modules/*/routes/*.preroute.js',
   routes: 'modules/*/routes/*.js',
   config: 'modules/*/*.init.js',
   policies: 'modules/*/policies/*.js',

lib/helpers/config.js

@@ -95,6 +95,7 @@ const initGlobalConfigFiles = async (assets) => {
   files.swagger = await getGlobbedPaths(assets.allYaml); // Setting Globbed module yaml files
   files.mongooseModels = await getGlobbedPaths(assets.mongooseModels); // Setting Globbed mongoose model files
   files.sequelizeModels = await getGlobbedPaths(assets.sequelizeModels); // Setting Globbed sequelize model files
+  files.preRoutes = await getGlobbedPaths(assets.preRoutes); // Setting Globbed pre-parser route files
   files.routes = await getGlobbedPaths(assets.routes); // Setting Globbed route files
   files.configs = await getGlobbedPaths(assets.config); // Setting Globbed config files
   // files.sockets = getGlobbedPaths(assets.sockets); // Setting Globbed socket files

lib/services/express.js

@@ -62,6 +62,16 @@ const initLocalVariables = (app) => {
   });
 };
 
+/**
+ * Initialize pre-parser routes (mounted before body parsing and CSRF)
+ */
+const initPreParserRoutes = async (app) => {
+  for (const routePath of config.files.preRoutes) {
+    const route = await import(path.resolve(routePath));
+    route.default(app);
+  }
+};
+
 /**
  * Initialize application middleware.
  * @param {object} app - express application instance
@@ -187,6 +197,8 @@ const init = async () => {
   initSwagger(app);
   // Initialize local variables
   initLocalVariables(app);
+  // Initialize pre-parser routes (before body parsing and CSRF)
+  await initPreParserRoutes(app);
   // Initialize Express middleware
   initMiddleware(app);
   // Initialize Helmet security headers
@@ -209,6 +221,7 @@ const init = async () => {
 export default {
   initSwagger,
   initLocalVariables,
+  initPreParserRoutes,
   initMiddleware,
   initModulesConfiguration,
   initHelmetHeaders,

modules/core/tests/core.unit.tests.js

@@ -56,7 +56,7 @@ describe('Core unit tests:', () => {
     });
 
     it('assets should contain the correct keys', () => {
-      const expectedKeys = ['allJS', 'allYaml', 'mongooseModels', 'sequelizeModels', 'routes', 'config', 'policies'];
+      const expectedKeys = ['allJS', 'allYaml', 'mongooseModels', 'sequelizeModels', 'preRoutes', 'routes', 'config', 'policies'];
 
       expectedKeys.forEach((key) => {
         expect(assets).toHaveProperty(key);