Guoguo
0c65ef95f8
- Avatar upload: whitelist image MIME types and extensions (jpg/png/gif/webp) - Normalize device_id to String for strict comparison in treatment sync - Add ORDER BY expire_time DESC to purchase/adminCreate subscription queries - Deduplicate readBearer: middleware imports from lib/auth.js - Parameterize createTrial INTERVAL instead of string concatenation - Add rate limiting (20/15min) to avatar upload and phone auth endpoints
65 行
2.1 KiB
JavaScript
65 行
2.1 KiB
JavaScript
const express = require('express')
|
|
const rateLimit = require('express-rate-limit')
|
|
const { ok, fail } = require('./lib/response')
|
|
const { authMiddleware } = require('./middleware/auth')
|
|
|
|
const app = express()
|
|
|
|
// Rate limiting for auth-sensitive endpoints
|
|
const userLoginLimiter = rateLimit({
|
|
windowMs: 15 * 60 * 1000, // 15 minutes
|
|
max: 10,
|
|
standardHeaders: true,
|
|
legacyHeaders: false,
|
|
message: { code: 2001, message: 'too_many_attempts' }
|
|
})
|
|
const adminLoginLimiter = rateLimit({
|
|
windowMs: 15 * 60 * 1000,
|
|
max: 5,
|
|
standardHeaders: true,
|
|
legacyHeaders: false,
|
|
message: { code: 2001, message: 'too_many_attempts' }
|
|
})
|
|
const uploadLimiter = rateLimit({
|
|
windowMs: 15 * 60 * 1000,
|
|
max: 20,
|
|
standardHeaders: true,
|
|
legacyHeaders: false,
|
|
message: { code: 2001, message: 'too_many_attempts' }
|
|
})
|
|
|
|
app.use(express.json())
|
|
app.use((req, res, next) => {
|
|
res.header('Access-Control-Allow-Origin', '*')
|
|
res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Device-Id, X-App-Version, X-Platform')
|
|
res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
|
|
if (req.method === 'OPTIONS') return res.sendStatus(204)
|
|
next()
|
|
})
|
|
|
|
app.use('/api/v1/auth/login', userLoginLimiter)
|
|
app.use('/api/v1/admin/login', adminLoginLimiter)
|
|
app.use('/api/v1/user/avatar', uploadLimiter)
|
|
app.use('/api/v1/user/phone', uploadLimiter)
|
|
|
|
app.use(authMiddleware)
|
|
|
|
app.get('/health', (req, res) => res.json(ok({ status: 'ok' })))
|
|
|
|
app.use('/api/v1', require('./routes/auth'))
|
|
app.use('/api/v1', require('./routes/user'))
|
|
app.use('/api/v1', require('./routes/device'))
|
|
app.use('/api/v1', require('./routes/subscription'))
|
|
app.use('/api/v1', require('./routes/treatment'))
|
|
app.use('/api/v1/admin', require('./routes/admin'))
|
|
app.use('/api/v1', require('./routes/firmware'))
|
|
|
|
app.use((req, res) => res.status(404).json(fail(404, 'not_found')))
|
|
|
|
app.use((err, req, res, _next) => {
|
|
console.error('[ERROR]', req.method, req.path, err.code || '', err.sqlMessage || err.message, err.stack)
|
|
res.status(500).json(fail(3001, 'server_error'))
|
|
})
|
|
|
|
module.exports = app
|