Upload 2 files

app.js

@@ -0,0 +1,91 @@
+const express = require("express");
+const helmet = require("helmet");
+const cors = require("cors");
+const cookieParser = require("cookie-parser");
+const compression = require("compression");
+const morgan = require("morgan");
+const mongoSanitize = require("express-mongo-sanitize");
+const hpp = require("hpp");
+
+const { env } = require("./config/env");
+const { apiLimiter } = require("./middleware/rateLimiters");
+const { errorHandler, notFound } = require("./middleware/errorHandler");
+const logger = require("./utils/logger");
+
+const authRoutes = require("./routes/auth.routes");
+const courseRoutes = require("./routes/course.routes");
+const orderRoutes = require("./routes/order.routes");
+const adminRoutes = require("./routes/admin.routes");
+
+const app = express();
+
+// Trust the first proxy hop (Render/Heroku/Nginx/etc.) so req.ip and the
+// "secure" cookie/HSTS logic reflect the real client over HTTPS.
+app.set("trust proxy", 1);
+
+// --- Security headers -------------------------------------------------
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'self'"],
+        scriptSrc: ["'self'"],
+        styleSrc: ["'self'", "'unsafe-inline'"],
+        imgSrc: ["'self'", "data:", "https:"],
+        objectSrc: ["'none'"],
+        frameAncestors: ["'none'"],
+      },
+    },
+    crossOriginResourcePolicy: { policy: "same-site" },
+    hsts: { maxAge: 63072000, includeSubDomains: true, preload: true },
+  })
+);
+
+// --- CORS: only the configured frontend origins may call the API, and
+// credentials (refresh-token cookie) are only sent to those origins. ---
+app.use(
+  cors({
+    origin(origin, callback) {
+      if (!origin || env.clientOrigins.includes(origin)) return callback(null, true);
+      // Logged (not just thrown) so a mismatched frontend domain shows up
+      // immediately in the server logs with the exact rejected value —
+      // compare this directly against the CORS allow-list logged at
+      // startup to spot typos, protocol mismatches, or a missing entry.
+      logger.warn(`CORS rejected origin: "${origin}" (allow-list: ${JSON.stringify(env.clientOrigins)})`);
+      return callback(new Error("Not allowed by CORS"));
+    },
+    credentials: true,
+  })
+);
+
+app.use(compression());
+app.use(express.json({ limit: "100kb" })); // small limit: this API never needs large bodies
+app.use(express.urlencoded({ extended: true, limit: "100kb" }));
+app.use(cookieParser(env.cookieSecret));
+
+// Strip any keys starting with "$" or containing "." from user input to
+// block MongoDB operator-injection attacks.
+app.use(mongoSanitize());
+// Prevent HTTP parameter-pollution (e.g. ?role=user&role=admin).
+app.use(hpp());
+
+app.use(
+  morgan("combined", {
+    stream: { write: (message) => logger.info(message.trim()) },
+    skip: () => env.nodeEnv === "test",
+  })
+);
+
+app.use("/api/", apiLimiter);
+
+app.get("/api/health", (req, res) => res.json({ status: "ok", time: new Date().toISOString() }));
+
+app.use("/api/auth", authRoutes);
+app.use("/api/courses", courseRoutes);
+app.use("/api/orders", orderRoutes);
+app.use("/api/admin", adminRoutes);
+
+app.use(notFound);
+app.use(errorHandler);
+
+module.exports = app;

server.js

@@ -0,0 +1,53 @@
+const { env, assertProductionSafety } = require("./config/env");
+const { connectDB, disconnectDB } = require("./config/db");
+const logger = require("./utils/logger");
+const app = require("./app");
+
+assertProductionSafety();
+
+let server;
+
+async function start() {
+  try {
+    await connectDB();
+    server = app.listen(env.port, () => {
+      logger.info(`Aynwerd API listening on port ${env.port} [${env.nodeEnv}]`);
+      // Logged deliberately at startup: this is the #1 source of CORS
+      // support confusion (a typo'd env var name, stray quotes, a
+      // trailing slash, or the value falling back to its localhost
+      // default because it was never actually set). Seeing the parsed
+      // array here removes all guesswork versus staring at the raw
+      // dashboard value.
+      logger.info(`CORS allow-list (CLIENT_ORIGINS parsed as): ${JSON.stringify(env.clientOrigins)}`);
+    });
+  } catch (err) {
+    logger.error("Failed to start server", { error: err.message });
+    process.exit(1);
+  }
+}
+
+async function shutdown(signal) {
+  logger.info(`Received ${signal}, shutting down gracefully...`);
+  if (server) {
+    server.close(async () => {
+      await disconnectDB();
+      process.exit(0);
+    });
+    // Force-exit if something hangs
+    setTimeout(() => process.exit(1), 10000).unref();
+  } else {
+    process.exit(0);
+  }
+}
+
+process.on("SIGINT", () => shutdown("SIGINT"));
+process.on("SIGTERM", () => shutdown("SIGTERM"));
+process.on("unhandledRejection", (reason) => {
+  logger.error("Unhandled promise rejection", { reason: reason?.message || reason });
+});
+process.on("uncaughtException", (err) => {
+  logger.error("Uncaught exception", { error: err.message, stack: err.stack });
+  process.exit(1);
+});
+
+start();