Spaces:
Running
Running
File size: 2,632 Bytes
30a3fac 9b40bfd 30a3fac fb78baf 9b40bfd 30a3fac fb78baf 30a3fac fb78baf 30a3fac 9b40bfd 30a3fac | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 | import express from 'express';
import cors from 'cors';
import { fileURLToPath } from 'url';
import path from 'path';
import dotenv from 'dotenv';
import swaggerUi from 'swagger-ui-express';
import projectsRouter from './src/routes/projects.js';
import ticketsRouter from './src/routes/tickets.js';
import flowRouter from './src/routes/flow.js';
import chefsysRouter from './src/routes/chefsys.js';
import { openapiSpec } from './src/openapi.js';
dotenv.config();
const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);
const app = express();
const PORT = process.env.PORT || 3000;
// Derive the Supabase storage origin so images can be whitelisted explicitly
// (instead of using a wildcard) in the Content-Security-Policy.
let supabaseOrigin = '';
try {
if (process.env.SUPABASE_URL) supabaseOrigin = new URL(process.env.SUPABASE_URL).origin;
} catch {
supabaseOrigin = '';
}
const baseCsp = [
"default-src 'self'",
"script-src 'self'",
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
"font-src 'self' https://fonts.gstatic.com",
`img-src 'self' data: blob:${supabaseOrigin ? ' ' + supabaseOrigin : ''}`,
`connect-src 'self'${supabaseOrigin ? ' ' + supabaseOrigin : ''}`,
"object-src 'none'",
"base-uri 'self'",
"form-action 'self'",
"frame-ancestors 'none'"
].join('; ');
// Swagger UI ships inline scripts/styles, so it needs a slightly relaxed policy.
const swaggerCsp = [
"default-src 'self'",
"script-src 'self' 'unsafe-inline'",
"style-src 'self' 'unsafe-inline'",
"img-src 'self' data:",
"object-src 'none'",
"base-uri 'self'",
"frame-ancestors 'none'"
].join('; ');
app.use((req, res, next) => {
res.setHeader(
'Content-Security-Policy',
req.path.startsWith('/api-docs') ? swaggerCsp : baseCsp
);
res.setHeader('X-Content-Type-Options', 'nosniff');
res.setHeader('Referrer-Policy', 'no-referrer');
next();
});
app.use(cors());
app.use(express.json({ limit: '5mb' }));
// API routes
app.use('/api/projects', projectsRouter);
app.use('/api/tickets', ticketsRouter);
app.use('/flow/tickets', flowRouter);
app.use('/chefsys', chefsysRouter);
app.get('/api/health', (req, res) => res.json({ ok: true }));
// API documentation (Swagger UI) + raw OpenAPI spec
app.get('/api-docs.json', (req, res) => res.json(openapiSpec));
app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(openapiSpec, {
customSiteTitle: 'Taboard API Docs'
}));
// Static frontend
app.use(express.static(path.join(__dirname, 'public')));
app.listen(PORT, () => {
console.log(`Taboard running at http://localhost:${PORT}`);
});
|