Spaces:
Running
Running
| import express from 'express'; | |
| import cors from 'cors'; | |
| import { fileURLToPath } from 'url'; | |
| import path from 'path'; | |
| import dotenv from 'dotenv'; | |
| import swaggerUi from 'swagger-ui-express'; | |
| import projectsRouter from './src/routes/projects.js'; | |
| import ticketsRouter from './src/routes/tickets.js'; | |
| import flowRouter from './src/routes/flow.js'; | |
| import chefsysRouter from './src/routes/chefsys.js'; | |
| import { openapiSpec } from './src/openapi.js'; | |
| dotenv.config(); | |
| const __filename = fileURLToPath(import.meta.url); | |
| const __dirname = path.dirname(__filename); | |
| const app = express(); | |
| const PORT = process.env.PORT || 3000; | |
| // Derive the Supabase storage origin so images can be whitelisted explicitly | |
| // (instead of using a wildcard) in the Content-Security-Policy. | |
| let supabaseOrigin = ''; | |
| try { | |
| if (process.env.SUPABASE_URL) supabaseOrigin = new URL(process.env.SUPABASE_URL).origin; | |
| } catch { | |
| supabaseOrigin = ''; | |
| } | |
| const baseCsp = [ | |
| "default-src 'self'", | |
| "script-src 'self'", | |
| "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com", | |
| "font-src 'self' https://fonts.gstatic.com", | |
| `img-src 'self' data: blob:${supabaseOrigin ? ' ' + supabaseOrigin : ''}`, | |
| `connect-src 'self'${supabaseOrigin ? ' ' + supabaseOrigin : ''}`, | |
| "object-src 'none'", | |
| "base-uri 'self'", | |
| "form-action 'self'", | |
| "frame-ancestors 'none'" | |
| ].join('; '); | |
| // Swagger UI ships inline scripts/styles, so it needs a slightly relaxed policy. | |
| const swaggerCsp = [ | |
| "default-src 'self'", | |
| "script-src 'self' 'unsafe-inline'", | |
| "style-src 'self' 'unsafe-inline'", | |
| "img-src 'self' data:", | |
| "object-src 'none'", | |
| "base-uri 'self'", | |
| "frame-ancestors 'none'" | |
| ].join('; '); | |
| app.use((req, res, next) => { | |
| res.setHeader( | |
| 'Content-Security-Policy', | |
| req.path.startsWith('/api-docs') ? swaggerCsp : baseCsp | |
| ); | |
| res.setHeader('X-Content-Type-Options', 'nosniff'); | |
| res.setHeader('Referrer-Policy', 'no-referrer'); | |
| next(); | |
| }); | |
| app.use(cors()); | |
| app.use(express.json({ limit: '5mb' })); | |
| // API routes | |
| app.use('/api/projects', projectsRouter); | |
| app.use('/api/tickets', ticketsRouter); | |
| app.use('/flow/tickets', flowRouter); | |
| app.use('/chefsys', chefsysRouter); | |
| app.get('/api/health', (req, res) => res.json({ ok: true })); | |
| // API documentation (Swagger UI) + raw OpenAPI spec | |
| app.get('/api-docs.json', (req, res) => res.json(openapiSpec)); | |
| app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(openapiSpec, { | |
| customSiteTitle: 'Taboard API Docs' | |
| })); | |
| // Static frontend | |
| app.use(express.static(path.join(__dirname, 'public'))); | |
| app.listen(PORT, () => { | |
| console.log(`Taboard running at http://localhost:${PORT}`); | |
| }); | |