Paul Nothaft
8017370271
* feat(settings): expose the API rate limiter in the Security tab The general per-IP limiter had six settings in app_settings and a backend route to write them, and no screen. Installs ran on the code fallback — 300 requests per 15 minutes per IP — with no way to see it, which is how issue 1287 played out: a 546-photo gallery exhausted the budget for one viewer and the operator learned about the setting from a grep of the backend log. Security tab: a card with the six settings, the validation ranges the route enforces, a one-line explanation per field, and a note that the unit is the client IP — an office or household behind one NAT shares a budget, and behind a proxy TRUST_PROXY has to cover the proxy or every visitor shares its address. The tab's Save button saves the limiter through its own route. The limiter values are checked against the route's ranges before anything is written and the limiter is written first, so a rejected value cannot leave the password/session settings half-saved behind a failure toast. Backend, three things the screen needed: - The settings read fills the six keys with the code defaults when they have no row, so the form shows the budget in force rather than an empty field; the defaults live in one exported constant the limiter itself reads. - The write route upserts instead of updating: on a fresh install, which has no rows, the old UPDATE matched nothing and the route answered 200 while changing nothing. - The live limiter instances move into rateLimitService and the write route rebuilds them. express-rate-limit fixes windowMs when an instance is built — max and skip re-read the settings per request, the window does not — so a saved window used to apply only after a restart. The gates in server.js resolve the instance per request through the service's getters. A rebuild starts fresh counters, which on a settings change is acceptable. The limiters get explicit MemoryStores and a rebuild shuts the superseded ones down, because a store keeps a cleanup interval alive for as long as it exists and dropping the reference alone would leak one timer per save. Tests: the read surfaces defaults and honours the key filter; the write creates rows on a fresh database, the limiter sees the values immediately and hands the gates a fresh instance; existing rows are updated not duplicated; out-of-range values are rejected. The tab renders the values, edits through the hook state, carries the ranges, saves with the tab's button, and the pre-write validation accepts the bounds and rejects outside them and cleared fields. Relates to issue 1337 * docs(security): point the rate limiter doc at the Security tab and the upsert --------- Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local>
1326 lines
60 KiB
JavaScript
1326 lines
60 KiB
JavaScript
require('dotenv').config();
|
|
|
|
// Validate critical environment variables before proceeding
|
|
const { validateEnvironment } = require('./src/config/validateEnv');
|
|
validateEnvironment();
|
|
|
|
// Resolve which database engine this process should use, BEFORE anything
|
|
// requires knexfile/db (#1038). wait-for-db.sh normally does this and exports
|
|
// DATABASE_CLIENT, but a Kubernetes manifest that sets `command`/`args`, or a
|
|
// plain `docker run … node server.js`, bypasses the entrypoint entirely — and
|
|
// those are exactly the deployments this fix is for. Without this, such an
|
|
// install would resolve to Postgres (NODE_ENV is baked into the image now) and
|
|
// come up against an empty database while its SQLite data sat there unseen.
|
|
//
|
|
// spawnSync because the decision needs an async Postgres probe and this must
|
|
// happen before the first `require` of knexfile. It short-circuits without
|
|
// probing when DATABASE_CLIENT is already set, so the entrypoint path pays
|
|
// nothing.
|
|
// Also run it when a migration pin exists: an explicit DATABASE_CLIENT=pg
|
|
// would otherwise skip the check and start against a half-migrated Postgres
|
|
// while SQLite is still the database of record.
|
|
if (!process.env.DATABASE_CLIENT
|
|
|| require('./src/utils/databaseEngine').hasMigrationInProgress()) {
|
|
const { spawnSync } = require('child_process');
|
|
const probe = spawnSync(
|
|
process.execPath,
|
|
[require('path').join(__dirname, 'scripts', 'resolve-db-engine.js')],
|
|
{ encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit'] }
|
|
);
|
|
// Exit 3: two populated databases and no record of which is authoritative.
|
|
// The resolver has printed the comparison and the two ways to resolve it;
|
|
// starting either engine would hide the other's data.
|
|
if (probe.status === 3) {
|
|
process.exit(1);
|
|
}
|
|
const resolved = (probe.stdout || '').trim();
|
|
if (probe.status === 0 && resolved) {
|
|
process.env.DATABASE_CLIENT = resolved;
|
|
// Pin the CONNECTION too, not just the client. knexfile's development block
|
|
// defaults Postgres to localhost/postgres/photo_sharing and production to
|
|
// db/picpeak/picpeak, so naming only the client can point this process at a
|
|
// different database than the resolver probed — with SQLite already retired.
|
|
if (resolved === 'pg') {
|
|
const conn = require('./src/utils/databaseEngine').pgConnectionFromEnv();
|
|
process.env.DB_HOST = String(conn.host);
|
|
process.env.DB_PORT = String(conn.port);
|
|
process.env.DB_USER = String(conn.user);
|
|
process.env.DB_NAME = String(conn.database);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Initialize logger early to capture startup logs
|
|
const logger = require('./src/utils/logger');
|
|
logger.info('Server starting up', {
|
|
nodeVersion: process.version,
|
|
environment: process.env.NODE_ENV || 'development',
|
|
// Which database this process actually talks to (#1038). Nothing logged this
|
|
// before, so an install silently running on SQLite with Postgres configured
|
|
// had no way to notice.
|
|
database: require('./src/utils/databaseEngine').describeEngine(require('./knexfile')),
|
|
timestamp: new Date().toISOString()
|
|
});
|
|
|
|
const fs = require('fs');
|
|
const express = require('express');
|
|
const helmet = require('helmet');
|
|
const compression = require('compression');
|
|
const cors = require('cors');
|
|
const path = require('path');
|
|
const { initializeDatabase, db } = require('./src/database/db');
|
|
const {
|
|
getFrontendBaseUrlSync,
|
|
getAbsoluteFrontendUrl,
|
|
primeSiteUrlCache,
|
|
} = require('./src/utils/frontendUrl');
|
|
const { startFileWatcher } = require('./src/services/fileWatcher');
|
|
const { startExpirationChecker } = require('./src/services/expirationChecker');
|
|
const { startTransferCleanup } = require('./src/services/transferCleanupService');
|
|
const { startDownloadJobCleanup } = require('./src/services/downloadJobCleanupService');
|
|
const { startRevealScheduler } = require('./src/services/revealScheduler');
|
|
const { startInvoiceScheduler } = require('./src/services/invoiceSchedulerService');
|
|
const { initializeTransporter, startEmailQueueProcessor } = require('./src/services/emailProcessor');
|
|
const emailWebhookTransport = require('./src/services/emailWebhookTransport');
|
|
const { startBackupService } = require('./src/services/backupService');
|
|
const { startScheduledBackups } = require('./src/services/databaseBackup');
|
|
const backgroundProcessor = require('./src/services/backgroundProcessor');
|
|
const { maintenanceMiddleware } = require('./src/middleware/maintenance');
|
|
const { sessionTimeoutMiddleware } = require('./src/middleware/sessionTimeout');
|
|
const { errorHandler, notFoundHandler } = require('./src/middleware/errorHandler');
|
|
const rateLimitService = require('./src/services/rateLimitService');
|
|
const { createApiRateLimitGate } = require('./src/middleware/apiRateLimitGate');
|
|
const { createAuthRateLimitGate } = require('./src/middleware/authRateLimitGate');
|
|
const { getPublicSitePayload } = require('./src/services/publicSiteService');
|
|
const cookieParser = require('cookie-parser');
|
|
const {
|
|
getAdminTokenFromRequest,
|
|
getGalleryTokenFromRequest,
|
|
} = require('./src/utils/tokenUtils');
|
|
|
|
// Import routes
|
|
const authRoutes = require('./src/routes/auth');
|
|
const galleryRoutes = require('./src/routes/gallery');
|
|
const adminRoutes = require('./src/routes/admin');
|
|
const adminAuthRoutes = require('./src/routes/adminAuth');
|
|
const secureImagesRoutes = require('./src/routes/secureImages');
|
|
const setupRoutes = require('./src/routes/setup');
|
|
|
|
const app = express();
|
|
const PORT = process.env.PORT || 3000;
|
|
|
|
// Trust proxy headers (required for Traefik/nginx).
|
|
//
|
|
// `req.ip` is computed by Express by walking X-Forwarded-For from
|
|
// right-to-left and stopping at the first hop NOT in this list, so
|
|
// the value picpeak audits (signing IPs, payment-check actions,
|
|
// rate-limit keys) is the originating client IP behind any number
|
|
// of trusted reverse proxies.
|
|
//
|
|
// Default: 'loopback, linklocal, uniquelocal' — covers localhost,
|
|
// link-local (169.254.0.0/16), and unique-local IPv6 (fc00::/7).
|
|
// Standard for nginx-in-front-of-Node deployments on the same host
|
|
// and for Docker bridge networks. Operators with unusual topologies
|
|
// (load balancer in a public subnet, multi-hop NAT) override via
|
|
// TRUST_PROXY env, accepting any value Express accepts: a number,
|
|
// 'loopback', 'linklocal', 'uniquelocal', a CIDR, a comma list, or
|
|
// 'true' (trust ALL proxies — only safe behind a fully-controlled
|
|
// reverse-proxy chain).
|
|
//
|
|
// NEVER read req.headers['x-forwarded-for'] directly in audit paths
|
|
// — see utils/clientIp.js for the rationale.
|
|
const trustProxySetting = process.env.TRUST_PROXY || 'loopback, linklocal, uniquelocal';
|
|
app.set('trust proxy', trustProxySetting === 'true' ? true : trustProxySetting);
|
|
|
|
// Security middleware with custom CSP
|
|
// In native HTTP installs, do NOT force HTTPS for subresources.
|
|
const enableHsts = process.env.ENABLE_HSTS === 'true';
|
|
const cspDirectives = {
|
|
defaultSrc: ["'self'"],
|
|
scriptSrc: [
|
|
"'self'",
|
|
'https://www.google.com',
|
|
'https://www.gstatic.com'
|
|
],
|
|
styleSrc: ["'self'", "'unsafe-inline'", "https:"], // Required for styled components
|
|
imgSrc: ["'self'", "data:", "https:", "blob:"], // Allow data URLs and external images
|
|
connectSrc: ["'self'", 'https://www.google.com', 'https://www.gstatic.com'], // API connections
|
|
fontSrc: ["'self'", "https:", "data:"], // Web fonts
|
|
objectSrc: ["'none'"], // Disable plugins
|
|
mediaSrc: ["'self'"], // Audio/video
|
|
frameSrc: ["'self'", 'https://www.google.com'],
|
|
};
|
|
// Only upgrade insecure requests when HSTS explicitly enabled (HTTPS deployment)
|
|
if (enableHsts) {
|
|
// In helmet, an empty array enables the directive
|
|
cspDirectives.upgradeInsecureRequests = [];
|
|
}
|
|
|
|
app.use(cookieParser());
|
|
|
|
app.use((req, res, next) => {
|
|
if (req.headers.authorization) {
|
|
return next();
|
|
}
|
|
|
|
const path = req.path || '';
|
|
const slugMatch = path.match(/\/api\/(?:gallery|secure-images)\/([^\/]+)/);
|
|
const slug = slugMatch ? slugMatch[1] : req.requestedSlug;
|
|
const adminToken = getAdminTokenFromRequest(req);
|
|
const galleryToken = getGalleryTokenFromRequest(req, slug);
|
|
|
|
const isAdminRequest = path.startsWith('/api/admin') || path.startsWith('/admin');
|
|
const isGalleryRequest = Boolean(slugMatch)
|
|
|| path.startsWith('/api/gallery')
|
|
|| path.startsWith('/gallery')
|
|
|| path.startsWith('/api/secure-images');
|
|
|
|
// Prefer admin credentials on admin routes so gallery sessions cannot override them.
|
|
if (isAdminRequest) {
|
|
if (adminToken) {
|
|
req.headers.authorization = `Bearer ${adminToken}`;
|
|
}
|
|
} else if (isGalleryRequest) {
|
|
if (galleryToken) {
|
|
req.headers.authorization = `Bearer ${galleryToken}`;
|
|
} else if (adminToken) {
|
|
req.headers.authorization = `Bearer ${adminToken}`;
|
|
}
|
|
} else if (adminToken) {
|
|
req.headers.authorization = `Bearer ${adminToken}`;
|
|
} else if (galleryToken) {
|
|
req.headers.authorization = `Bearer ${galleryToken}`;
|
|
}
|
|
|
|
next();
|
|
});
|
|
|
|
app.use(helmet({
|
|
contentSecurityPolicy: {
|
|
// Avoid helmet adding defaults like upgrade-insecure-requests when not desired
|
|
useDefaults: false,
|
|
directives: cspDirectives,
|
|
},
|
|
hsts: enableHsts ? {
|
|
maxAge: 31536000, // 1 year
|
|
includeSubDomains: true,
|
|
preload: true
|
|
} : false,
|
|
permittedCrossDomainPolicies: false,
|
|
referrerPolicy: { policy: "strict-origin-when-cross-origin" }
|
|
}));
|
|
|
|
// Additional security headers
|
|
app.use((req, res, next) => {
|
|
// Permissions Policy (controls browser features)
|
|
res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()');
|
|
next();
|
|
});
|
|
|
|
// CORS configuration (apply only to API routes)
|
|
const { isAllowedOrigin, multipartOriginAllowed } = require('./src/utils/requestOrigin');
|
|
|
|
const corsOptions = {
|
|
origin: function (origin, callback) {
|
|
// getFrontendBaseUrlSync() resolves FRONTEND_URL, else the configured
|
|
// general_site_url (#705) — without it, an install that leaves the
|
|
// environment untouched and answers the setup wizard instead would have
|
|
// its own public origin missing from the allowlist.
|
|
// Allow requests with no origin (like curl) and allow-listed origins
|
|
if (!origin || isAllowedOrigin(origin)) {
|
|
callback(null, true);
|
|
} else {
|
|
// Do not error globally; just omit CORS headers on disallowed origins
|
|
callback(null, false);
|
|
}
|
|
},
|
|
credentials: true,
|
|
// Expose Content-Disposition so split (cross-origin) frontend
|
|
// deployments can read the server's chosen download filename. Used
|
|
// by the gallery/admin download flows to honour the #493 "original
|
|
// camera filename" toggle on individual photo downloads (#507).
|
|
//
|
|
// Retry-After is not CORS-safelisted either. AuthenticatedImage reads it
|
|
// off a 429 to wait out the rate-limit window before retrying a thumbnail
|
|
// fetch; without it a split-origin deployment would spend its retry budget
|
|
// inside the window and leave the tile blank after the limit had lifted.
|
|
exposedHeaders: ['Content-Disposition', 'Retry-After'],
|
|
};
|
|
|
|
// Only attach CORS to API endpoints, not static assets
|
|
app.use('/api', cors(corsOptions));
|
|
// Handle preflight explicitly for API paths
|
|
app.options('/api/*', cors(corsOptions));
|
|
|
|
// Same-origin proxy for the configured analytics tracker. Mounted HERE, ahead
|
|
// of the body parsers, so the tracker's beacon payload reaches the proxy as a
|
|
// raw buffer (express.json would consume it, and the CSRF Content-Type gate
|
|
// below would 415 a navigator.sendBeacon `text/plain` POST). It carries no
|
|
// PicPeak state and reads no PicPeak credentials — see the route file for the
|
|
// SSRF/path-allowlist model.
|
|
app.use('/api/analytics/tracker', require('./src/routes/analyticsTrackerProxy'));
|
|
|
|
// Health check endpoint. `pid` + `uptime` let monitors (and the local E2E
|
|
// watchdog) detect a silent process restart between two checks.
|
|
//
|
|
// Served at BOTH paths: /health is the canonical one, /api/health exists
|
|
// because probes reasonably assume the API lives under /api and otherwise
|
|
// produce a "route not found" warning on every poll. Same handler, same body,
|
|
// same (public) exposure — the alias adds no information.
|
|
//
|
|
// Mounted HERE, ahead of the API middleware chain, so a probe running every
|
|
// couple of seconds does not pay for — or pollute — the body parsers, the
|
|
// request logger, the maintenance gate (/health is on its skip list anyway)
|
|
// or the rate limiter's per-IP budget.
|
|
app.get(['/health', '/api/health'], async (req, res) => {
|
|
try {
|
|
await db.raw('SELECT 1');
|
|
res.json({
|
|
status: 'ok',
|
|
timestamp: new Date().toISOString(),
|
|
pid: process.pid,
|
|
uptime: process.uptime()
|
|
});
|
|
} catch (error) {
|
|
logger.error('Health check failed:', error);
|
|
res.status(503).json({
|
|
status: 'error',
|
|
timestamp: new Date().toISOString(),
|
|
pid: process.pid,
|
|
uptime: process.uptime()
|
|
});
|
|
}
|
|
});
|
|
|
|
// Initialize rate limiters (they will be created dynamically)
|
|
|
|
function composeInlineStyles(payload) {
|
|
const { branding } = payload;
|
|
const cssSegments = [];
|
|
|
|
cssSegments.push(`:root {
|
|
--brand-primary: ${branding.colors.primary};
|
|
--brand-accent: ${branding.colors.accent};
|
|
--brand-background: ${branding.colors.background};
|
|
--brand-text: ${branding.colors.text};
|
|
--brand-surface: ${branding.colors.surface || '#ffffff'};
|
|
--brand-elevated: ${branding.colors.elevated || '#f5f5f5'};
|
|
--brand-border: ${branding.colors.border || '#e5e5e5'};
|
|
--brand-muted-text: ${branding.colors.mutedText || '#737373'};
|
|
}`);
|
|
|
|
if (payload.baseCss) {
|
|
cssSegments.push(payload.baseCss);
|
|
}
|
|
|
|
if (payload.css) {
|
|
cssSegments.push(`/* Custom styles */\n${payload.css}`);
|
|
}
|
|
|
|
return cssSegments.join('\n\n');
|
|
}
|
|
|
|
function escapeHtml(str) {
|
|
if (!str) return '';
|
|
return String(str)
|
|
.replace(/&/g, '&')
|
|
.replace(/</g, '<')
|
|
.replace(/>/g, '>')
|
|
.replace(/"/g, '"')
|
|
.replace(/'/g, ''');
|
|
}
|
|
|
|
function renderBrandHeader(branding) {
|
|
const displayName = escapeHtml(branding.companyName || 'PicPeak');
|
|
const logoSrc = encodeURI(branding.logoUrl || '/picpeak-logo-transparent.png');
|
|
const logo = `<img src="${logoSrc}" alt="${displayName}" class="brand-logo" loading="lazy" decoding="async" />`;
|
|
|
|
const tagline = branding.companyTagline
|
|
? `<p class="brand-tagline">${escapeHtml(branding.companyTagline)}</p>`
|
|
: '';
|
|
|
|
return `<header class="site-header">
|
|
<div class="header-inner">
|
|
<div class="brand">
|
|
${logo}
|
|
<div class="brand-copy">
|
|
<p class="brand-label">${displayName}</p>
|
|
${tagline}
|
|
</div>
|
|
</div>
|
|
<nav class="site-nav">
|
|
<a href="#features">${'Features'}</a>
|
|
<a href="#workflow">${'Workflow'}</a>
|
|
<a href="#collections">${'Collections'}</a>
|
|
<a href="#stories">${'Stories'}</a>
|
|
<a href="#contact">${'Contact'}</a>
|
|
</nav>
|
|
</div>
|
|
</header>`;
|
|
}
|
|
|
|
function renderBrandFooter(branding) {
|
|
const displayName = escapeHtml(branding.companyName || 'PicPeak');
|
|
const footerNote = branding.footerText
|
|
? `<p>${escapeHtml(branding.footerText)}</p>`
|
|
: '<p>Powered by PicPeak to keep every celebration beautifully organised.</p>';
|
|
|
|
const supportEmail = escapeHtml(branding.supportEmail || '');
|
|
const supportLink = supportEmail
|
|
? `<a href="mailto:${supportEmail}">Support</a>`
|
|
: '';
|
|
|
|
const legalLinks = `
|
|
<a href="/datenschutz">Privacy Policy</a>
|
|
<a href="/impressum">Impressum</a>
|
|
${supportLink}
|
|
`;
|
|
|
|
return `<footer class="site-footer" id="contact">
|
|
<div class="footer-inner">
|
|
<div>
|
|
<h2>${displayName}</h2>
|
|
${footerNote}
|
|
</div>
|
|
<div class="footer-links">
|
|
${legalLinks}
|
|
</div>
|
|
</div>
|
|
</footer>`;
|
|
}
|
|
|
|
function buildSeoMetaTags(seoSettings) {
|
|
const tags = [];
|
|
const robotsDirectives = [];
|
|
|
|
if (seoSettings.seo_meta_noindex) robotsDirectives.push('noindex');
|
|
if (seoSettings.seo_meta_nofollow) robotsDirectives.push('nofollow');
|
|
|
|
if (robotsDirectives.length > 0) {
|
|
tags.push(`<meta name="robots" content="${robotsDirectives.join(', ')}" />`);
|
|
}
|
|
|
|
if (seoSettings.seo_meta_noai) {
|
|
tags.push('<meta name="robots" content="noai, noimageai" />');
|
|
}
|
|
|
|
return tags.join('\n ');
|
|
}
|
|
|
|
function buildPublicSiteDocument(payload) {
|
|
const inlineStyles = composeInlineStyles(payload);
|
|
const header = renderBrandHeader(payload.branding);
|
|
const footer = renderBrandFooter(payload.branding);
|
|
const seoMeta = payload.seoSettings ? buildSeoMetaTags(payload.seoSettings) : '';
|
|
|
|
return `<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<title>${escapeHtml(payload.title)}</title>
|
|
<meta name="description" content="Curated photo galleries and stories from unforgettable celebrations." />
|
|
${seoMeta}
|
|
<link rel="preconnect" href="https://fonts.googleapis.com" />
|
|
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
|
|
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet" />
|
|
<style>${inlineStyles}</style>
|
|
</head>
|
|
<body>
|
|
<div class="site-shell">
|
|
${header}
|
|
<main class="site-main">
|
|
${payload.html}
|
|
</main>
|
|
${footer}
|
|
</div>
|
|
</body>
|
|
</html>`;
|
|
}
|
|
|
|
async function handlePublicSiteRequest(req, res, next) {
|
|
try {
|
|
const payload = await getPublicSitePayload();
|
|
|
|
if (!payload.enabled) {
|
|
res.redirect(302, '/admin/login');
|
|
return;
|
|
}
|
|
|
|
if (payload.etag && req.headers['if-none-match'] === payload.etag) {
|
|
res.status(304).end();
|
|
return;
|
|
}
|
|
|
|
// Inject SEO meta settings into payload
|
|
try {
|
|
const seoRows = await db('app_settings')
|
|
.where('setting_type', 'seo')
|
|
.whereIn('setting_key', ['seo_meta_noindex', 'seo_meta_nofollow', 'seo_meta_noai'])
|
|
.select('setting_key', 'setting_value');
|
|
const seoSettings = {};
|
|
for (const row of seoRows) {
|
|
let val = row.setting_value;
|
|
if (typeof val === 'string') { try { val = JSON.parse(val); } catch {} }
|
|
seoSettings[row.setting_key] = val;
|
|
}
|
|
payload.seoSettings = seoSettings;
|
|
} catch {}
|
|
|
|
const document = buildPublicSiteDocument(payload);
|
|
|
|
res.setHeader('Content-Type', 'text/html; charset=utf-8');
|
|
res.setHeader('Cache-Control', 'public, max-age=30, must-revalidate');
|
|
res.setHeader('ETag', payload.etag);
|
|
res.setHeader('Vary', 'Accept-Encoding');
|
|
res.setHeader('Content-Security-Policy', "default-src 'self'; frame-ancestors 'none'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline' https:; font-src 'self' https: data:; object-src 'none'; script-src 'self'; form-action 'self'");
|
|
|
|
res.status(200).send(document);
|
|
} catch (error) {
|
|
logger.error('Failed to render public site', { error: error.message });
|
|
next();
|
|
}
|
|
}
|
|
|
|
// Function to initialize rate limiters
|
|
async function initializeRateLimiters() {
|
|
// The instances live in rateLimitService so the settings route can
|
|
// rebuild them when the window changes (#1337); the gates below read
|
|
// them per request through the service's getters.
|
|
await rateLimitService.initializeRateLimiters();
|
|
|
|
// Neither limiter is registered here — an app.use() at this point runs after
|
|
// the routers, the /api 404 handler and the error handler are already on the
|
|
// stack, so it can never see a request. Both are reached through their gates
|
|
// below, which are registered ahead of the routers and read these variables
|
|
// per request.
|
|
//
|
|
// The five prefix registrations of authRateLimiter that used to live here
|
|
// were inert for that reason, and could not simply be moved up either: the
|
|
// widest of them mounted on the whole /api/auth router, so the 5-per-window
|
|
// auth budget would have covered GET /api/auth/session and POST
|
|
// /api/auth/password-strength, which the frontend calls far more often than
|
|
// five times per window. authRateLimitGate matches exact method + path
|
|
// instead, and counts only failed attempts.
|
|
}
|
|
|
|
// Rate limiting for /api. Registered HERE — above the routers — because
|
|
// Express dispatches in registration order; see apiRateLimitGate for the full
|
|
// story. The gate is a no-op until initializeRateLimiters() resolves, and it
|
|
// must stay unmounted (no path argument) so req.path keeps its /api prefix.
|
|
// /health and /api/health are mounted above this point and so are never
|
|
// counted, which matters because monitors poll them every couple of seconds.
|
|
app.use(createApiRateLimitGate(rateLimitService.getGeneralLimiter));
|
|
|
|
// Per-IP limit for credential-verification endpoints only, on its own bucket.
|
|
// Registered after the general gate so that an IP already over the /api budget
|
|
// is rejected there first; see authRateLimitGate for the exact endpoint table
|
|
// and why it must stay unmounted.
|
|
app.use(createAuthRateLimitGate(rateLimitService.getAuthLimiter));
|
|
|
|
// Body limits. 50mb is only needed by the authenticated admin and API-token
|
|
// surfaces (restore manifests, CMS and email templates, bulk operations);
|
|
// applied globally it let any unauthenticated caller hand JSON.parse a 50mb
|
|
// body and block the event loop. express.json skips a request whose body
|
|
// is already parsed, so the scoped parser must run first.
|
|
app.use(['/api/admin', '/api/v1'], express.json({ limit: '50mb' }));
|
|
app.use(express.json({ limit: '2mb' }));
|
|
app.use(express.urlencoded({ extended: true, limit: '2mb' }));
|
|
|
|
// CSRF protection: require JSON Content-Type on mutating API requests
|
|
// This blocks cross-origin form submissions which cannot set Content-Type: application/json
|
|
app.use('/api', (req, res, next) => {
|
|
if (['POST', 'PUT', 'DELETE', 'PATCH'].includes(req.method)) {
|
|
const contentType = req.headers['content-type'] || '';
|
|
const contentLength = parseInt(req.headers['content-length'] || '0', 10);
|
|
// Allow empty-body requests (e.g. logout), multipart for uploads, and JSON for API calls
|
|
if (contentLength > 0 && !contentType.includes('application/json') && !contentType.includes('multipart/form-data')) {
|
|
return res.status(415).json({ error: 'Unsupported Content-Type. Use application/json or multipart/form-data.' });
|
|
}
|
|
// multipart is exactly what a cross-site <form> can send without a
|
|
// preflight, and in a split-origin deployment (SameSite=None) the admin
|
|
// cookie rides along to the upload routes. Browsers label such a
|
|
// submission Sec-Fetch-Site: cross-site (and always send Origin on a
|
|
// cross-origin POST); non-browser clients send neither header and pass.
|
|
if (contentType.includes('multipart/form-data') && !multipartOriginAllowed(req)) {
|
|
return res.status(403).json({ error: 'Cross-site multipart request rejected' });
|
|
}
|
|
}
|
|
next();
|
|
});
|
|
|
|
// Request logging for API routes (with timestamps)
|
|
const apiRequestLogger = (req, res, next) => {
|
|
try {
|
|
const started = Date.now();
|
|
const ts = new Date().toISOString();
|
|
logger.info(`[${ts}] ${req.method} ${req.originalUrl}`);
|
|
res.on('finish', () => {
|
|
const ms = Date.now() - started;
|
|
const tsDone = new Date().toISOString();
|
|
logger.info(`[${tsDone}] ${req.method} ${req.originalUrl} -> ${res.statusCode} (${ms}ms)`);
|
|
});
|
|
} catch (_) {}
|
|
next();
|
|
};
|
|
app.use('/api', apiRequestLogger);
|
|
|
|
// Maintenance mode middleware - add after body parsing but before routes
|
|
app.use(maintenanceMiddleware);
|
|
|
|
// Session timeout middleware for admin routes
|
|
app.use('/api/admin', sessionTimeoutMiddleware);
|
|
|
|
// Middleware to set CORS headers for static files
|
|
const setCorsHeaders = (req, res, next) => {
|
|
const origin = req.headers.origin;
|
|
const staticAllowedOrigins = [
|
|
getFrontendBaseUrlSync() || 'http://localhost:3005',
|
|
process.env.ADMIN_URL || 'http://localhost:3005'
|
|
];
|
|
if (process.env.NODE_ENV === 'development') {
|
|
staticAllowedOrigins.push(
|
|
'http://localhost:5173',
|
|
'http://localhost:3002',
|
|
'http://localhost:3001',
|
|
'http://localhost:3000'
|
|
);
|
|
}
|
|
if (origin && staticAllowedOrigins.indexOf(origin) !== -1) {
|
|
res.header('Access-Control-Allow-Origin', origin);
|
|
res.header('Access-Control-Allow-Credentials', 'true');
|
|
}
|
|
res.header('Cross-Origin-Resource-Policy', 'cross-origin');
|
|
next();
|
|
};
|
|
|
|
// Import secure static middleware
|
|
const secureStatic = require('./src/middleware/secureStatic');
|
|
|
|
// Get storage path from environment or use default
|
|
const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../storage');
|
|
process.env.EXTERNAL_MEDIA_ROOT = process.env.EXTERNAL_MEDIA_ROOT || '/external-media';
|
|
|
|
// The /photos and /thumbnails static mounts are gone.
|
|
//
|
|
// They served the raw originals tree and the thumbnail tree behind photoAuth
|
|
// alone, which authorises on a slug match. A static file server cannot apply
|
|
// the rules the gallery API applies per photo, so everything the API decides
|
|
// was simply absent here: allow_downloads, per-category allow_downloads,
|
|
// watermarking, the resolution cap, reveal-mode windows, visibility='hidden',
|
|
// download logging, and the customer-assignment re-check that lets an admin
|
|
// revoke access immediately. The filenames needed to exercise it are handed to
|
|
// every guest in the photos listing.
|
|
//
|
|
// Nothing builds these URLs: no reference in frontend/src, none in the email
|
|
// templates, and the only backend mentions are the /api/admin/photos/... API
|
|
// routes and a maintenance-mode prefix list. nginx still proxies /photos and
|
|
// /thumbnails; those locations now 404, which is the intended outcome.
|
|
//
|
|
// Serving these safely would mean reimplementing per-photo authorisation and
|
|
// image processing inside a static handler -- i.e. the gallery API, which
|
|
// already exists at /api/gallery/:slug/photo/:id and /thumbnail/:id.
|
|
|
|
// Static file serving for uploads.
|
|
//
|
|
// Narrowed to the two public asset trees. The mount used to expose the whole
|
|
// uploads/ root with no auth middleware at all, and that root also holds
|
|
// signed contract PDFs (uploads/contracts/signed) and client transfer files
|
|
// (uploads/transfers/<id>) -- both reachable by anyone who learned or guessed
|
|
// a filename. Those are served by their own authorised routes.
|
|
app.use('/uploads/logos', setCorsHeaders, secureStatic(path.join(storagePath, 'uploads/logos')));
|
|
app.use('/uploads/favicons', setCorsHeaders, secureStatic(path.join(storagePath, 'uploads/favicons')));
|
|
|
|
// Static file serving for self-hosted webfonts (public — gallery visitors
|
|
// load these via @font-face). Replaces the previous Google Fonts CDN
|
|
// dependency, which leaked visitor IPs to a third party (LG München 2022
|
|
// GDPR ruling).
|
|
//
|
|
// Two mounts in priority order:
|
|
// 1. STORAGE_PATH/fonts/ — runtime user additions (drop a folder, restart)
|
|
// 2. backend/assets/fonts/ — bundled defaults baked into the image
|
|
// Express evaluates handlers in order, so user-supplied files win on overlap.
|
|
//
|
|
// We deliberately do NOT set `immutable` on these responses. The filenames
|
|
// are stable (e.g. Inter/400.woff2), so an admin replacing the file on disk
|
|
// must be able to roll out the change to clients. With max-age + Last-Modified
|
|
// (set by express.static from file mtime), browsers send If-Modified-Since
|
|
// after expiry and pick up the new version automatically. See https://docs.picpeak.app/guides/custom-fonts
|
|
// "Replacing an existing font" for the documented rollout strategy.
|
|
const fontStaticOpts = { maxAge: '7d' };
|
|
app.use(
|
|
'/fonts',
|
|
setCorsHeaders,
|
|
secureStatic(path.join(storagePath, 'fonts'), fontStaticOpts)
|
|
);
|
|
app.use(
|
|
'/fonts',
|
|
setCorsHeaders,
|
|
secureStatic(path.resolve(__dirname, 'assets/fonts'), fontStaticOpts)
|
|
);
|
|
|
|
// Debug endpoint to check IP detection (only in development)
|
|
if (process.env.NODE_ENV === 'development') {
|
|
app.get('/api/debug/ip', (req, res) => {
|
|
const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() ||
|
|
req.headers['x-real-ip'] ||
|
|
req.connection.remoteAddress ||
|
|
req.ip;
|
|
|
|
res.json({
|
|
detectedIp: clientIp,
|
|
reqIp: req.ip,
|
|
headers: {
|
|
'x-forwarded-for': req.headers['x-forwarded-for'],
|
|
'x-real-ip': req.headers['x-real-ip'],
|
|
'x-forwarded-proto': req.headers['x-forwarded-proto'],
|
|
'x-forwarded-host': req.headers['x-forwarded-host']
|
|
},
|
|
trustProxy: app.get('trust proxy')
|
|
});
|
|
});
|
|
}
|
|
|
|
// OG/Twitter-card preview endpoint for gallery share URLs. Crawlers (WhatsApp,
|
|
// Slack, Facebook, etc.) don't execute JS, so the SPA's client-side meta tags
|
|
// never reach them. nginx routes UA-detected crawlers from /gallery/:slug to
|
|
// here; humans still get the SPA via try_files.
|
|
const {
|
|
isSocialCrawler,
|
|
handleGalleryOgRequest,
|
|
handleGalleryOgCover,
|
|
} = require('./src/services/galleryOgService');
|
|
app.get('/og/gallery/:slug', handleGalleryOgRequest);
|
|
// Public hero-photo cover served as og:image when the admin has flipped
|
|
// events.og_image_share_enabled (#474). Unauthenticated by design;
|
|
// returns 404 unless the opt-in is on AND a hero_photo_id is set.
|
|
app.get('/og/gallery/:slug/cover', handleGalleryOgCover);
|
|
|
|
// Branded URL shortener (#699). /s/<short_slug> is bot-UA aware:
|
|
// - Social crawler → server-render OG for the target event so the
|
|
// SHORT URL itself is what scrapes cache against. The og:url canonical
|
|
// in the rendered HTML points back at /s/<slug>, not the underlying
|
|
// gallery URL — so a re-share of the same short URL keeps the cache
|
|
// warm even if the underlying gallery slug rotates.
|
|
// - Browser → 302 to the stored target_path. The target_path was
|
|
// captured at create time from the event's slug + share_token + the
|
|
// global "Use short gallery URLs" setting, so it doesn't silently
|
|
// change later.
|
|
// - Soft-deleted → 410 Gone so the admin can tell their delete worked
|
|
// vs. a typo'd unknown slug (which returns 404).
|
|
const galleryShortUrlService = require('./src/services/galleryShortUrlService');
|
|
const { buildOgMetadata, renderOgHtml } = require('./src/services/galleryOgService');
|
|
app.get('/s/:shortSlug', async (req, res) => {
|
|
try {
|
|
const row = await galleryShortUrlService.findByShortSlug(req.params.shortSlug);
|
|
if (!row) {
|
|
return res.status(404).type('text/plain').send('Short URL not found');
|
|
}
|
|
if (row.deleted_at) {
|
|
return res.status(410).type('text/plain').send('Short URL has been removed');
|
|
}
|
|
|
|
// Bot UA → render OG metadata for the target event. We look up the
|
|
// event via the short URL's event_id rather than re-parsing the
|
|
// target_path so a future migration that adds new target shapes
|
|
// (slideshow, client-access) doesn't need to rewrite the URL parser.
|
|
if (isSocialCrawler(req.get('user-agent'))) {
|
|
const event = await require('./src/database/db').db('events')
|
|
.where({ id: row.event_id })
|
|
.first('slug');
|
|
if (event?.slug) {
|
|
const meta = await buildOgMetadata(event.slug, req.originalUrl);
|
|
// Override the canonical to point at the SHORT URL itself —
|
|
// social platforms cache OG by URL, and the short URL is the
|
|
// one operators actually share, so that's the cache key we
|
|
// want them to stick with.
|
|
const base = await getAbsoluteFrontendUrl(req);
|
|
meta.url = `${base}/s/${row.short_slug}`;
|
|
res.set('Cache-Control', 'public, max-age=300');
|
|
res.set('Content-Type', 'text/html; charset=utf-8');
|
|
res.send(renderOgHtml(meta));
|
|
// Hit accounting is fire-and-forget — don't block the bot.
|
|
galleryShortUrlService.recordHit(row.id).catch(() => {});
|
|
return;
|
|
}
|
|
// Event disappeared (FK CASCADE in flight, or admin hard-deleted
|
|
// outside the normal soft-delete path) — fall through to 410 so
|
|
// the scraper sees a clean signal.
|
|
return res.status(410).type('text/plain').send('Short URL points at a deleted event');
|
|
}
|
|
|
|
// Browser path: redirect. Hit accounting is fire-and-forget.
|
|
galleryShortUrlService.recordHit(row.id).catch(() => {});
|
|
return res.redirect(302, row.target_path);
|
|
} catch (err) {
|
|
logger.error('Short URL resolver failed', { slug: req.params.shortSlug, error: err.message });
|
|
return res.status(500).type('text/plain').send('Internal server error');
|
|
}
|
|
});
|
|
|
|
// robots.txt endpoint (dynamic, served from DB settings)
|
|
const { generateRobotsTxt } = require('./src/services/robotsTxtService');
|
|
app.get('/robots.txt', async (req, res) => {
|
|
try {
|
|
const robotsTxt = await generateRobotsTxt();
|
|
res.setHeader('Content-Type', 'text/plain');
|
|
res.setHeader('Cache-Control', 'public, max-age=3600');
|
|
res.status(200).send(robotsTxt);
|
|
} catch (error) {
|
|
logger.error('Failed to generate robots.txt', { error: error.message });
|
|
// Safe default for a private photo platform
|
|
res.setHeader('Content-Type', 'text/plain');
|
|
res.status(200).send('User-agent: *\nDisallow: /\n');
|
|
}
|
|
});
|
|
|
|
// Dynamic favicon endpoints. Browsers — notably Safari — request
|
|
// /favicon.ico and /apple-touch-icon*.png directly at the site root and are
|
|
// unreliable about honouring JS-injected <link rel="icon"> tags. Serving the
|
|
// admin's configured branding favicon here makes it work without client-side
|
|
// JS (and survive aggressive favicon caches). Falls back to the bundled asset
|
|
// shipped with the frontend build when no custom favicon is set.
|
|
app.get(
|
|
['/favicon.ico', '/apple-touch-icon.png', '/apple-touch-icon-precomposed.png'],
|
|
async (req, res) => {
|
|
try {
|
|
const { getAppSetting } = require('./src/utils/appSettings');
|
|
const raw = await getAppSetting('branding_favicon_url', null);
|
|
const url = (raw && String(raw).trim()) || null;
|
|
if (url) {
|
|
// External URL — can't stream the bytes, so redirect (best effort).
|
|
if (/^https?:\/\//i.test(url)) return res.redirect(302, url);
|
|
// Local upload → stream the file bytes DIRECTLY rather than 302'ing.
|
|
// Safari does NOT reliably follow a redirect for favicon requests
|
|
// (it falls back to the HTML <link>, i.e. the bundled default),
|
|
// whereas Firefox/Chrome do — so a 302 worked everywhere except
|
|
// Safari. sendFile sets the right content-type from the extension.
|
|
const rel = String(url).replace(/^\/+/, '').replace(/^uploads\//, '');
|
|
// Containment is the two public asset trees, not the whole uploads/
|
|
// root: that root also holds signed contracts and client transfer
|
|
// files, and the favicon URL is an admin-writable setting, so the
|
|
// wider check let `/uploads/contracts/signed/<file>` be served here
|
|
// unauthenticated with a day of cache.
|
|
const uploadsRoot = path.resolve(path.join(storagePath, 'uploads'));
|
|
const resolved = path.resolve(path.join(uploadsRoot, rel));
|
|
const servableRoots = ['favicons', 'logos'].map((d) => path.join(uploadsRoot, d) + path.sep);
|
|
if (servableRoots.some((root) => resolved.startsWith(root)) && fs.existsSync(resolved)) {
|
|
// This route streams the file directly, bypassing the secureStatic
|
|
// middleware — so re-apply its SVG hardening here. An admin-uploaded
|
|
// SVG favicon could contain <script>; served at the top-level
|
|
// /favicon.ico origin without CSP that would be stored XSS. Keep in
|
|
// sync with secureStatic.js.
|
|
if (/\.svg$/i.test(resolved)) {
|
|
res.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:");
|
|
res.setHeader('X-Content-Type-Options', 'nosniff');
|
|
}
|
|
res.setHeader('Cache-Control', 'public, max-age=86400');
|
|
return res.sendFile(resolved);
|
|
}
|
|
}
|
|
} catch (error) {
|
|
logger.warn('Favicon lookup failed; serving bundled default', { error: error.message });
|
|
}
|
|
return res.redirect(302, '/favicon-32x32.png');
|
|
}
|
|
);
|
|
|
|
// Routes
|
|
app.use('/api/setup', setupRoutes); // public first-run bootstrap (self-closes after setup)
|
|
app.use('/api/auth', authRoutes);
|
|
app.use('/api/admin', require('./src/middleware/productUsage').productUsage);
|
|
app.use('/api/admin/usage', require('./src/routes/adminUsage'));
|
|
app.use('/api/admin/external-media', require('./src/routes/adminExternalMedia'));
|
|
// Gallery routes - main routes first, then feedback routes
|
|
app.use('/api/gallery', galleryRoutes);
|
|
app.use('/api/gallery', require('./src/routes/galleryFeedback'));
|
|
app.use('/api/gallery', require('./src/routes/galleryGuests'));
|
|
app.use('/api/admin', adminRoutes);
|
|
app.use('/api/admin/auth', adminAuthRoutes);
|
|
app.use('/api/admin/system', require('./src/routes/adminSystem'));
|
|
// Branded URL shortener admin CRUD (#699) — list/create/delete short URLs
|
|
// per event. Mounted at /api/admin so the routes appear at
|
|
// /api/admin/events/:eventId/short-urls and /api/admin/short-urls/:id.
|
|
app.use('/api/admin', require('./src/routes/adminShortUrls'));
|
|
app.use('/api/admin/feature-flags', require('./src/routes/adminFeatureFlags'));
|
|
app.use('/api/admin/whatsapp', require('./src/routes/adminWhatsapp'));
|
|
app.use('/api/admin/backup', require('./src/routes/adminBackup'));
|
|
app.use('/api/admin/database-backup', require('./src/routes/adminDatabaseBackup'));
|
|
app.use('/api/admin/feedback', require('./src/routes/adminFeedback'));
|
|
app.use('/api/admin', require('./src/routes/adminGuests'));
|
|
app.use('/api/admin/image-security', require('./src/routes/adminImageSecurity'));
|
|
app.use('/api/admin/thumbnails', require('./src/routes/adminThumbnails'));
|
|
app.use('/api/admin/photos', require('./src/routes/adminPhotoDimensions'));
|
|
app.use('/api/admin/photos', require('./src/routes/adminPhotos'));
|
|
app.use('/api/admin/photo-export', require('./src/routes/adminPhotoExport'));
|
|
app.use('/api/admin/css-templates', require('./src/routes/adminCssTemplates'));
|
|
app.use('/api/admin/events', require('./src/routes/adminEventRename'));
|
|
app.use('/api/admin/users', require('./src/routes/adminUsers'));
|
|
app.use('/api/admin/roles', require('./src/routes/adminRoles'));
|
|
// Customer portal (#354). The customerPortal feature flag is a
|
|
// VISIBILITY toggle for the admin surface, not a kill switch for
|
|
// customer access. Enforcement:
|
|
//
|
|
// 1. Frontend: RequireFeature guards + AdminSidebar visibility
|
|
// hide the Clients section when the flag is off. Customer-side
|
|
// /customer/* surfaces stay reachable.
|
|
// 2. Backend: NO route-level gate. The admin surface is gated by
|
|
// adminAuth + permission checks (admin still has rights to
|
|
// manage customer records even if the section is hidden in
|
|
// their UI). The customer surface is gated by customerAuth +
|
|
// is_active checks on customer_accounts.
|
|
//
|
|
// For close-to-realtime access changes use the dedicated tools:
|
|
// - Revoke a customer's access to ONE gallery → "Manage galleries"
|
|
// dialog removes the event_customer_assignments row, which
|
|
// verifyGalleryAccess re-checks on every customer-minted JWT.
|
|
// - Lock out a customer entirely → "Deactivate" sets is_active=false
|
|
// and bumps password_changed_at, killing every outstanding JWT.
|
|
// - Toggle per-customer feature surfaces (calendar/quotes/bills)
|
|
// → toggles on the customer detail page.
|
|
//
|
|
// Putting the global flag in the kill-switch role was a mistake — a
|
|
// stray click in Settings → Features would lock every paying
|
|
// customer out at once. PR-revert moved the gate back to per-record.
|
|
//
|
|
// `noStoreCache` belt-and-braces the cache-control story for both
|
|
// surfaces: any response — 200, 4xx, 5xx — carries `Cache-Control:
|
|
// no-store` so a transient error (the now-reverted #458 410, a
|
|
// permission flip mid-session, a backend restart) can't get pinned
|
|
// in browser or intermediate caches and outlive its cause. See the
|
|
// PR #458 → #470 history in the middleware file for context.
|
|
const { noStoreCache } = require('./src/middleware/noStoreCache');
|
|
app.use('/api/admin/customers', noStoreCache, require('./src/routes/adminCustomers'));
|
|
// Customer-side surface (#354). Strictly separate from /api/admin/* —
|
|
// distinct token type, distinct cookie, distinct middleware. The
|
|
// noStoreCache wrapper (upstream) prevents stale customer-portal
|
|
// data from being served after logout. The CRM-area route-flag
|
|
// gate was reverted upstream and lives in the UI now.
|
|
app.use('/api/customer/auth', noStoreCache, require('./src/routes/customerAuth'));
|
|
app.use('/api/customer', noStoreCache, require('./src/routes/customer'));
|
|
|
|
// --- CRM (#TBD) -------------------------------------------------------
|
|
// Quotes / Invoices / Contracts / Calendar / Tax report / Deals lineage.
|
|
// Business profile (issuer block for PDFs) lives at
|
|
// /api/admin/business-profile, gated by the existing settings.manage
|
|
// permission rather than a CRM-specific one. The public endpoints
|
|
// host the customer-side accept/decline / sign / payment-check pages.
|
|
app.use('/api/admin/business-profile', require('./src/routes/adminBusinessProfile'));
|
|
app.use('/api/admin/quotes', require('./src/routes/adminQuotes'));
|
|
app.use('/api/admin/invoices', require('./src/routes/adminInvoices'));
|
|
app.use('/api/admin/contracts', require('./src/routes/adminContracts'));
|
|
app.use('/api/admin/projects', require('./src/routes/adminProjects'));
|
|
app.use('/api/admin/calendar', require('./src/routes/adminCalendar'));
|
|
app.use('/api/admin/deals', require('./src/routes/adminDeals'));
|
|
app.use('/api/admin/workflows', require('./src/routes/adminWorkflows'));
|
|
app.use('/api/admin/tax-report', require('./src/routes/adminTaxReport'));
|
|
app.use('/api/admin/expenses', require('./src/routes/adminExpenses'));
|
|
app.use('/api/admin/ledger', require('./src/routes/adminLedger'));
|
|
// Read-only VAT-code registry for the invoice/quote editors — un-gated by the
|
|
// accounting flag (management stays under /ledger).
|
|
app.use('/api/admin/vat-codes', require('./src/routes/adminVatCodes'));
|
|
app.use('/api/admin/system-health', require('./src/routes/adminSystemHealth'));
|
|
app.use('/api/admin/dev', require('./src/routes/adminDev'));
|
|
app.use('/api/admin/transfers', require('./src/routes/adminTransfers'));
|
|
// Newsletter campaigns (#1264). Flag-gated inside the router.
|
|
app.use('/api/admin/newsletters', require('./src/routes/adminNewsletters'));
|
|
app.use('/api/public/quotes', require('./src/routes/publicQuotes'));
|
|
app.use('/api/public/contracts', require('./src/routes/publicContracts'));
|
|
// PicTransfer (#997): recipient download + client upload, token-authenticated.
|
|
app.use('/api/public/transfer', require('./src/routes/publicTransfer'));
|
|
app.use('/api/public/transfer-upload', require('./src/routes/publicTransferUpload'));
|
|
app.use('/api/public/payment-check', require('./src/routes/publicPaymentCheck'));
|
|
// Newsletter unsubscribe (#1264). Deliberately NOT flag-gated: turning the
|
|
// feature off must not break the links in mail that already went out.
|
|
app.use('/api/public/newsletter', require('./src/routes/publicNewsletter'));
|
|
app.use('/api/public/workflow-approvals', require('./src/routes/publicWorkflowApprovals'));
|
|
app.use('/api/admin/event-types', require('./src/routes/adminEventTypes'));
|
|
app.use('/api/admin/api-tokens', require('./src/routes/adminApiTokens'));
|
|
app.use('/api/admin/webhooks', require('./src/routes/adminWebhooks'));
|
|
// Public v1 API for n8n / external integrations (#322). Mounted under
|
|
// /api/v1; auth handled per-route via apiTokenAuth (Bearer tokens).
|
|
app.use('/api/v1', require('./src/middleware/productUsage').productUsageApi, require('./src/routes/v1/events'));
|
|
|
|
// Swagger UI for the v1 API. Admin-gated since it lists endpoint shapes
|
|
// that should not be enumerable to anonymous users (a common reduce-info-leak hardening).
|
|
{
|
|
const swaggerUi = require('swagger-ui-express');
|
|
const { adminAuth } = require('./src/middleware/auth');
|
|
const { getOpenApiSpec } = require('./src/openapi/spec');
|
|
app.get('/api/openapi.json', adminAuth, (_req, res) => res.json(getOpenApiSpec()));
|
|
app.use(
|
|
'/api/docs',
|
|
adminAuth,
|
|
swaggerUi.serve,
|
|
swaggerUi.setup(getOpenApiSpec(), { customSiteTitle: 'PicPeak API · v1' })
|
|
);
|
|
}
|
|
|
|
app.use('/api/invite', require('./src/routes/acceptInvite'));
|
|
app.use('/api/public/settings', require('./src/routes/publicSettings'));
|
|
app.use('/api/public/fonts', require('./src/routes/publicFonts'));
|
|
app.use('/api/public', require('./src/routes/publicCMS'));
|
|
app.use('/api/images', require('./src/routes/protectedImages'));
|
|
app.use('/api/secure-images', secureImagesRoutes);
|
|
|
|
// Optional: Serve built frontend (native installs and the all-in-one image, #1042)
|
|
// Set when the SPA is being served, and registered as a catch-all AFTER the
|
|
// /api 404 handler further down — see the registration site for why it cannot
|
|
// live inside this block.
|
|
let spaCatchAll = null;
|
|
try {
|
|
const serveFrontendEnv = process.env.SERVE_FRONTEND; // 'true' | 'false' | undefined
|
|
const frontendDir = process.env.FRONTEND_DIR || path.join(__dirname, '../frontend/dist');
|
|
const indexPath = path.join(frontendDir, 'index.html');
|
|
// Auto-serve when dist exists unless explicitly disabled
|
|
const shouldServe = (serveFrontendEnv === 'true') || ((serveFrontendEnv === undefined || serveFrontendEnv === 'auto') && fs.existsSync(indexPath));
|
|
if (shouldServe) {
|
|
logger.info(`Serving frontend from ${frontendDir}`);
|
|
|
|
// The built index.html carries ${BRAND_TITLE} / ${BRAND_DESCRIPTION}
|
|
// placeholders (#521) that the nginx image renders via envsubst in its
|
|
// entrypoint. Here the render happens once at boot, in memory — same
|
|
// semantics: locked to exactly these two vars (never the JS bundle's own
|
|
// template literals), defaults applied when unset, re-rendered on every
|
|
// process start so changing the env + restarting is enough.
|
|
const spaHtml = fs
|
|
.readFileSync(indexPath, 'utf8')
|
|
.split('${BRAND_TITLE}').join(process.env.BRAND_TITLE || 'PicPeak')
|
|
.split('${BRAND_DESCRIPTION}').join(process.env.BRAND_DESCRIPTION || 'Photo gallery shared with PicPeak.');
|
|
// Mirrors nginx's `location = /index.html` cache rule: the SPA shell must
|
|
// revalidate so a redeploy is picked up, while the hashed assets below
|
|
// cache immutably.
|
|
const sendSpa = (res) => {
|
|
res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
|
|
res.type('html').send(spaHtml);
|
|
};
|
|
|
|
// gzip for the SPA bundle (nginx parity — its server block gzips js/css/
|
|
// json). Mounted here, after every /api router, so API responses keep
|
|
// their exact current behavior; only the statics and SPA shell below
|
|
// pass through it.
|
|
app.use(compression());
|
|
|
|
// /index.html must serve the RENDERED shell, and express.static would
|
|
// otherwise answer first with the raw template straight off disk.
|
|
app.get('/index.html', (req, res) => sendSpa(res));
|
|
|
|
// Serve pre-built assets. index:false keeps `/` flowing to the landing-page
|
|
// handler below (nginx parity: `location = /` goes to the backend, it never
|
|
// serves index.html off disk) — express.static's default index option was
|
|
// shadowing handlePublicSiteRequest in native installs. Vite's hashed
|
|
// /assets/* get nginx's 1y-immutable rule; everything else keeps etag
|
|
// revalidation.
|
|
app.use(express.static(frontendDir, {
|
|
index: false,
|
|
setHeaders: (res, filePath) => {
|
|
if (/[/\\]assets[/\\]/.test(filePath)) {
|
|
res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
|
|
}
|
|
},
|
|
}));
|
|
|
|
// Landing page handler or SPA fallback
|
|
app.get('/', handlePublicSiteRequest, (req, res) => {
|
|
sendSpa(res);
|
|
});
|
|
|
|
// SPA fallback for admin + gallery routes. For gallery URLs we intercept
|
|
// social-crawler User-Agents and serve OG/Twitter-card metadata so link
|
|
// previews show the event name + branding instead of the SPA stub.
|
|
//
|
|
// Two route shapes — 1-2 segments (`/gallery/:slug/:token?`) and the
|
|
// 3-segment slideshow form (`/gallery/:slug/show/:token`). The slideshow
|
|
// shape was previously falling through to the SPA-catchall below and
|
|
// skipping OG injection entirely (#699). Both patterns route to the
|
|
// same handler — buildOgMetadata only looks at `slug`, so the extra
|
|
// /show/ segment is harmless.
|
|
const ogIntercept = (req, res, next) => {
|
|
if (isSocialCrawler(req.get('user-agent'))) {
|
|
return handleGalleryOgRequest(req, res);
|
|
}
|
|
return next();
|
|
};
|
|
app.get('/gallery/:slug/:token?', ogIntercept, (req, res) => sendSpa(res));
|
|
app.get('/gallery/:slug/show/:token', ogIntercept, (req, res) => sendSpa(res));
|
|
|
|
app.get(['/admin', '/admin/*', '/gallery/*'], (req, res) => {
|
|
sendSpa(res);
|
|
});
|
|
|
|
// Everything else the router owns client-side. nginx did `try_files $uri
|
|
// $uri/ /index.html`, so behind compose every client route survived a
|
|
// reload and the short route list above was never exercised. Without
|
|
// nginx it is the whole contract: /setup, /customer, /impressum,
|
|
// /datenschutz, /payment-check, /quote/:token, /contract/:token,
|
|
// /invite/:token, /transfer/:token, /transfer-upload/:token and the
|
|
// branded short URLs all 404'd on a direct hit or a refresh. /setup is
|
|
// the first URL a new install visits.
|
|
spaCatchAll = (req, res) => sendSpa(res);
|
|
} else {
|
|
logger.info('Frontend static serving disabled or dist not found', { serveFrontendEnv, frontendDir });
|
|
app.get('/', handlePublicSiteRequest, (req, res) => {
|
|
res.status(503).send('Frontend bundle not available. Build frontend or enable public site.');
|
|
});
|
|
}
|
|
} catch (e) {
|
|
logger.warn('Failed to enable frontend static serving', { error: e.message });
|
|
}
|
|
|
|
// 404 handler for undefined API routes
|
|
app.use('/api', notFoundHandler);
|
|
|
|
// SPA history fallback, deliberately registered here — AFTER the /api 404
|
|
// handler, so an unknown /api/* route still answers JSON instead of being
|
|
// handed the HTML shell, and after the short-URL resolver so a real short
|
|
// code still redirects. GET-only: a stray POST/PUT keeps 404ing rather than
|
|
// getting a 200 page back.
|
|
if (spaCatchAll) {
|
|
// nginx gives these their own `location` blocks, so `try_files` never applied
|
|
// to them. The fallback has to mirror that: /photos, /thumbnails, /uploads
|
|
// and /fonts are backend-owned static mounts whose middleware calls next()
|
|
// when the file is missing, and swallowing that would answer 200 text/html
|
|
// under an image or font URL instead of a 404.
|
|
// /assets/ belongs on this list for the same reason even though it is the
|
|
// frontend's own bundle: after an upgrade a still-open tab requests the old
|
|
// hashed chunk, which no longer exists. Answering index.html would hand a
|
|
// JavaScript URL a 200 text/html body, so the module load fails with a MIME
|
|
// error instead of the plain 404 nginx returns — and the 200 hides it from
|
|
// any monitoring watching status codes.
|
|
const BACKEND_OWNED = ['/photos/', '/thumbnails/', '/uploads/', '/fonts/', '/assets/', '/health'];
|
|
app.get('*', (req, res, next) => {
|
|
if (BACKEND_OWNED.some((prefix) => req.path.startsWith(prefix))) return next();
|
|
return spaCatchAll(req, res);
|
|
});
|
|
}
|
|
|
|
// Global error handler (must be last)
|
|
app.use(errorHandler);
|
|
|
|
// Initialize services
|
|
async function startServer() {
|
|
try {
|
|
// Initialize database
|
|
await initializeDatabase();
|
|
|
|
// Warm the public-origin cache so the SYNCHRONOUS resolver (CORS headers,
|
|
// secureImageMiddleware) can see the general_site_url setting. Best-effort:
|
|
// the async resolver reads through on its own, and a cold cache only means
|
|
// falling back to the environment.
|
|
await primeSiteUrlCache().catch(() => {});
|
|
|
|
// Initialize storage backend (local fs or S3) — fail fast on misconfig
|
|
const { initStorage } = require('./src/services/storage');
|
|
await initStorage();
|
|
|
|
// Initialize rate limiters after database is ready
|
|
await initializeRateLimiters();
|
|
logger.info('Rate limiters initialized with database configuration');
|
|
|
|
// Initialize auth security cleanup job
|
|
const { initializeCleanupJob } = require('./src/utils/authSecurity');
|
|
initializeCleanupJob();
|
|
|
|
// Initialize temp upload cleanup job
|
|
const { cleanupTempUploads } = require('./src/utils/cleanupTempUploads');
|
|
// Run cleanup on startup
|
|
cleanupTempUploads();
|
|
// Schedule periodic cleanup every hour
|
|
setInterval(cleanupTempUploads, 60 * 60 * 1000);
|
|
logger.info('Temp upload cleanup scheduled');
|
|
|
|
// Start file watcher
|
|
startFileWatcher();
|
|
|
|
// Start expiration checker
|
|
startExpirationChecker();
|
|
// PicTransfer retention sweep (#997): expire links, notify admins, and
|
|
// hard-delete client uploads once the grace window elapses.
|
|
startTransferCleanup();
|
|
// Custom-resolution download archives (#858) are disposable renditions —
|
|
// sweep them once their TTL passes so .download-cache doesn't grow forever.
|
|
startDownloadJobCleanup();
|
|
// Reveal-mode scheduler (#838): minutely stamp for scheduled reveals.
|
|
startRevealScheduler();
|
|
// CRM invoice scheduler: hourly tick to flush scheduled-send invoices
|
|
// + run the overdue reminder ladder. No-op when the `bills` feature
|
|
// flag is OFF (the service short-circuits on empty result sets).
|
|
startInvoiceScheduler();
|
|
|
|
// Initialize email transporter and start queue processor.
|
|
// Skipped under the webhook transport (#1225): an install that switched to
|
|
// it may still carry an old, now-unreachable SMTP row, and nodemailer's
|
|
// verify() would sit on a connection timeout here — delaying boot for a
|
|
// transport that will never send anything.
|
|
if (!emailWebhookTransport.isEnabled()) {
|
|
await initializeTransporter();
|
|
}
|
|
// Seed CRM / contract / event-reminder email templates and recover
|
|
// any queue rows that exhausted retries because their template
|
|
// didn't exist yet. Runs once per boot via module-level caches in
|
|
// each seeder. See _emailTemplateBoot.js for the full rationale.
|
|
try {
|
|
const { seedEmailTemplatesAndRecoverQueue } = require('./src/services/_emailTemplateBoot');
|
|
await seedEmailTemplatesAndRecoverQueue(db, logger);
|
|
} catch (err) {
|
|
logger.warn('Email template self-heal failed at boot:', err.message);
|
|
}
|
|
startEmailQueueProcessor();
|
|
|
|
// Start WhatsApp queue processor — no-ops each cycle unless the
|
|
// `whatsapp` flag is on and a config exists (migration 136, #640D).
|
|
try {
|
|
const { startWhatsAppQueueProcessor } = require('./src/services/whatsappProcessor');
|
|
startWhatsAppQueueProcessor();
|
|
} catch (err) {
|
|
logger.warn('WhatsApp queue processor start failed:', err.message);
|
|
}
|
|
|
|
// Start incoming-mail (IMAP) poller — no-ops each minute unless the
|
|
// `incomingMail` flag is on and a mailbox is configured (migration 128).
|
|
try {
|
|
const { startIncomingMailPoller } = require('./src/services/emailIntakeService');
|
|
startIncomingMailPoller();
|
|
} catch (err) {
|
|
logger.warn('Incoming-mail poller failed to start:', err.message);
|
|
}
|
|
|
|
// Start webhook delivery worker (#327)
|
|
const { startWebhookDeliveryWorker } = require('./src/services/webhookDeliveryWorker');
|
|
startWebhookDeliveryWorker();
|
|
|
|
// Start S3 auto-importer (#328 follow-up). No-op when STORAGE_AUTO_IMPORT
|
|
// is unset OR STORAGE_BACKEND=local — replaces the chokidar watcher
|
|
// for S3-mode deployments that drop files into the bucket directly.
|
|
const { startS3AutoImporter } = require('./src/services/s3AutoImporter');
|
|
startS3AutoImporter();
|
|
|
|
// Self-heal the `backup_paths` table before the backup service
|
|
// starts — the file-backup walker reads from it, so missing
|
|
// canonical rows (a new subdirectory shipped by a future feature)
|
|
// get re-seeded here on every boot. See _backupPathsBoot.js for
|
|
// the full rationale; pattern mirrors _emailTemplateBoot.js.
|
|
try {
|
|
const { seedBackupPathsAtBoot } = require('./src/services/_backupPathsBoot');
|
|
await seedBackupPathsAtBoot(db, logger);
|
|
} catch (err) {
|
|
logger.warn('backup_paths self-heal failed at boot:', err.message);
|
|
}
|
|
|
|
// Self-heal restore-meta settings — currently just
|
|
// `restore_allow_force` defaulting to ON so fresh installs can
|
|
// recover from disaster without a SQL incantation. Only seeds on
|
|
// FRESH installs (existing rows, true or false, are preserved).
|
|
// See _restoreSettingsBoot.js for the full rationale.
|
|
try {
|
|
const { seedRestoreSettingsAtBoot } = require('./src/services/_restoreSettingsBoot');
|
|
await seedRestoreSettingsAtBoot(db, logger);
|
|
} catch (err) {
|
|
logger.warn('restore-settings self-heal failed at boot:', err.message);
|
|
}
|
|
|
|
// Seed built-in workflows (the editable invoice-dunning flow). Disabled by
|
|
// default — live reminder behaviour is unchanged. See _workflowSeedBoot.js.
|
|
try {
|
|
const { seedBuiltinWorkflowsAtBoot } = require('./src/services/_workflowSeedBoot');
|
|
await seedBuiltinWorkflowsAtBoot(db, logger);
|
|
} catch (err) {
|
|
logger.warn('built-in workflow seed failed at boot:', err.message);
|
|
}
|
|
|
|
// Self-heal the RBAC catalog: ensure super_admin holds every permission
|
|
// (the "Admin tracks all" guarantee) and the solo_photographer preset
|
|
// exists. New perms never need a compensation migration. See
|
|
// _permissionsBoot.js + project_permission_gating.
|
|
try {
|
|
const { seedPermissionsAtBoot } = require('./src/services/_permissionsBoot');
|
|
await seedPermissionsAtBoot(db, logger);
|
|
} catch (err) {
|
|
logger.warn('permissions self-heal failed at boot:', err.message);
|
|
}
|
|
|
|
// Install-from-backup trigger. If `RESTORE_ON_INSTALL` (or
|
|
// `.txt`) exists in the /backup mount AND the DB is empty, run
|
|
// the restore HERE before any admin UI surfaces. Lets admins
|
|
// recover a picpeak install with: (a) place backup files in the
|
|
// bind mount, (b) drop the trigger file, (c) `docker compose up`.
|
|
// No onboarding wizard, no throwaway admin, no compose-file
|
|
// changes. See _installFromBackupBoot.js for the full rationale
|
|
// + the safety gates.
|
|
try {
|
|
const { tryInstallFromBackup } = require('./src/services/_installFromBackupBoot');
|
|
const result = await tryInstallFromBackup(db, logger);
|
|
if (result.ran) {
|
|
logger.info(`Install-from-backup: completed from ${result.manifestPath}. Server will start with restored state.`);
|
|
}
|
|
} catch (err) {
|
|
logger.warn('Install-from-backup hook threw:', err.message);
|
|
}
|
|
|
|
// First-run: surface a one-time setup token while no admin account exists.
|
|
// Runs AFTER install-from-backup so a restored instance (which repopulates
|
|
// admin_users) never prints a throwaway token. Best-effort — never blocks boot.
|
|
let setupToken = null;
|
|
let setupTokenFile = null;
|
|
try {
|
|
const setupSvc = require('./src/services/setupService');
|
|
setupToken = await setupSvc.ensureSetupToken();
|
|
// The path the write ACTUALLY produced (null when it failed). existsSync
|
|
// on the candidate answered a different question and reported success
|
|
// for a stale, read-only or directory-shaped SETUP_TOKEN — suppressing
|
|
// the token here while pointing the operator at content that is not it.
|
|
setupTokenFile = setupSvc.writtenSetupTokenFile();
|
|
} catch (err) {
|
|
logger.warn(`[setup] ensureSetupToken skipped: ${err.message}`);
|
|
}
|
|
|
|
// Start backup service
|
|
await startBackupService();
|
|
|
|
// Start database backup service
|
|
await startScheduledBackups();
|
|
|
|
// Start the async photo-processing worker pool. Picks up
|
|
// photos in 'pending' state (from POST /upload) and runs the
|
|
// sharp/ffmpeg/EXIF pipeline off the request thread.
|
|
backgroundProcessor.start();
|
|
|
|
// Face detection (#1074). Starts alongside the photo processor but stays
|
|
// idle — every worker tick re-checks the `faces` feature flag, which is
|
|
// off by default. It is safe to start unconditionally precisely because
|
|
// it never touches FACE_ML_URL until that flag is on.
|
|
//
|
|
// Required HERE rather than at module scope: the face stack pulls in
|
|
// axios and (via imageProcessor) sharp, and server.js is imported by a
|
|
// large number of supertest suites that never start a worker. Keeping it
|
|
// lazy means they don't pay for a module graph they never use.
|
|
require('./src/services/faceQueue').start();
|
|
|
|
app.listen(PORT, () => {
|
|
logger.info(`Server running on port ${PORT}`);
|
|
logger.info(`Admin interface: ${process.env.ADMIN_URL || 'http://localhost:3000'}`);
|
|
logger.info(`Frontend: ${process.env.FRONTEND_URL || 'http://localhost:3001'}`);
|
|
// First-run banner. Print the TOKEN ITSELF only when the 0600 token file
|
|
// could not be written — otherwise this lands a live first-admin
|
|
// credential in `docker logs` / journald, which is the leak GHSA-r794's
|
|
// sweep turned up. When the file exists we point at it instead.
|
|
if (setupToken) {
|
|
const url = `${process.env.ADMIN_URL || 'http://localhost:3000'}/admin`;
|
|
const line = '='.repeat(64);
|
|
const secretLine = setupTokenFile
|
|
? ` Setup token saved to: ${setupTokenFile}\n (read it there — deliberately not printed)`
|
|
: ` One-time setup token: ${setupToken}\n (could not write the token file, so it is shown here)`;
|
|
console.log(`\n${line}\n PicPeak first-run setup — no admin account yet.\n Open: ${url}\n${secretLine}\n${line}\n`);
|
|
}
|
|
});
|
|
} catch (error) {
|
|
logger.error('Failed to start server:', error);
|
|
process.exit(1);
|
|
}
|
|
}
|
|
|
|
startServer();
|
|
|
|
module.exports = app; // For testing
|