create-dacosta-proj 1.0.13 → 1.0.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-dacosta-proj",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "bin": {
     "create-dacosta-proj": "./index.js"
   }

package/template/package.json

@@ -13,8 +13,10 @@
     "express": "^5.2.1",
     "module-alias": "^2.3.4",
     "nanoid": "^5.1.6",
+    "rate-limiter-flexible": "^9.1.1",
     "redis": "^5.11.0",
-    "simple-supabase": "^2.0.5"
+    "simple-supabase": "^2.0.5",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "eslint": "^9.39.3",

package/template/src/api/v1/public/signature.js

@@ -2,6 +2,7 @@
 
 const crypto = require('crypto');
 const { global } = require('@/config/global');
+const { default: zod } = require('zod');
 
 async function GET({ headers }) {
 
@@ -11,11 +12,9 @@ async function GET({ headers }) {
 		const userId = headers['user-id'];
 		const accessToken = headers['access-token'];
 
-		if (!userId || !accessToken) return { code: 400, json: { error: 'Missing params!' } };
-
 		// Format Signature
 
-		const expires = Date.now() + (1_000 * 60 * 60 * 24); // 24 Hours
+		const expires = Date.now() + (1_000 * 60 * 60 * 1); // 1 Hour
 
 		const hmac = crypto.createHmac('sha256', process.env.SIGNATURE_KEY)
 			.update(`${userId}:${accessToken}:${expires}:${process.env.SIGNATURE_REF}`)
@@ -28,6 +27,19 @@ async function GET({ headers }) {
 			json: { signature }
 		};
 	}
-	catch { return { code: 500, json: { error: 'Failed to generate signature!' } }; }
+	catch (err) { console.log('Signature Generation Failed', err); return { code: 500, json: { error: 'Failed to generate signature!' } }; }
 }
-module.exports = { GET, settings: { requires_bypass: true } };
+
+module.exports = {
+	GET,
+	settings: {
+		requires_bypass: true
+	},
+	schemas: {
+		headers: zod.object({
+			'user-id': zod.string(),
+			'access-token': zod.string(),
+			'bypass': zod.string()
+		})
+	}
+};

package/template/src/config/config.js

@@ -0,0 +1,4 @@
+const config = {
+	api_version: 1
+};
+module.exports = { config };

package/template/src/helpers/verifySignature.js

@@ -16,7 +16,6 @@ module.exports = (signature, userId, accessToken) => {
 			.update(`${userId}:${accessToken}:${sigExpires}:${process.env.SIGNATURE_REF}`)
 			.digest('hex');
 
-		if (sigHmac.length !== expectedHmac.length) return false;
 		const isValid = crypto.timingSafeEqual(
 			Uint8Array.from([...sigHmac].map(c => c.charCodeAt(0))),
 			Uint8Array.from([...expectedHmac].map(c => c.charCodeAt(0)))
@@ -25,5 +24,5 @@ module.exports = (signature, userId, accessToken) => {
 
 		return true;
 	}
-	catch { return false; }
+	catch (err) { console.log('Signature Verification Failed', err); return false; }
 };

package/template/src/index.js

@@ -10,6 +10,7 @@ const { SimpleSupabase } = require('simple-supabase');
 const { createClient: createRedisClient } = require('redis');
 const Cryptr = require('cryptr');
 const fs = require('fs');
+const path = require('path');
 
 // Start System
 
@@ -17,8 +18,11 @@ const fs = require('fs');
 
 	// Handle Errors
 
-	process.on('unhandledRejection', async (error) => console.log('Unhandled Rejection', error));
-	process.on('uncaughtException', async (error) => console.log('Uncaught Exception', error));
+	process.on('unhandledRejection', (error) => console.log('Unhandled Rejection', error));
+	process.on('uncaughtException', (error) => {
+		console.log('Uncaught Exception', error);
+		process.exit(1);
+	});
 
 	// Database / Redis
 
@@ -47,9 +51,9 @@ const fs = require('fs');
 
 	// Start Services
 
-	fs.readdirSync('src/services')
+	fs.readdirSync(path.join(__dirname, 'services'))
 		.filter(f => f.endsWith('.js') && !f.startsWith('_'))
-		.map(service => {
+		.forEach(service => {
 			const serviceFile = require(`@/services/${service}`);
 			serviceFile();
 		});

package/template/src/services/api.js

@@ -1,9 +1,13 @@
 // Packages / Helpers
 
 const fs = require('fs');
+const path = require('path');
 const express = require('express');
 const cors = require('cors');
+const { RateLimiterRedis } = require('rate-limiter-flexible');
 const verifySignature = require('@/helpers/verifySignature');
+const { global } = require('@/config/global');
+const { config } = require('@/config/config');
 
 module.exports = async () => {
 
@@ -20,34 +24,69 @@ module.exports = async () => {
 
 	api.use(cors({
 		origin: (origin, callback) => {
-			if (allowedOrigins.includes(origin)) return callback(null, true);
+			if (!origin || allowedOrigins.includes(origin)) return callback(null, true);
 			return callback(new Error('Not allowed by CORS'));
 		}
 	}));
 
 	// Get Endpoints
 
-	const endpoints = fs.readdirSync('src/api', { recursive: true })
+	const endpoints = fs.readdirSync(path.join(__dirname, '..', 'api'), { recursive: true })
 		.filter(f => f.endsWith('.js') && !f.startsWith('_'))
 		.map(endpoint => endpoint.replace('.js', ''));
 
-	// Endpoint Settings
+	const slashEndpoints = endpoints.map(e => `/${e}`);
 
+	// Endpoint Data
+
+	let endpointRateLimiter = {};
 	let endpointSettings = {};
+	let endpointSchemas = {};
 
-	endpoints.map(endpoint => {
-		try { endpointSettings[`/${endpoint}`] = (require(`@/api/${endpoint}`))?.settings || {}; }
-		catch { endpointSettings[`/${endpoint}`] = {}; }
+	endpoints.forEach(endpoint => {
+		try {
+			const data = require(`@/api/${endpoint}`);
+			endpointRateLimiter[`/${endpoint}`] = new RateLimiterRedis({
+				storeClient: global.redis,
+				keyPrefix: `${process.env.PROJECT_ID}_request_rate_limit_${endpoint}`,
+				...(data?.rate_limit || { points: 1, duration: 2 }),
+				useRedisPackage: true
+			});
+			endpointSettings[`/${endpoint}`] = data?.settings || {};
+			endpointSchemas[`/${endpoint}`] = data?.schemas || {};
+		}
+		catch (err) {
+			console.log('API Endpoint Data Listing Error', `Endpoint: ${endpoint}`, err);
+			endpointSettings[`/${endpoint}`] = {};
+			endpointSchemas[`/${endpoint}`] = {};
+		}
 	});
 
 	// API Authentication
 
 	api.use('/', async (req, res, next) => {
 
-		// Get Endpoint Settings
+		// Get Endpoint Data
 
 		const endpoint = req?.path || '';
+		const rateLimiter = endpointRateLimiter[endpoint];
 		const settings = endpointSettings[endpoint];
+		const schemas = endpointSchemas[endpoint];
+
+		// Check Endpoint
+
+		if (!slashEndpoints.includes(endpoint)) return res.sendStatus(404);
+
+		// Check Schemas
+
+		const invalidSchema = ['query','headers','body']
+			.filter(schema => schemas[schema])
+			.map(schema => {
+				return { id: schema, parsed: schemas[schema].safeParse(req[schema] || {}) };
+			})
+			.find(schema => !schema?.parsed?.success);
+
+		if (invalidSchema?.id) return res.status(400).json({ error: 'Missing params!' });
 
 		// Check Bypass
 
@@ -58,7 +97,7 @@ module.exports = async () => {
 
 		// Public Endpoint
 
-		if (endpoint.includes('/public')) return next();
+		if (endpoint.includes(`/v${config.api_version}/public`)) return next();
 
 		// Private Endpoint
 
@@ -71,6 +110,11 @@ module.exports = async () => {
 
 			if (!userId || !accessToken || !signature) return res.sendStatus(401);
 
+			// Check Rate Limit
+
+			try { await rateLimiter.consume(userId, 1); }
+			catch (err) { return res.status(429).json({ error: 'Too many requests!', resets_at: new Date(Date.now() + (err?.msBeforeNext || 0)).toISOString() }); }
+
 			// Verify Signature
 
 			const signatureIsValid = verifySignature(signature, userId, accessToken);
@@ -84,12 +128,12 @@ module.exports = async () => {
 
 			return next();
 		}
-		catch { return res.sendStatus(500); }
+		catch (err) { console.log('API Middleware Error', `Endpoint: ${endpoint}`, err); return res.sendStatus(500); }
 	});
 
 	// Start API Endpoints
 
-	endpoints.map(endpoint => {
+	endpoints.forEach(endpoint => {
 
 		let endpointMethods = require(`@/api/${endpoint}`);
 
@@ -100,11 +144,12 @@ module.exports = async () => {
 
 			try {
 				const result = await method({ userId: req.headers['user-id'], req, res, endpoint, headers: req.headers || {}, body: req?.body || {}, query: req?.query || {} });
-				return res.status(result?.code || 200).json(result?.json || {});
+				return res.status(result?.code || 200).json(result?.json);
 			}
-			catch {
+			catch (err) {
+				console.log('API Error', `Endpoint: ${endpoint}`, err);
 				try { return res.sendStatus(500); }
-				catch (err) { console.log(err); }
+				catch {}
 			}
 		});
 	});