proteum 1.0.2 → 2.0.0-1

package/server/services/router/http/index.ts

@@ -21,62 +21,53 @@ import * as csp from 'express-csp-header';
 
 // Core
 import Container from '@server/app/container';
-import type Router from '..';
+import type { TServerRouter } from '..';
 
 // Middlewaees (core)
-import { MiddlewareFormData } from './multipart';
+import { isMutipart, MiddlewareFormData } from './multipart';
 
 /*----------------------------------
 - CONFIG
 ----------------------------------*/
 
 export type Config = {
-
-    debug?: boolean,
+    debug?: boolean;
 
     // Access
-    domain: string,
-    port: number,
-    ssl: boolean,
+    domain: string;
+    port: number;
+    ssl: boolean;
 
     // Limitations / Load restriction
     upload: {
-        maxSize: string // Expression package bytes
-    },
-    csp: {
-        default?: string[],
-        styles?: string[],
-        images?: string[],
-        scripts: string[],
-    },
-    cors?: CorsOptions,
-    helmet?: Parameters<typeof helmet>[0]
-}
+        maxSize: string; // Expression package bytes
+    };
+    csp: { default?: string[]; styles?: string[]; images?: string[]; scripts: string[] };
+    cors?: CorsOptions;
+    helmet?: Parameters<typeof helmet>[0];
+};
 
-export type Hooks = {
-
-}
+export type Hooks = {};
 
 /*----------------------------------
 - FUNCTION
 ----------------------------------*/
-export default class HttpServer {
-
+export default class HttpServer<TRouter extends TServerRouter = TServerRouter> {
     public http: http.Server | https.Server;
     public express: express.Express;
 
     public publicUrl: string;
 
-    public constructor( 
-        public config: Config, 
-        public router: Router,
-        public app = router.app
+    public constructor(
+        public config: Config,
+        public router: TRouter,
+        public app = router.app,
     ) {
-
         // Init
-        this.publicUrl = this.app.env.name === 'local'
-            ? 'http://localhost:' + this.config.port
-            : ((this.config.ssl ? 'https' : 'http') + '://' + this.config.domain);
+        this.publicUrl =
+            this.app.env.name === 'local'
+                ? 'http://localhost:' + this.config.port
+                : (this.config.ssl ? 'https' : 'http') + '://' + this.config.domain;
 
         // Configure HTTP server
         this.express = express();
@@ -91,8 +82,18 @@ export default class HttpServer {
     ----------------------------------*/
 
     public async start() {
-
-        const routes = this.express
+        const routes = this.express;
+        const routeRequest = this.router.middleware.bind(this.router);
+        const apiOnly =
+            (middleware: express.RequestHandler): express.RequestHandler =>
+            (req, res, next) =>
+                req.path === '/api' || req.path.startsWith('/api/') ? middleware(req, res, next) : next();
+        const apiMultipartOnly =
+            (middleware: express.RequestHandler): express.RequestHandler =>
+            (req, res, next) =>
+                (req.path === '/api' || req.path.startsWith('/api/')) && isMutipart(req)
+                    ? middleware(req, res, next)
+                    : next();
 
         /*----------------------------------
         - SECURITÉ DE BASE
@@ -100,29 +101,45 @@ export default class HttpServer {
 
         // Config
         routes.set('trust proxy', 1); // Indique qu'on est sous le proxy apache
+        /*----------------------------------
+        - FAST PATH: API
+        ----------------------------------*/
+
+        // Keep /api requests off the heavier page middleware stack below.
+        routes.use(apiOnly(hpp()));
+        routes.use(apiOnly(cookieParser()));
+        routes.use(apiOnly(express.json({ limit: bytes(this.config.upload.maxSize) })));
+        routes.use(
+            apiMultipartOnly(
+                fileUpload({
+                    debug: false,
+                    limits: { fileSize: bytes(this.config.upload.maxSize), abortOnLimit: true },
+                }),
+            ),
+        );
+        routes.use(apiMultipartOnly(MiddlewareFormData));
+        if (this.config.cors !== undefined) routes.use(apiOnly(cors(this.config.cors)));
+        routes.use(apiOnly(routeRequest));
+
         // Diverses protections (dont le disable x-powered-by)
-        routes.use( helmet(this.config.helmet) );
+        routes.use(helmet(this.config.helmet));
 
         /*----------------------------------
         - FICHIERS STATIQUES
         ----------------------------------*/
 
         // Fichiers statiques: Eviter un maximum de middlewares inutiles
-        // Normalement, seulement utile pour le mode production, 
+        // Normalement, seulement utile pour le mode production,
         // Quand mode debug, les ressources client semblent servies par le dev middlewae
         // Sauf que les ressources serveur ne semblent pas trouvées par le dev-middleware
         routes.use(compression());
         routes.use('/public', cors());
         routes.use(
             '/public',
-            express.static( Container.path.root + '/bin/public', {
+            express.static(path.join(Container.path.root, APP_OUTPUT_DIR, 'public'), {
                 dotfiles: 'deny',
                 setHeaders: function setCustomCacheControl(res, path) {
-
-                    const dontCache = [
-                        '/public/icons',
-                        '/public/client'
-                    ]
+                    const dontCache = ['/public/icons', '/public/client'];
 
                     res.setHeader('Cache-Control', 'public, max-age=0');
 
@@ -132,17 +149,16 @@ export default class HttpServer {
                     } else {
                         res.setHeader('Cache-Control', 'public, max-age=604800000'); // 7 Days
                     }*/
-                    
-                }
+                },
             }),
             (req, res) => {
                 res.status(404).send();
-            }
+            },
         );
- 
-        routes.use('/robots.txt', express.static( path.resolve(__dirname, 'public/robots.txt')) );
 
-        routes.get("/ping", (req, res) => res.send("pong"));
+        routes.use('/robots.txt', express.static(path.resolve(__dirname, 'public/robots.txt')));
+
+        routes.get('/ping', (req, res) => res.send('pong'));
 
         /*----------------------------------
         - SESSION & SECURITE
@@ -152,66 +168,55 @@ export default class HttpServer {
         routes.use(hpp());
 
         // Init de req.cookies
-        routes.use(cookieParser())
+        routes.use(cookieParser());
 
         /*----------------------------------
         - DÉCODEURS
         ----------------------------------*/
         routes.use(
-
             // Décodage des données post
             express.json({
                 // TODO: prendre en considération les upload de fichiers
                 limit: bytes(this.config.upload.maxSize),
                 verify: (req, res, buf, encoding) => {
                     // Store the raw request body so we can access it later
-                    req.rawBody = buf;
-                }
+                    (req as express.Request & { rawBody?: Buffer }).rawBody = buf;
+                },
             }),
 
             // Permet de receptionner les données multipart (req.body + req.files)
             // A mettre avant les services, car l'assignement de req.socket fait planter les uploads
-            fileUpload({
-                debug: false,
-                limits: {
-                    fileSize: bytes(this.config.upload.maxSize),
-                    abortOnLimit: true
-                },
-            }),
+            fileUpload({ debug: false, limits: { fileSize: bytes(this.config.upload.maxSize), abortOnLimit: true } }),
 
             // Décodage des requetes multipart
             // Peut-être requis par le résolver api
-            MiddlewareFormData
+            MiddlewareFormData,
         );
 
         /*----------------------------------
         - PAGES / API
         ----------------------------------*/
 
-        if (this.config.cors !== undefined)
-            routes.use( cors( this.config.cors ));
+        if (this.config.cors !== undefined) routes.use(cors(this.config.cors));
 
-        routes.use( csp.expressCspHeader({
-            directives: {
-                'script-src': [csp.INLINE, csp.SELF, csp.UNSAFE_EVAL,
-                   ...this.config.csp.scripts
-                ]
-            }
-        }));
-        
-        routes.use( this.router.middleware.bind( this.router ) );
+        routes.use(
+            csp.expressCspHeader({
+                directives: { 'script-src': [csp.INLINE, csp.SELF, csp.UNSAFE_EVAL, ...this.config.csp.scripts] },
+            }),
+        );
+
+        routes.use(routeRequest);
 
         /*----------------------------------
         - BOOT SERVICES
         ----------------------------------*/
-        console.info("Lancement du serveur web");
+        console.info('Lancement du serveur web');
         this.http.listen(this.config.port, () => {
             console.info(`Web server ready on ${this.publicUrl}`);
         });
-
     }
 
     public async cleanup() {
         this.http.close();
     }
-}
+}

package/server/services/router/http/multipart.ts

@@ -2,18 +2,7 @@
 - DEPENDANCES
 ----------------------------------*/
 
-// Npm
-import mime from 'mime-types';
-
-// Core
-import { InputError } from '@common/errors';
-
-/*----------------------------------
-- TYPES
-----------------------------------*/
-
 import type { Request, Response, NextFunction } from 'express';
-import type { FileArray, UploadedFile } from 'express-fileupload';
 
 /*----------------------------------
 - CONFIG
@@ -23,34 +12,30 @@ const reMultipart = /^multipart\/(?:form-data|related)(?:;|$)/i;
 /*----------------------------------
 - MIDDLEWARE
 ----------------------------------*/
-export const MiddlewareFormData = (req: Request, res: Response, next: NextFunction) => {
-
+export const MiddlewareFormData = (req: Request, _res: Response, next: NextFunction) => {
     // Verif si multipart
-    if (!isMutipart( req ))
-        return next();
-        
+    if (!isMutipart(req)) return next();
+
     // Données body + fichiers
-    // NOTE: Les données devant obligatoirement passer par le validateur de schema, 
+    // NOTE: Les données devant obligatoirement passer par le validateur de schema,
     //  On peut mélanger le body et les files sans risque de sécurité
     req.body = traiterMultipart(req.body, req['files']);
     //req.files = traiterMultipart(req.files);
 
     next();
-}
+};
 
 /*----------------------------------
 - FUNCTIONS
 ----------------------------------*/
-export const isMutipart = (req: Request) => req.headers['content-type'] && reMultipart.exec( req.headers['content-type'] );
+export const isMutipart = (req: Request) =>
+    req.headers['content-type'] && reMultipart.exec(req.headers['content-type']);
 
 export const traiterMultipart = (...canaux: any[]) => {
-
-    let sortie: {[nom: string]: any} = {};
+    let sortie: { [nom: string]: any } = {};
 
     for (const donnees of canaux) {
-
-        if (!donnees)
-            continue;
+        if (!donnees) continue;
 
         for (const fieldPath in donnees) {
             let donnee = donnees[fieldPath];
@@ -58,32 +43,24 @@ export const traiterMultipart = (...canaux: any[]) => {
             let brancheA = sortie;
             const results = [...fieldPath.matchAll(/[^\[\]]+/g)];
             for (let iCle = 0; iCle < results.length; iCle++) {
-
-                const [cle] = results[ iCle ];
+                const [cle] = results[iCle];
 
                 // Need to go deeper to find data
                 if (iCle !== results.length - 1) {
-
-                    if (brancheA[ cle ] === undefined) {
-                        const tableau = !isNaN( results[ iCle + 1 ][0] as any )
-                        brancheA[ cle ] = tableau ? [] : {};
+                    if (brancheA[cle] === undefined) {
+                        const tableau = !isNaN(results[iCle + 1][0] as any);
+                        brancheA[cle] = tableau ? [] : {};
                     }
 
-                    brancheA = brancheA[ cle ];
+                    brancheA = brancheA[cle];
                     continue;
                 }
 
                 // Data reached
-                if (
-                    typeof donnee === 'object' 
-                    && 
-                    donnee.data !== undefined 
-                    && 
-                    donnee.data instanceof Buffer
-                ){
+                if (typeof donnee === 'object' && donnee.data !== undefined && donnee.data instanceof Buffer) {
                     const md5 = donnee.md5;
                     const data = donnee.data;
-                    donnee = new File(donnee.data, donnee.name, { 
+                    donnee = new File(donnee.data, donnee.name, {
                         type: donnee.mimetype,
                         lastModified: Date.now(),
                         //size: donnee.size,
@@ -92,11 +69,11 @@ export const traiterMultipart = (...canaux: any[]) => {
                     donnee.md5 = md5;
                     donnee.data = data;
                 }
-                
-                brancheA[ cle ] = donnee;
+
+                brancheA[cle] = donnee;
             }
         }
     }
 
     return sortie;
-}
+};