Feature/helmet cors rate limit

package.json

@@ -20,6 +20,7 @@
     "test:e2e": "playwright test"
   },
   "dependencies": {
+    "@fastify/helmet": "^13.0.1",
     "@fastify/static": "^8.1.1",
     "@nestjs/axios": "^4.0.0",
     "@nestjs/common": "^11.0.1",
@@ -31,13 +32,14 @@
     "@nestjs/platform-express": "^11.0.1",
     "@nestjs/platform-fastify": "^11.0.9",
     "@nestjs/swagger": "^11.0.5",
+    "@nestjs/throttler": "^6.4.0",
     "@nestjs/typeorm": "^11.0.0",
     "@types/uuid": "^10.0.0",
     "axios": "^1.7.9",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.1",
     "dotenv": "^16.4.7",
-    "fastify": "^5.2.1",
+    "fastify": "^5.3.3",
     "jsonwebtoken": "^9.0.2",
     "nestjs-pino": "^4.3.0",
     "passport": "^0.7.0",

src/app.module.ts

@@ -37,6 +37,8 @@ import { AnswerTemplatesModule } from './answer-templates/answer-templates.modul
 // IMPORTS POUR LA SÉCURITÉ GLOBALE
 import { APP_GUARD } from '@nestjs/core';
 import { GlobalAuthGuard } from './auth/guards/global-auth.guard';
+import { ThrottlerModule } from '@nestjs/throttler';
+
 
 /**
  * Module principal de l'application
@@ -84,7 +86,11 @@ import { GlobalAuthGuard } from './auth/guards/global-auth.guard';
     SignatureModule,
     PollTemplatesModule,
     QuestionTemplatesModule,
-    AnswerTemplatesModule
+    AnswerTemplatesModule,
+    ThrottlerModule.forRoot([{
+      ttl: 1, // 1 seconde
+      limit: 50, // 50 requêtes par seconde
+    }]),
   ],
   controllers: [AppController],
   // CONFIGURATION DU GUARD GLOBAL

src/main.ts

@@ -7,6 +7,7 @@ import { EmptyResponseInterceptor } from './common/interceptors/empty-response.i
 import { HttpExceptionFilter } from './common/filters/http-exception.filter';
 import { ValidationPipe } from '@nestjs/common';
 import { join } from 'path';
+import helmet from '@fastify/helmet';
 
 dotenv.config();
 async function bootstrap() {
@@ -15,6 +16,26 @@ async function bootstrap() {
     new FastifyAdapter(),
   );
 
+  // Configuration CORS
+  app.enableCors({
+    origin: [
+      'http://localhost:3000',
+      'https://discord.com',
+      'https://discordapp.com',       
+      'https://cdn.discordapp.com',
+      'https://discord.gg',           
+      'wss://gateway.discord.gg' 
+    ],
+    methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
+    allowedHeaders: [
+      'Content-Type',
+      'Authorization',
+      'X-Super-Properties',     
+      'X-Discord-Locale' 
+    ],
+    credentials: false, 
+  });
+
   app.useGlobalInterceptors(new EmptyResponseInterceptor());
   app.useGlobalFilters(new HttpExceptionFilter());
   app.useGlobalPipes(new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true }));
@@ -56,11 +77,31 @@ async function bootstrap() {
     });
   }
 
-  SwaggerModule.setup('api', app, document);
+  SwaggerModule.setup('api', app, document, {
+  });
+
 
-  // Nous ne définissons plus de préfixe global pour l'API
-  // app.setGlobalPrefix('api');
+  const isDevelopment = process.env.NODE_ENV === 'development';
 
+  //Attention, lorsque fastify et nestjs/platform-fastify n'ont pas la même version,
+  //cela provoque des erreurs sur helmet
+  await app.register(helmet, {
+    contentSecurityPolicy: isDevelopment ? false : {
+      directives: {
+        defaultSrc: ["'self'"],
+        scriptSrc: ["'self'"],
+        styleSrc: ["'self'"],
+        imgSrc: ["'self'", "data:", "validator.swagger.io"],
+        connectSrc: ["'self'", "https://discord.com", "https://discord.com/api", "http://localhost:3000", "http://127.0.0.1:3000" ],
+        fontSrc: ["'self'"],
+        objectSrc: ["'none'"],
+        mediaSrc: ["'none'"],
+        frameSrc: ["'none'"],
+        formAction: ["'self'"],
+      }
+    },
+  });
+
   // Configuration de la version de l'API
   await app.listen(3000, '0.0.0.0');
 }