Merge pull request #222 from ohamamarachi474-del/fix/providers-and-helmet

fix(security): standardize frontend Providers export and add backend …

Author: dzekojohn4

backend/package.json

@@ -47,6 +47,7 @@
     "class-validator": "^0.14.2",
     "dotenv": "^16.4.7",
     "ioredis": "^5.6.1",
+    "helmet": "^8.0.0",
     "ip2location-nodejs": "^9.6.3",
     "joi": "^17.0.0",
     "multer": "^1.4.5-lts.2",

backend/src/main.ts

@@ -1,29 +1,3 @@
-import { Module } from "@nestjs/common"
-import { AppController } from "./app.controller"
-import { AppService } from "./app.service"
-import { TypeOrmModule } from "@nestjs/typeorm"
-import { ConfigModule, ConfigService } from "@nestjs/config"
-import { AuthModule } from "./auth/auth.module"
-import { UserInventoryModule } from "./user-inventory/user-inventory.module"
-import { CacheModule } from "./cache/cache.module"
-import appConfig from "config/app.config"
-import databaseConfig from "config/database.config"
-import { PuzzleCategoryModule } from "./puzzle-category/puzzle-category.module"
-import { RewardsModule } from "./rewards/rewards.module"
-import { PuzzleModule } from "./puzzle/puzzle.module"
-import { PuzzleSubmissionModule } from "./puzzle-submission/puzzle-submission.module"
-import { ContentModule } from "./content/content.module"
-import { UserReportCardModule } from "./user-report-card/user-report-card.module"
-import { PuzzleDependencyModule } from "./puzzle-dependency/puzzle-dependency.module"
-import { TimeTrialModule } from "./time-trial/time-trial.module"
-import { InAppNotificationsModule } from "./in-app-notifications/in-app-notifications.module"
-import { User } from "./auth/entities/user.entity"
-import { TimeTrial } from "./time-trial/time-trial.entity"
-import { Puzzle } from "./puzzle/puzzle.entity"
-import { Category } from "./puzzle-category/entities/category.entity"
-import { AnalyticsModule } from './analytics/analytics.module';
-import { RewardShopModule } from './reward-shop/reward-shop.module';
-import { ApiKeyModule } from './api-key/api-key.module';
 import { NestFactory } from '@nestjs/core';
 import { Logger, ValidationPipe } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
@@ -37,19 +11,6 @@ async function bootstrap(): Promise<void> {
   const app = await NestFactory.create(AppModule);
   const configService = app.get<ConfigService>(ConfigService);
 
-  // The frontend calls endpoints under the `/api` prefix (see
-  // frontend/store calls to /api/login, /api/register, etc.), so the global
-  // prefix is set on the whole Nest app. This also resolves issue #105 which
-  // expects the /api/users/:userId/history URL shape.
-  //
-  // Swagger UI is excluded so /docs, its JSON sibling /docs-json, and its
-  // nested asset routes (e.g. /docs/swagger-ui-init.js) stay at canonical
-  // paths instead of being double-prefixed to /api. Nest treats string
-  // entries as exact paths, so we also pass a RegExp to cover /docs/....
-  // A single anchored regex covers `docs`, `docs-json`, and any nested
-  // /docs/<asset> route (e.g. /docs/swagger-ui-init.js). Nest evaluates the
-  // exclude list against the registered handler path before the global
-  // prefix is applied.
   app.setGlobalPrefix('api', { exclude: [/^docs/] });
 
   app.enableCors({
@@ -71,55 +32,37 @@ async function bootstrap(): Promise<void> {
       configService.get<boolean>('appConfig.cors.credentials') ?? true,
   });
 
-  app.use(helmet({
-    contentSecurityPolicy: {
-      directives: {
-        defaultSrc: ["'self'"],
-        scriptSrc: ["'self'", "'unsafe-eval'", "'unsafe-inline'"],
-        styleSrc: ["'self'", "'unsafe-inline'"],
-        imgSrc: ["'self'", "data:", "blob:", "https:"],
-        fontSrc: ["'self'"],
-        connectSrc: ["'self'", "https://soroban-testnet.stellar.org"],
-        frameAncestors: ["'none'"],
-        baseUri: ["'self'"],
-        formAction: ["'self'"],
+  // Security Headers via Helmet middleware
+  app.use(
+    helmet({
+      contentSecurityPolicy: {
+        directives: {
+          defaultSrc: ["'self'"],
+          scriptSrc: ["'self'", "'unsafe-eval'", "'unsafe-inline'"],
+          styleSrc: ["'self'", "'unsafe-inline'"],
+          imgSrc: ["'self'", "data:", "blob:", "https:"],
+          fontSrc: ["'self'"],
+          connectSrc: ["'self'", "https://soroban-testnet.stellar.org"],
+          frameAncestors: ["'none'"],
+          baseUri: ["'self'"],
+          formAction: ["'self'"],
+        },
       },
-    },
-    hsts: { maxAge: 63072000, includeSubDomains: true, preload: true },
-    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
-  }));
+      hsts: { maxAge: 63072000, includeSubDomains: true, preload: true },
+      referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
+    }),
+  );
 
   app.useGlobalPipes(
     new ValidationPipe({
       whitelist: true,
       transform: true,
       forbidNonWhitelisted: false,
     }),
-    PuzzleModule,
-    PuzzleSubmissionModule,
-    ContentModule,
-    UserReportCardModule,
-    PuzzleDependencyModule,
-    TimeTrialModule,
-    InAppNotificationsModule,
-    PuzzleTranslationModule,
-    NFTClaimModule,
-    AnalyticsModule,
-    RewardShopModule,
-    ApiKeyModule,
-    UserReactionModule,
-    MultiplayerQueueModule,
-    // Redis-backed caching + single-flight for the read-heavy endpoints
-    // (`/streaks/leaderboard`, `/analytics/puzzles/most-solved`) (#107).
-    CacheModule,
-  ],
-  controllers: [AppController],
-  providers: [AppService],
-})
-export class AppModule {}
   );
 
-  const apiVersion = configService.get<string>('appConfig.apiVersion') ?? '1.0';
+  const apiVersion =
+    configService.get<string>('appConfig.apiVersion') ?? '1.0';
   const swaggerConfig = new DocumentBuilder()
     .setTitle('StellarHunts API')
     .setDescription('StellarHunts backend REST API documentation.')
@@ -130,10 +73,9 @@ export class AppModule {}
     )
     .build();
   const document = SwaggerModule.createDocument(app, swaggerConfig);
-  // Excluded from the global prefix above, so this resolves to /docs.
   SwaggerModule.setup('docs', app, document);
 
-  const port = parseInt(process.env.PORT, 10) || 3001;
+  const port = parseInt(process.env.PORT || '3001', 10);
   await app.listen(port);
   logger.log(`StellarHunts API listening on http://localhost:${port}`);
   logger.log(`Swagger UI available at http://localhost:${port}/docs`);

frontend/app/layout.js

@@ -2,7 +2,7 @@ import localFont from "next/font/local";
 import "./globals.css";
 
 import StoreProvider from "@/store/StoreProvider";
-import Providers from "@/lib/queryClient";
+import Providers from "@/lib/Providers";
 import Navbar from "@/components/Navbar";
 
 const geistSans = localFont({

frontend/lib/Providers.js

@@ -0,0 +1,17 @@
+"use client";
+
+import React, { useState } from "react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { SessionProvider } from "next-auth/react";
+
+export default function Providers({ children, session }) {
+  const [queryClient] = useState(() => new QueryClient());
+
+  return (
+    <SessionProvider session={session}>
+      <QueryClientProvider client={queryClient}>
+        {children}
+      </QueryClientProvider>
+    </SessionProvider>
+  );
+}

frontend/lib/queryClient.js

@@ -1,13 +1,8 @@
 "use client";
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import { useState } from "react";
 
-export default function Providers({ children }) {
-  const [queryClient] = useState(() => new QueryClient());
-  
-  return (
-    <QueryClientProvider client={queryClient}>
-      {children}
-    </QueryClientProvider>
-  );
-}
+import Providers from "./Providers";
+import { QueryClient } from "@tanstack/react-query";
+
+export const queryClient = new QueryClient();
+export { Providers };
+export default Providers;