app.js

'use strict'

// dependencies
const config = require('./config')
const express = require('express')
const bodyParser = require('body-parser')
const http = require('http')
const path = require('path')
const passport = require('passport')
const mongoose = require('mongoose')
const helmet = require('helmet')
const cors = require('cors')
const mongoSanitize = require('express-mongo-sanitize')
const basicAuth = require('express-basic-auth')
const swaggerUi = require('swagger-ui-express')
const swaggerSpec = require('./swagger')

// create express app
const app = express()

// keep reference to config
app.config = config

// setup the web server
app.server = http.createServer(app)

// setup mongoose
app.db = mongoose.connection

app.db.on('error', function (error) {
  console.error('Error in MongoDb connection: ' + error)
})

app.db.on('disconnected', function () {
  console.log('MongoDB disconnected!')
})

// config data models
require('./models')(app, mongoose)

// settings
app.disable('x-powered-by')
app.set('port', config.port)
app.set('views', path.join(__dirname, 'controllers'))
app.set('view engine', 'pug')

// middleware
app.use(require('morgan')('dev'))
app.use(require('compression')())
app.use(require('serve-static')(path.join(__dirname, 'build')))
app.use(require('serve-static')(path.join(__dirname, 'public')))
app.use(require('method-override')())
app.use(bodyParser.json())
app.use(bodyParser.urlencoded({ extended: true }))
app.use(passport.initialize())
const allowedOrigins = config.allowedOrigins
  ? config.allowedOrigins.split(',')
  : ['http://localhost:3000', 'http://localhost:3001']
app.use(cors({ origin: allowedOrigins, credentials: true }))
app.use(helmet())

// 防止 NoSQL Injection：過濾 $ / . 等 MongoDB 運算子，避免惡意 payload 竄改查詢條件。
// sanitize() 深度遍歷物件，大型 payload 會造成效能瓶頸。
// 根本解法：在 Mongoose Schema 層定義嚴格型別與 required，
// 搭配 Joi / Zod 做輸入驗證，從源頭拒絕非預期欄位，可取代此中介層。
// 注意：新版 Node.js 將 req.query 定義為 getter-only，不能直接賦值，
// 因此對 query 採用 in-place 修改而非替換參考。
app.use(function (req, res, next) {
  if (req.body) req.body = mongoSanitize.sanitize(req.body)
  if (req.params) req.params = mongoSanitize.sanitize(req.params)
  if (req.query) {
    const clean = mongoSanitize.sanitize(Object.assign({}, req.query))
    Object.keys(req.query).forEach(function (k) {
      if (k in clean) req.query[k] = clean[k]
      else delete req.query[k]
    })
  }
  next()
})

// response locals
app.use(function (req, res, next) {
  res.locals.user = {}
  res.locals.user.defaultReturnUrl = req.user && req.user.defaultReturnUrl()
  res.locals.user.username = req.user && req.user.username
  next()
})

// global locals
app.locals.projectName = app.config.projectName
app.locals.copyrightYear = new Date().getFullYear()
app.locals.copyrightName = app.config.companyName
app.locals.cacheBreaker = 'br34k-01'

// setup passport
require('./passport')(app, passport)

// setup routes
require('./routes')(app, passport)

// api docs（需設定 SWAGGER_USER 與 SWAGGER_PASSWORD 環境變數才會啟用）
if (config.swaggerAuth.user && config.swaggerAuth.password) {
  app.use(
    '/api-docs',
    basicAuth({ users: { [config.swaggerAuth.user]: config.swaggerAuth.password }, challenge: true }),
    swaggerUi.serve,
    swaggerUi.setup(swaggerSpec)
  )
}

// setup react
app.get('*path', function (req, res) {
  res.sendFile(path.join(__dirname, './build/index.html'))
})

// 全域錯誤攔截：防止 stack trace 或內部錯誤訊息外洩給客戶端
// 開發模式（NODE_ENV=development）下保留完整錯誤訊息以利 trace
app.use(function (err, req, res, next) { // eslint-disable-line no-unused-vars
  const status = err.status || err.statusCode || 500
  if (status >= 500) {
    console.error(err)
  }
  const isDev = app.get('env') === 'development'
  res.status(status).json({
    errors: [{ message: isDev || status < 500 ? err.message : 'An error occurred' }]
  })
})

// setup utilities
app.utility = {}
app.utility.sendmail = require('./util/sendmail')
app.utility.slugify = require('./util/slugify')
app.utility.workflow = require('./util/workflow')
app.utility.ODMService = require('./util/odm-service')

const shutdownTimeoutMs = 10000
let isShuttingDown = false

const startServer = async function () {
  await mongoose.connect(config.mongodb.uri)

  await new Promise(function (resolve, reject) {
    app.server.once('error', reject)

    app.server.listen(app.config.port, function () {
      app.server.off('error', reject)

      // and... we're live
      console.log('Server is running on port ' + config.port)
      resolve()
    })
  })
}

const closeServer = function () {
  return new Promise(function (resolve, reject) {
    app.server.close(function (err) {
      if (err) {
        reject(err)
        return
      }

      resolve()
    })
  })
}

const shutdown = async function (signal) {
  if (isShuttingDown) {
    console.log('Shutdown already in progress, ignoring ' + signal)
    return
  }

  isShuttingDown = true
  console.log('Received ' + signal + ', shutting down gracefully')

  const timeout = setTimeout(function () {
    console.error('Graceful shutdown timed out after ' + shutdownTimeoutMs + 'ms')
    process.exit(1)
  }, shutdownTimeoutMs)

  try {
    await closeServer()
    console.log('HTTP server closed')

    await mongoose.disconnect()
    console.log('MongoDB disconnected')

    clearTimeout(timeout)
    process.exit(0)
  } catch (err) {
    clearTimeout(timeout)
    console.error('Failed to shutdown gracefully:', err)
    process.exit(1)
  }
}

process.on('SIGTERM', function () {
  shutdown('SIGTERM')
})

process.on('SIGINT', function () {
  shutdown('SIGINT')
})

startServer().catch(function (err) {
  console.error('Failed to start server:', err)
  process.exit(1)
})