s.esmaeiliandClaude Opus 5
460cf276b6
D20: OTP_MASTER_CODE login bypass read only from the environment, disabled when unset, audited on every use, with a boot banner while armed. SMS no longer aborts the boot in production — it warns and declines silently, so no message can stop an operation. D19: port Utility::faTOen onto admin-entered mobiles (before the uniqueness lookup, which could previously be bypassed with Persian digits), and the create-only welcome SMS, byte-identical to the reference and fire-and-forget. user-app-v2 was missing the cart stock ceiling entirely: capQty/maxQty, the un-orderable guard and the qty clamp are ported, leaving v2's own design intact. The two cart stores are now byte-identical. isVariantOrderable and the orderable-first default selection ported too. jest 45/45; typecheck clean on api, admin-panel, user-app, user-app-v2. [ref: henza_server/app/Http/Controllers/Adm/AdminController.php:333,348,364,378-387] [ref: henza_server/app/Models/Utility.php:26] Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
77 lines
3.0 KiB
TypeScript
77 lines
3.0 KiB
TypeScript
import 'reflect-metadata';
|
|
import { NestFactory } from '@nestjs/core';
|
|
import { ValidationPipe } from '@nestjs/common';
|
|
import { NestExpressApplication } from '@nestjs/platform-express';
|
|
import { extname, join } from 'node:path';
|
|
import type { Response } from 'express';
|
|
import { AppModule } from './app.module';
|
|
import { prepareDatabase } from './prisma/bootstrap';
|
|
import { PrismaExceptionFilter } from './prisma/prisma-exception.filter';
|
|
import { assertSmsConfigured } from './modules/sms/sms.service';
|
|
import { masterOtpEnabled } from './modules/customer-auth/customer-auth.service';
|
|
|
|
// serve-static's bundled `mime` version predates .avif, so it falls back to
|
|
// application/octet-stream — browsers still render the image (they sniff
|
|
// content), but a strict client or an <img> under some CSPs would not.
|
|
const EXTRA_MIME_TYPES: Record<string, string> = {
|
|
'.avif': 'image/avif',
|
|
};
|
|
|
|
async function bootstrap() {
|
|
// D20 — reports the SMS configuration and never throws. A missing credential
|
|
// no longer stops the boot; messages are logged instead of sent.
|
|
assertSmsConfigured();
|
|
|
|
// D20 — a loud, unmissable banner whenever the delivery bypass is armed, so
|
|
// it cannot reach the real release unnoticed.
|
|
if (masterOtpEnabled()) {
|
|
// eslint-disable-next-line no-console
|
|
console.warn(
|
|
'\n' +
|
|
'='.repeat(72) +
|
|
'\n ⚠ OTP_MASTER_CODE فعال است — قبل از انتشار اصلی حذف شود\n' +
|
|
' ⚠ OTP_MASTER_CODE IS ACTIVE: any active customer can sign in with\n' +
|
|
' ⚠ this fixed code. Remove it from the environment before release.\n' +
|
|
'='.repeat(72) +
|
|
'\n',
|
|
);
|
|
}
|
|
|
|
await prepareDatabase();
|
|
|
|
const app = await NestFactory.create<NestExpressApplication>(AppModule);
|
|
app.setGlobalPrefix('api');
|
|
app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));
|
|
app.useGlobalFilters(new PrismaExceptionFilter());
|
|
app.enableCors();
|
|
// Uploaded files, mounted OUTSIDE the /api prefix so the URLs stored on
|
|
// UploadedFile.url ("/uploads/<name>") resolve directly.
|
|
app.useStaticAssets(process.env.UPLOAD_DIR ?? join(process.cwd(), 'storage', 'uploads'), {
|
|
prefix: '/uploads/',
|
|
index: false,
|
|
dotfiles: 'deny',
|
|
setHeaders: (res: Response, path: string) => {
|
|
const mime = EXTRA_MIME_TYPES[extname(path).toLowerCase()];
|
|
if (mime) res.setHeader('Content-Type', mime);
|
|
},
|
|
});
|
|
const port = Number(process.env.PORT ?? 3000);
|
|
|
|
try {
|
|
// Bind all interfaces explicitly so the container is reachable from nginx.
|
|
await app.listen(port, '0.0.0.0');
|
|
} catch (err) {
|
|
if ((err as NodeJS.ErrnoException).code === 'EADDRINUSE') {
|
|
// eslint-disable-next-line no-console
|
|
console.error(
|
|
`\n[api] Port ${port} is already in use. Free it or change API_PORT ` +
|
|
`in the repo-root .env (and PORT in apps/api/.env to match) — the ` +
|
|
`API will not fall back to a different port.\n`,
|
|
);
|
|
process.exit(1);
|
|
}
|
|
throw err;
|
|
}
|
|
}
|
|
bootstrap();
|