tehran_taj/apps/api/src/main.ts

import 'reflect-metadata';
import { NestFactory } from '@nestjs/core';
import { ValidationPipe } from '@nestjs/common';
import { NestExpressApplication } from '@nestjs/platform-express';
import { extname, join } from 'node:path';
import type { Response } from 'express';
import { AppModule } from './app.module';
import { prepareDatabase } from './prisma/bootstrap';
import { PrismaExceptionFilter } from './prisma/prisma-exception.filter';
import { assertSmsConfigured } from './modules/sms/sms.service';
import { masterOtpCode, masterOtpEnabled } from './modules/customer-auth/customer-auth.service';

// serve-static's bundled `mime` version predates .avif, so it falls back to
// application/octet-stream — browsers still render the image (they sniff
// content), but a strict client or an <img> under some CSPs would not.
const EXTRA_MIME_TYPES: Record<string, string> = {
  '.avif': 'image/avif',
};

async function bootstrap() {
  // D20 — reports the SMS configuration and never throws. A missing credential
  // no longer stops the boot; messages are logged instead of sent.
  assertSmsConfigured();

  // A missing JWT_CUSTOMER_SECRET is not a cosmetic default: customerJwtSecret()
  // falls back to JWT_SECRET, so admin and app tokens end up signed with the
  // SAME key. The `typ` check in JwtStrategy is then the only thing keeping an
  // app token off the admin routes — one guard instead of two independent ones,
  // and a sales expert's app token carries their AdminUser id in `sub`. Warn as
  // loudly as the master-code banner rather than fail the boot, so a running
  // deployment that has not set it yet still starts.
  if (!process.env.JWT_CUSTOMER_SECRET?.trim()) {
    const sharedWithAdmin = Boolean(process.env.JWT_SECRET?.trim());
    // eslint-disable-next-line no-console
    console.warn(
      '\n' +
        '='.repeat(72) +
        '\n  ⚠  JWT_CUSTOMER_SECRET تنظیم نشده است\n' +
        '  ⚠  JWT_CUSTOMER_SECRET IS NOT SET.\n' +
        (sharedWithAdmin
          ? '  ⚠  Customer/expert app tokens are being signed with JWT_SECRET,\n' +
            '  ⚠  the SAME key as admin tokens. The two token realms are no\n' +
            '  ⚠  longer cryptographically separated.\n'
          : '  ⚠  Neither JWT_SECRET nor JWT_CUSTOMER_SECRET is set, so app\n' +
            '  ⚠  tokens are signed with a well-known development string.\n') +
        '  ⚠  Set JWT_CUSTOMER_SECRET to a distinct random value before release.\n' +
        '='.repeat(72) +
        '\n',
    );
  }

  // D20 — a loud, unmissable banner whenever the delivery bypass is armed, so
  // it cannot reach the real release unnoticed.
  if (masterOtpEnabled()) {
    const code = masterOtpCode() ?? '';
    // Both apps render the login OTP as FOUR single-character boxes and only
    // submit on @on-complete, i.e. at exactly 4 digits
    // (LoginView.vue:43 in each app, OtpInput.vue:43). The API itself accepts
    // any length, so a longer master code works over HTTP but can never be
    // typed into the apps. Warn rather than reject: an operator may be using it
    // for API testing only.
    const typable = /^\d{4}$/.test(code);
    // eslint-disable-next-line no-console
    console.warn(
      '\n' +
        '='.repeat(72) +
        '\n  ⚠  OTP_MASTER_CODE فعال است — قبل از انتشار اصلی حذف شود\n' +
        '  ⚠  OTP_MASTER_CODE IS ACTIVE: any active customer can sign in with\n' +
        '  ⚠  this fixed code. Remove it from the environment before release.\n' +
        (typable
          ? ''
          : '  ⚠\n' +
            '  ⚠  NOTE: this code is not 4 digits, so it CANNOT be entered in the\n' +
            '  ⚠  customer apps — their OTP box has exactly 4 boxes. Use a\n' +
            '  ⚠  4-digit code for the apps; this one works over the API only.\n') +
        '='.repeat(72) +
        '\n',
    );
  }

  await prepareDatabase();

  const app = await NestFactory.create<NestExpressApplication>(AppModule);
  app.setGlobalPrefix('api');
  app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));
  app.useGlobalFilters(new PrismaExceptionFilter());
  app.enableCors();
  // Uploaded files, mounted OUTSIDE the /api prefix so the URLs stored on
  // UploadedFile.url ("/uploads/<name>") resolve directly.
  app.useStaticAssets(process.env.UPLOAD_DIR ?? join(process.cwd(), 'storage', 'uploads'), {
    prefix: '/uploads/',
    index: false,
    dotfiles: 'deny',
    setHeaders: (res: Response, path: string) => {
      const mime = EXTRA_MIME_TYPES[extname(path).toLowerCase()];
      if (mime) res.setHeader('Content-Type', mime);
    },
  });
  const port = Number(process.env.PORT ?? 3000);

  try {
    // Bind all interfaces explicitly so the container is reachable from nginx.
    await app.listen(port, '0.0.0.0');
  } catch (err) {
    if ((err as NodeJS.ErrnoException).code === 'EADDRINUSE') {
      // eslint-disable-next-line no-console
      console.error(
        `\n[api] Port ${port} is already in use. Free it or change API_PORT ` +
          `in the repo-root .env (and PORT in apps/api/.env to match) — the ` +
          `API will not fall back to a different port.\n`,
      );
      process.exit(1);
    }
    throw err;
  }
}
bootstrap();