tehran_tala/apps/api/src/main.ts

import 'reflect-metadata';
import { NestFactory } from '@nestjs/core';
import { ValidationPipe } from '@nestjs/common';
import { NestExpressApplication } from '@nestjs/platform-express';
import { extname, join } from 'node:path';
import type { Response } from 'express';
import { AppModule } from './app.module';
import { prepareDatabase } from './prisma/bootstrap';
import { PrismaExceptionFilter } from './prisma/prisma-exception.filter';
import { assertSmsConfigured } from './modules/sms/sms.service';
import { envOr, envOrNull } from './common/env';
import { masterOtpCode, masterOtpEnabled } from './modules/customer-auth/customer-auth.service';

// serve-static's bundled `mime` version predates .avif, so it falls back to
// application/octet-stream — browsers still render the image (they sniff
// content), but a strict client or an <img> under some CSPs would not.
const EXTRA_MIME_TYPES: Record<string, string> = {
  '.avif': 'image/avif',
};

/**
 * SEC-04 — production must not run on the published development key. Both JWT
 * modules fall back to 'dev-only-insecure-secret' (a string anyone can read
 * in this repository), with which anyone could mint an admin token. Outside
 * production that fallback is kept, so a fresh checkout still runs.
 */
function assertProductionSecrets() {
  if (process.env.NODE_ENV !== 'production') return;
  if (!envOrNull('JWT_SECRET')) {
    throw new Error(
      'JWT_SECRET تنظیم نشده است — سرور در حالت production بدون آن اجرا نمی‌شود.\n' +
        'JWT_SECRET is not set: refusing to start in production on the public development key.',
    );
  }
}

/**
 * SEC-04 — which sites may call the API from a browser. CORS_ORIGINS is a
 * comma-separated list of exact origins (e.g. https://adm.example.ir,https://app.example.ir).
 * Unset keeps the old allow-all, with a warning in production, so an existing
 * deployment keeps working until the list is filled in.
 */
function corsOrigins(): string[] | true {
  const list = (envOrNull('CORS_ORIGINS') ?? '')
    .split(',')
    .map((o) => o.trim().replace(/\/+$/, ''))
    .filter(Boolean);
  if (list.length) return list;
  if (process.env.NODE_ENV === 'production') {
    console.warn('⚠  CORS_ORIGINS تنظیم نشده — هر سایتی می‌تواند به API درخواست بفرستد. / CORS_ORIGINS is not set: any website may call this API.');
  }
  return true;
}

async function bootstrap() {
  assertProductionSecrets();

  // D20 — reports the SMS configuration and never throws. A missing credential
  // no longer stops the boot; messages are logged instead of sent.
  assertSmsConfigured();

  // A missing JWT_CUSTOMER_SECRET is not a cosmetic default: customerJwtSecret()
  // falls back to JWT_SECRET, so admin and app tokens end up signed with the
  // SAME key. The `typ` check in JwtStrategy is then the only thing keeping an
  // app token off the admin routes — one guard instead of two independent ones,
  // and a sales expert's app token carries their AdminUser id in `sub`. Warn as
  // loudly as the master-code banner rather than fail the boot, so a running
  // deployment that has not set it yet still starts.
  if (!envOrNull('JWT_CUSTOMER_SECRET')) {
    const sharedWithAdmin = Boolean(envOrNull('JWT_SECRET'));
    // eslint-disable-next-line no-console
    console.warn(
      '\n' +
        '='.repeat(72) +
        '\n  ⚠  JWT_CUSTOMER_SECRET تنظیم نشده است\n' +
        '  ⚠  JWT_CUSTOMER_SECRET IS NOT SET.\n' +
        (sharedWithAdmin
          ? '  ⚠  Customer/expert app tokens are being signed with JWT_SECRET,\n' +
            '  ⚠  the SAME key as admin tokens. The two token realms are no\n' +
            '  ⚠  longer cryptographically separated.\n'
          : '  ⚠  Neither JWT_SECRET nor JWT_CUSTOMER_SECRET is set, so app\n' +
            '  ⚠  tokens are signed with a well-known development string.\n') +
        '  ⚠  Set JWT_CUSTOMER_SECRET to a distinct random value before release.\n' +
        '='.repeat(72) +
        '\n',
    );
  }

  // D20 — a loud, unmissable banner whenever the delivery bypass is armed, so
  // it cannot reach the real release unnoticed.
  if (masterOtpEnabled()) {
    const code = masterOtpCode() ?? '';
    // Both apps render the login OTP as FOUR single-character boxes and only
    // submit on @on-complete, i.e. at exactly 4 digits
    // (LoginView.vue:43 in each app, OtpInput.vue:43). The API itself accepts
    // any length, so a longer master code works over HTTP but can never be
    // typed into the apps. Warn rather than reject: an operator may be using it
    // for API testing only.
    const typable = /^\d{4}$/.test(code);
    // eslint-disable-next-line no-console
    console.warn(
      '\n' +
        '='.repeat(72) +
        '\n  ⚠  OTP_MASTER_CODE فعال است — قبل از انتشار اصلی حذف شود\n' +
        '  ⚠  OTP_MASTER_CODE IS ACTIVE: any active customer can sign in with\n' +
        '  ⚠  this fixed code. Remove it from the environment before release.\n' +
        (typable
          ? ''
          : '  ⚠\n' +
            '  ⚠  NOTE: this code is not 4 digits, so it CANNOT be entered in the\n' +
            '  ⚠  customer apps — their OTP box has exactly 4 boxes. Use a\n' +
            '  ⚠  4-digit code for the apps; this one works over the API only.\n') +
        '='.repeat(72) +
        '\n',
    );
  }

  await prepareDatabase();

  const app = await NestFactory.create<NestExpressApplication>(AppModule);
  app.setGlobalPrefix('api');
  app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));
  app.useGlobalFilters(new PrismaExceptionFilter());
  app.enableCors({ origin: corsOrigins() });
  // Uploaded files, mounted OUTSIDE the /api prefix so the URLs stored on
  // UploadedFile.url ("/uploads/<name>") resolve directly.
  app.useStaticAssets(envOr('UPLOAD_DIR', join(process.cwd(), 'storage', 'uploads')), {
    prefix: '/uploads/',
    index: false,
    dotfiles: 'deny',
    setHeaders: (res: Response, path: string) => {
      const mime = EXTRA_MIME_TYPES[extname(path).toLowerCase()];
      if (mime) res.setHeader('Content-Type', mime);
    },
  });
  // envOr, not `??`: Number('') is 0, which would bind a random ephemeral port
  // and make the container unreachable at the port compose maps. See DEPLOY-02.
  const port = Number(envOr('PORT', '3000'));

  try {
    // Bind all interfaces explicitly so the container is reachable from nginx.
    await app.listen(port, '0.0.0.0');
  } catch (err) {
    if ((err as NodeJS.ErrnoException).code === 'EADDRINUSE') {
      // eslint-disable-next-line no-console
      console.error(
        `\n[api] Port ${port} is already in use. Free it or change API_PORT ` +
          `in the repo-root .env (and PORT in apps/api/.env to match) — the ` +
          `API will not fall back to a different port.\n`,
      );
      process.exit(1);
    }
    throw err;
  }
}
bootstrap();