Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-09-07 10:45:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update group booking and package

Browse Source
This commit is contained in:
Roba Boru
2026-08-27 22:54:59 +03:00
parent 5c2100e76d
commit 1603ff8211
35 changed files with 1170 additions and 377 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
apps/edr-passenger-api/src/main.ts
View File

@@ -4,9 +4,11 @@
import "dotenv/config";
import "reflect-metadata";
import { NestFactory } from "@nestjs/core";
import { NestExpressApplication } from "@nestjs/platform-express";
import { Logger, ValidationPipe, VersioningType } from "@nestjs/common";
import { DocumentBuilder, SwaggerModule } from "@nestjs/swagger";
import helmet from "helmet";
import { join } from "path";
import { AppModule } from "./app.module";
import { HttpExceptionFilter } from "./common/filters/http-exception.filter";
import { ResponseTransformInterceptor } from "./common/interceptors/response-transform.interceptor";
@@ -23,10 +25,20 @@ if (process.env.NODE_ENV === 'production' && process.env.WAAFI_INSECURE_TLS ===
async function bootstrap() {
// rawBody: true buffers the unparsed request body onto req.rawBody so webhook handlers
// (e.g. Waafi HMAC verification) can sign over the exact bytes the provider signed.
const app = await NestFactory.create(AppModule, { rawBody: true });
const app = await NestFactory.create<NestExpressApplication>(AppModule, { rawBody: true });
// Security headers
app.use(helmet());
// Security headers. crossOriginResourcePolicy defaults to 'same-origin' in helmet, which
// would make browsers refuse to actually render package images (served from this origin)
// inside <img> tags on the portal/backoffice (different origins) even though the request
// itself succeeds — relaxed to 'cross-origin' since this API already serves all its JSON to
// those exact same origins per the CORS allowlist below; nothing new is being exposed.
app.use(helmet({ crossOriginResourcePolicy: { policy: "cross-origin" } }));
// Serves apps/edr-passenger-api/public/* at the site root — package images live at
// public/uploads/packages/<file>, reachable as GET /uploads/packages/<file>. Local-disk
// storage is a deliberate, explicit stopgap (see packages.service.ts's uploadImage) rather
// than this app's usual MinIO-backed upload pattern (see modules/support's attachments).
app.useStaticAssets(join(__dirname, "..", "public"));
// URI versioning: the @tria-plc IAM controllers declare `version: "1"` so they register under
// `/v1/...` (e.g. /v1/auth/login). Passenger controllers declare no version, so they stay