b3dc608750
Implement enterprise-grade security measures and input validation: Security Features: - Add Helmet.js for security headers (XSS, clickjacking, MIME protection) - Implement rate limiting (5/15min for auth, 100/15min for API) - Add Socket.IO JWT authentication middleware - Fix JWT auth middleware (remove throw in catch, extend token to 7 days) - Implement centralized error handling with AppError class - Add CORS restrictive configuration Input Validation: - Add express-validator to all routes (auth, streets, tasks, posts, events, rewards, reports, users) - Create comprehensive validation schemas in middleware/validators/ - Consistent error response format for validation failures Additional Features: - Add pagination middleware for all list endpoints - Add Multer file upload middleware (5MB limit, image validation) - Update .env.example with all required environment variables Dependencies Added: - helmet@8.1.0 - express-rate-limit@8.2.1 - express-validator@7.3.0 - multer@1.4.5-lts.1 - cloudinary@2.8.0 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
69 lines
1.6 KiB
JavaScript
69 lines
1.6 KiB
JavaScript
const { body, validationResult } = require("express-validator");
|
|
|
|
/**
|
|
* Validation middleware to check validation results
|
|
*/
|
|
const validate = (req, res, next) => {
|
|
const errors = validationResult(req);
|
|
if (!errors.isEmpty()) {
|
|
return res.status(400).json({
|
|
success: false,
|
|
errors: errors.array().map((err) => ({
|
|
field: err.path,
|
|
message: err.msg,
|
|
})),
|
|
});
|
|
}
|
|
next();
|
|
};
|
|
|
|
/**
|
|
* Register validation rules
|
|
*/
|
|
const registerValidation = [
|
|
body("name")
|
|
.trim()
|
|
.notEmpty()
|
|
.withMessage("Name is required")
|
|
.isLength({ min: 2, max: 50 })
|
|
.withMessage("Name must be between 2 and 50 characters"),
|
|
body("email")
|
|
.trim()
|
|
.notEmpty()
|
|
.withMessage("Email is required")
|
|
.isEmail()
|
|
.withMessage("Please provide a valid email address")
|
|
.normalizeEmail(),
|
|
body("password")
|
|
.notEmpty()
|
|
.withMessage("Password is required")
|
|
.isLength({ min: 6 })
|
|
.withMessage("Password must be at least 6 characters long")
|
|
.matches(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/)
|
|
.withMessage(
|
|
"Password must contain at least one uppercase letter, one lowercase letter, and one number",
|
|
),
|
|
validate,
|
|
];
|
|
|
|
/**
|
|
* Login validation rules
|
|
*/
|
|
const loginValidation = [
|
|
body("email")
|
|
.trim()
|
|
.notEmpty()
|
|
.withMessage("Email is required")
|
|
.isEmail()
|
|
.withMessage("Please provide a valid email address")
|
|
.normalizeEmail(),
|
|
body("password").notEmpty().withMessage("Password is required"),
|
|
validate,
|
|
];
|
|
|
|
module.exports = {
|
|
registerValidation,
|
|
loginValidation,
|
|
validate,
|
|
};
|