Commit Graph

12 Commits

Author SHA1 Message Date
Oliver Eyton-Williams
58539ce080 refactor(api): DRY tests (#51776) 2023-10-03 21:44:25 +07:00
Muhammed Mustafa
49b728d31b refactor: disable naming-convenction rule (#51685) 2023-09-30 20:23:39 +07:00
Oliver Eyton-Williams
2b5bc585a3 feat(api): sync api and api-server CORS headers (#51608) 2023-09-21 15:40:19 +02:00
Oliver Eyton-Williams
c3c912db07 feat(api): add csrf protection (#50275)
Co-authored-by: Sboonny <muhammed@freecodecamp.org>
2023-05-18 17:06:40 +05:30
Oliver Eyton-Williams
df12c72f46 test: stop mocking FREECODECAMP_NODE_ENV (#50406)
While this lets us write slightly better tests, I don't think it's worth
the extra complexity. For example, it interferes with the creation of
test databases. We could work around this, but I'd rather keep things
simple.
2023-05-17 22:36:22 +04:00
Oliver Eyton-Williams
c2cb818f87 chore(api): add test utilities (#50289) 2023-05-09 11:15:54 +05:30
Oliver Eyton-Williams
5e17868c74 fix(api): allow fastify to set content-type dynamically (#50248)
fix: allow fastify to set content-type dynamically

We can set content-type: application/json for specific routes, but
doing so ends up with confusing, over-engineered code.

Instead we should take care when auditing the endpoints.
2023-05-02 10:15:31 -07:00
Oliver Eyton-Williams
46cdfd7802 feat(api): add CORS headers (#50120)
* test: allow mocking of env vars

Since utils/env is a module, we can mock it to control env vars in
tests. However, it's not compatible with building the server in
setupFilesAfterEnv, so, instead, we can use a utility function to keep
things DRY.

* fix: update type of fastifyTestInstance

* chore: add comment about sts preload

* chore: rename header plugin

* test: add get util + provide origin on request

* feat: add cors headers

* chore: add TODO
2023-04-26 09:02:12 +02:00
Muhammed Mustafa
01b9bd9245 fix(api): fix eslint error (#50080) 2023-04-17 20:21:36 +05:30
Oliver Eyton-Williams
6289efbbad test(api): always start server before testing (#49994) 2023-04-17 17:54:50 +07:00
Oliver Eyton-Williams
71d5a67745 feat(api): add security headers (#49995)
* feat(api): add security headers

Includes the OWASP recommended headers for REST APIs. Taken from
https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html#security-headers

* test: check OWASP headers appear on GET / request

* fix: only enable Strict-Transport-Security in prod
2023-04-13 10:16:58 +02:00
Oliver Eyton-Williams
a128dd8fcd chore(api): compile TS into /dist (#49812
* chore: compile TS into /dist

Having the output co-located with the source meant that the js would be
imported by default. Given that we don't recompile on source changes,
this means the server got 'stuck' at the point of compilation and would
only register changes on build.

Also, compiling to a dist directory should make it easier to build when
we want to deploy. That said, the motivation is mostly DX.

* fix: put schema.prisma in the default location
2023-03-28 19:42:20 +05:30