Socialflow/server/index.ts

import express, { type Request, Response, NextFunction } from "express";
import type { IncomingMessage } from "http";
import path from "path";
import fs from "fs";
import session from "express-session";
import connectPgSimple from "connect-pg-simple";
import pg from "pg";
import crypto from "crypto";
import helmet from "helmet";
import rateLimit from "express-rate-limit";
import passport from "./auth";
import { registerRoutes } from "./routes";
import { setupVite, serveStatic, log } from "./vite";
import { schedulerService } from "./services/scheduler";
import { ensureAdminUserExists } from "./init-admin";
import { startTokenCron } from "./cron";
import { migrate } from "./migrate";
import { startReelProcessing } from "./services/reels";
import { jamendoService } from "./services/jamendo";
import { ffmpegService } from "./services/ffmpeg";

const app = express();
const PgSession = connectPgSimple(session);

// Faire confiance au reverse proxy (nginx) pour X-Forwarded-For
// Nécessaire pour que express-rate-limit identifie correctement les IPs
app.set('trust proxy', 1);

// Headers de sécurité HTTP avec helmet
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
      styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
      imgSrc: ["'self'", "data:", "https:", "blob:"],
      fontSrc: ["'self'", "https://fonts.gstatic.com"],
      connectSrc: ["'self'", "https://graph.facebook.com", "https://openrouter.ai", "https://res.cloudinary.com", "wss:", "ws:"],
      mediaSrc: ["'self'", "https:", "data:"],
    }
  },
  crossOriginEmbedderPolicy: false,
}));

// Rate limiting global - 1000 requêtes par 15 minutes par IP
const globalLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 1000,
  message: { error: 'Trop de requêtes, réessayez plus tard' },
  standardHeaders: true,
  legacyHeaders: false,
});

// Rate limiting pour l'authentification - 30 tentatives par 15 minutes
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 30,
  message: { error: 'Trop de tentatives de connexion, réessayez dans 15 minutes' },
  standardHeaders: true,
  legacyHeaders: false,
});

app.use('/api/', globalLimiter);
app.use('/api/auth/login', authLimiter);

// Serve locally stored audio files
const AUDIO_UPLOAD_DIR = process.env.AUDIO_UPLOAD_DIR || '/app/uploads/audio';
app.use('/uploads/audio', express.static(AUDIO_UPLOAD_DIR));

// Serve locally stored media files (images, videos, logos, stories)
const MEDIA_UPLOAD_DIR = path.join(process.cwd(), 'uploads', 'media');
const LOGOS_UPLOAD_DIR = path.join(process.cwd(), 'uploads', 'logos');
const STORIES_UPLOAD_DIR = path.join(process.cwd(), 'uploads', 'stories');
try { fs.mkdirSync(MEDIA_UPLOAD_DIR, { recursive: true }); } catch { /* ignore */ }
try { fs.mkdirSync(LOGOS_UPLOAD_DIR, { recursive: true }); } catch { /* ignore */ }
try { fs.mkdirSync(STORIES_UPLOAD_DIR, { recursive: true }); } catch { /* ignore */ }
app.use('/uploads/media', express.static(MEDIA_UPLOAD_DIR));
app.use('/uploads/logos', express.static(LOGOS_UPLOAD_DIR));
app.use('/uploads/stories', express.static(STORIES_UPLOAD_DIR));

// Serve temp uploads for Remotion
const TEMP_UPLOAD_DIR = process.env.TEMP_UPLOAD_DIR || path.join(process.cwd(), 'uploads', 'temp');
try { fs.mkdirSync(TEMP_UPLOAD_DIR, { recursive: true }); } catch { /* ignore */ }
app.use('/uploads/temp', express.static(TEMP_UPLOAD_DIR));

declare module 'http' {
  interface IncomingMessage {
    rawBody: unknown
  }
}
const keepRawBody = (req: IncomingMessage, _res: unknown, buf: Buffer) => {
  req.rawBody = buf;
};
// L'API externe accepte des images en base64 (imageData) : 10 MB d'image font
// ~13,4 MB une fois encodés. Ce parseur passe avant le parseur global (100 KB),
// qui ignore ensuite un corps déjà lu.
app.use('/api/v1', express.json({ limit: '15mb', verify: keepRawBody }));
app.use(express.json({ verify: keepRawBody }));
app.use(express.urlencoded({ extended: false }));

// Validation renforcée du SESSION_SECRET
if (!process.env.SESSION_SECRET && process.env.NODE_ENV === 'production') {
  console.error('❌ SESSION_SECRET non défini en production. Arrêt du serveur.');
  process.exit(1);
}

if (!process.env.SESSION_SECRET) {
  console.warn('⚠️ SESSION_SECRET non défini. Utilisation d\'une clé aléatoire pour le développement.');
}

// Générer un secret aléatoire pour le dev si non défini
const sessionSecret = process.env.SESSION_SECRET || crypto.randomBytes(32).toString('hex');

// HTTPS déduit d'APP_URL ; à défaut, 'auto' laisse express-session décider par
// requête à partir de X-Forwarded-Proto (cf. `trust proxy` plus haut), ce qui
// évite un cookie non sécurisé derrière un reverse proxy HTTPS sans APP_URL.
const isHttps: boolean | 'auto' = process.env.APP_URL?.startsWith('https://') || 'auto';

// Configuration du store de session pour production
const sessionStore = process.env.NODE_ENV === 'production' && process.env.DATABASE_URL
  ? new PgSession({
    pool: new pg.Pool({
      connectionString: process.env.DATABASE_URL,
    }),
    tableName: 'session',
    createTableIfMissing: true,
  })
  : undefined; // MemoryStore par défaut en dev

app.use(session({
  store: sessionStore,
  secret: sessionSecret,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: isHttps,
    httpOnly: true,
    sameSite: 'lax',
    maxAge: 7 * 24 * 60 * 60 * 1000, // 7 jours
  }
}));

// Initialisation de Passport
app.use(passport.initialize());
app.use(passport.session());

app.use((req, res, next) => {
  const start = Date.now();
  const path = req.path;
  let capturedJsonResponse: Record<string, any> | undefined = undefined;

  const originalResJson = res.json;
  res.json = function (bodyJson, ...args) {
    capturedJsonResponse = bodyJson;
    return originalResJson.apply(res, [bodyJson, ...args]);
  };

  res.on("finish", () => {
    const duration = Date.now() - start;
    if (path.startsWith("/api")) {
      // Ne pas logger les 401 sur /api/auth/session (vérification normale de session)
      if (path === "/api/auth/session" && res.statusCode === 401) {
        return;
      }

      let logLine = `${req.method} ${path} ${res.statusCode} in ${duration}ms`;
      if (capturedJsonResponse) {
        logLine += ` :: ${JSON.stringify(capturedJsonResponse)}`;
      }

      if (logLine.length > 80) {
        logLine = logLine.slice(0, 79) + "…";
      }

      log(logLine);
    }
  });

  next();
});

(async () => {
  // Run database migration first
  await migrate();

  const server = await registerRoutes(app);

  app.use((err: any, _req: Request, res: Response, _next: NextFunction) => {
    const status = err.status || err.statusCode || 500;
    const message = err.message || "Internal Server Error";

    res.status(status).json({ message });
    throw err;
  });

  // importantly only setup vite in development and after
  // setting up all the other routes so the catch-all route
  // doesn't interfere with the other routes
  if (app.get("env") === "development") {
    await setupVite(app, server);
  } else {
    serveStatic(app);
  }

  // ALWAYS serve the app on the port specified in the environment variable PORT
  // Other ports are firewalled. Default to 5000 if not specified.
  // this serves both the API and the client.
  // It is the only port that is not firewalled.
  const port = parseInt(process.env.PORT || '5000', 10);

  // Initialiser l'utilisateur admin par défaut avant de démarrer le serveur
  await ensureAdminUserExists();

  // Configurer le service Jamendo pour les Reels
  const jamendoClientId = process.env.JAMENDO_CLIENT_ID || '5b6bba49';
  jamendoService.configure(jamendoClientId);


  // Configurer le service FFmpeg pour le traitement vidéo (si configuré)
  if (process.env.FFMPEG_API_URL && process.env.FFMPEG_API_KEY) {
    ffmpegService.configure(process.env.FFMPEG_API_URL, process.env.FFMPEG_API_KEY);
  } else {
    log('⚠️ FFmpeg API not configured - video processing will be skipped');
  }

  server.listen({
    port,
    host: "0.0.0.0",
    reusePort: true,
  }, () => {
    log(`serving on port ${port}`);

    // Démarrer le scheduler pour les publications programmées
    schedulerService.start();

    // Start Token Refresh Cron
    startTokenCron();

    // File des rendus de Reels : démarrée une fois le serveur à l'écoute, car
    // le rendu d'images lit la voix et la musique via http://localhost.
    startReelProcessing().catch((error) => {
      console.error("❌ Démarrage de la file des Reels impossible :", error);
    });
  });
})();