Merge pull request #11 from fabrix-app/v1.5

V1.5

archetype/src/config/express.ts

@@ -0,0 +1,10 @@
+/**
+ * Express Configuration
+ * This supplements the config.web with express only configuration
+ */
+export const express = {
+  /**
+   * Spool-express uses helmet by default, it can be disabled by turning the value to false
+   */
+  helmet: {}
+}

lib/archetype/src/config/web.ts → archetype/src/config/web.ts

@@ -38,6 +38,7 @@ export const web = {
      'compression',
      'methodOverride',
      'www',
+     'helmet',
      'router',
      '404',
      '500'

lib/ExpressSpool.ts

@@ -1,6 +1,7 @@
 import { ServerSpool } from '@fabrix/fabrix/dist/common/spools/server'
 import { isArray } from 'lodash'
 import { Express } from 'express'
+import * as helmet from 'helmet'
 
 import { Server } from './server'
 import { Validator } from './validator'
@@ -50,6 +51,7 @@ export class ExpressSpool extends ServerSpool {
     }
 
     return Promise.all([
+      Validator.validateExpress(this.app.config.get('express')),
       Validator.validateWebConfig(this.app.config.get('web'))
     ])
       .catch(err => {
@@ -58,7 +60,12 @@ export class ExpressSpool extends ServerSpool {
   }
 
   configure () {
+    // Set a config that let's other spools know this is using express as a webserver
     this.app.config.set('web.server', 'express')
+    // Set helmet for express if it is not explicitly disabled
+    if (this.app.config.get('express.helmet') === false) {
+      this.app.config.set('web.middlewares.helmet', helmet(this.app.config.get('express.helmet')))
+    }
   }
 
   /**

lib/config/express.ts

@@ -0,0 +1,3 @@
+export const express = {
+  helmet: {}
+}

lib/config/index.ts

@@ -2,9 +2,11 @@ import { spool } from './spool'
 import { web } from './web'
 import { session } from './session'
 import { router } from './router'
+import { express } from './express'
 export {
   spool,
   web,
   session,
-  router
+  router,
+  express
 }

lib/config/web.ts

@@ -37,7 +37,11 @@ export const web = {
       const accept = req.get('accept') || ''
 
       // respond with html page
-      if (accept.indexOf('html') !== -1 && req.app.get('view engine') && !req.wantsJSON) {
+      if (
+        accept.indexOf('html') !== -1
+        && req.app.get('view engine')
+        && !req.wantsJSON
+      ) {
         res.render('404', {
           url: req.url,
           error: req.error
@@ -142,6 +146,7 @@ export const web = {
       'compression',
       'methodOverride',
       'www',
+      'helmet',
       'router',
       '404',
       '500'

lib/schemas/expressConfig.ts

@@ -0,0 +1,4 @@
+import * as joi from 'joi'
+
+export const expressConfig = joi.object().keys({})
+  .unknown()

lib/schemas/index.ts

@@ -1 +1,2 @@
+export { expressConfig } from './expressConfig'
 export { webConfig } from './webConfig'

lib/validator.ts

@@ -1,5 +1,6 @@
 import * as joi from 'joi'
 import { webConfig } from './schemas/webConfig'
+import { expressConfig } from './schemas/expressConfig'
 
 export const Validator = {
   /**
@@ -12,6 +13,17 @@ export const Validator = {
           return reject(new TypeError('config.web: ' + err))
         }
 
+        return resolve(value)
+      })
+    })
+  },
+  validateExpress (config) {
+    return new Promise((resolve, reject) => {
+      joi.validate(config, expressConfig, (err, value) => {
+        if (err) {
+          return reject(new TypeError('config.express: ' + err))
+        }
+
         return resolve(value)
       })
     })