Demo Admin: Adapt server based on Starter (#3098)

demo/admin/package.json

@@ -19,6 +19,7 @@
         "lint:prettier": "npx prettier --check './**/*.{js,json,md,yml,yaml}'",
         "lint:tsc": "tsc --project .",
         "lint:generated-files-not-modified": "$npm_execpath admin-generator && git diff --exit-code HEAD -- src/**/generated",
+        "serve": "node server",
         "start": "run-s intl:compile && run-p gql:types generate-block-types && dotenv -e .env.site-configs -- chokidar --initial -s \"../../packages/admin/*/src/**\" -c \"kill-port $ADMIN_PORT && vite --force\""
     },
     "dependencies": {

demo/admin/server/index.js

@@ -0,0 +1,69 @@
+/* eslint-disable no-undef */
+const express = require("express");
+const compression = require("compression");
+const helmet = require("helmet");
+const fs = require("fs");
+
+const app = express();
+const port = process.env.APP_PORT ?? 3000;
+
+let indexFile = fs.readFileSync("./build/index.html", "utf8");
+
+// Replace environment variables
+indexFile = indexFile.replace(/\$([A-Z_]+)/g, (match, p1) => {
+    return process.env[p1] || "";
+});
+
+app.use(compression());
+app.use(
+    helmet({
+        contentSecurityPolicy: {
+            directives: {
+                "script-src": ["'self'", "'unsafe-inline'"],
+                "img-src": ["'self'", "https:", "data:"],
+                "default-src": ["'self'", "https:"],
+                "media-src": ["'self'", "https:"],
+                "style-src": ["'self'", "https:", "'unsafe-inline'"],
+                "font-src": ["'self'", "https:", "data:"],
+            },
+        },
+        xXssProtection: false,
+        strictTransportSecurity: {
+            maxAge: 63072000,
+            includeSubDomains: true,
+            preload: true,
+        },
+    }),
+);
+
+app.get("/status/health", (req, res) => {
+    res.send("OK!");
+});
+
+app.use(
+    express.static("./build", {
+        index: false, // Don't send index.html for requests to "/" as it will be handled by the fallback route (with replaced environment variables)
+        setHeaders: (res, path, stat) => {
+            if (path.endsWith(".js")) {
+                // The js file is static and the index.html uses a parameter as cache buster
+                // implemented as suggested by https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#caching_static_assets
+                res.setHeader("cache-control", "public, max-age=31536000, immutable");
+            } else {
+                // Icons and Fonts could be changed over time, cache for 7d
+                res.setHeader("cache-control", "public, max-age=604800, immutable");
+            }
+        },
+    }),
+);
+
+// As a fallback, route everything to index.html
+app.get("*", (req, res) => {
+    // Don't cache the index.html at all to make sure applications updates are applied
+    // implemented as suggested by https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#preventing_storing
+    res.setHeader("cache-control", "no-store");
+    res.send(indexFile);
+});
+
+app.listen(port, () => {
+    console.log(`Admin app listening at http://localhost:${port}`);
+});

demo/admin/server/package.json

@@ -1,13 +1,12 @@
 {
     "name": "comet-demo-admin-server",
-    "version": "1.0.0",
     "private": true,
     "dependencies": {
-        "compression": "^1.7.4",
-        "express": "^4.18.2"
+        "compression": "^1.7.5",
+        "express": "^4.21.1",
+        "helmet": "^7.2.0"
     },
-    "scripts": {
-        "preserve": "envsubst < \"../build/index.html\" > \"/tmp/index.html\" && mv /tmp/index.html ../build/index.html",
-        "serve": "node server.js"
+    "engines": {
+        "node": "22"
     }
 }