"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
const express_1 = __importDefault(require("express"));
const cors_1 = __importDefault(require("cors"));
const helmet_1 = __importDefault(require("helmet"));
const routes_1 = __importDefault(require("./routes"));
const errorHandler_middleware_1 = require("./middleware/errorHandler.middleware");
const xss_middleware_1 = require("./middleware/xss.middleware");
const logger_1 = require("./config/logger");
const assets_1 = require("./config/assets");
const app = (0, express_1.default)();
// 1. Helmet Security Headers (HSTS, CSP, Frameguard, NoSniff)
app.use((0, helmet_1.default)({
    contentSecurityPolicy: {
        directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'", "'unsafe-inline'"],
            styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
            fontSrc: ["'self'", "https://fonts.gstatic.com"],
            imgSrc: ["'self'", "data:", "https:"],
            connectSrc: ["'self'", "https://api.razorpay.com", "https://www.sandbox.paypal.com"],
        },
    },
    crossOriginEmbedderPolicy: false,
}));
// 2. Strict CORS Configuration
app.use((0, cors_1.default)({
    origin: process.env.FRONTEND_URL || 'http://localhost:3000',
    credentials: true,
    methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
    allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With'],
}));
// 3. Request Parsers with Size Limits
app.use(express_1.default.json({ limit: '12mb' }));
app.use(express_1.default.urlencoded({ extended: true, limit: '12mb' }));
app.use('/assets', express_1.default.static(assets_1.assetStorageDir, {
    immutable: process.env.NODE_ENV === 'production',
    maxAge: process.env.NODE_ENV === 'production' ? '30d' : 0,
}));
// 4. XSS Sanitization Middleware
app.use(xss_middleware_1.xssSanitizer);
// 5. Request Logger
app.use((req, res, next) => {
    logger_1.logger.info(`${req.method} ${req.url} - IP: ${req.ip}`);
    next();
});
// Health Endpoint
app.get('/health', (req, res) => {
    res.status(200).json({ status: 'OK', message: 'Indian Books Worldwide API is Healthy and Secure' });
});
// API Routes
app.use('/api/v1', routes_1.default);
// Error Handler Middleware
app.use(errorHandler_middleware_1.errorHandler);
exports.default = app;
//# sourceMappingURL=app.js.map