initial

server.js

@@ -0,0 +1,115 @@
+/***********************************************************************************************************************************************************************
+ * File Name: server.js
+ * Type of Program: Application Entry Point
+ * Description: Bootstraps the Express application.
+ *              Registers global middleware (CORS, rate-limit, cookie-parser,
+ *              session, Passport) and mounts all route groups.
+ *              Syncs Sequelize models to the database on startup.
+ *
+ * Author: rgrgogu
+ * Date Created: Oct. 6, 2025
+ ***********************************************************************************************************************************************************************
+ * HOW TO RUN:
+ *   1. cp .env.example .env   (fill in your values)
+ *   2. npm install
+ *   3. npm run dev            (development)
+ *      npm start              (production)
+ ***********************************************************************************************************************************************************************/
+require('dotenv').config();
+
+const express       = require('express');
+const cors          = require('cors');
+const cookieParser  = require('cookie-parser');
+const session       = require('express-session');
+const passport      = require('./config/passport.config');
+const sequelize     = require('./config/db.config');
+
+// ── Middleware ──────────────────────────────────────────────────────────────────
+const { globalLimiter }  = require('./middleware/rateLimiter.middleware');
+const { csrfErrorHandler } = require('./middleware/csrf.middleware');
+
+// ── Routes ─────────────────────────────────────────────────────────────────────
+const authRoutes   = require('./routes/auth.routes');
+const clientRoutes = require('./routes/client/client.routes');
+const staffRoutes  = require('./routes/staff/staff.routes');
+const adminRoutes  = require('./routes/admin/admin.routes');
+
+// ── Models (ensure associations are loaded) ────────────────────────────────────
+require('./models/users/users.mdl');
+require('./models/users/user_sessions.mdl');
+require('./models/users/user_groups.mdl');
+
+const app  = express();
+const PORT = process.env.PORT || 3000;
+
+// ──────────────────────────────────────────────────────────────────────────────
+//  Global Middleware Stack
+// ──────────────────────────────────────────────────────────────────────────────
+app.set('trust proxy', 1); // Required for rate-limiter behind proxies/load balancers
+
+app.use(cors({
+  origin:      process.env.APP_URL || '*',
+  credentials: true,
+}));
+
+app.use(express.json());
+app.use(express.urlencoded({ extended: true }));
+app.use(cookieParser());
+
+// Session — used only by csurf; JWT handles auth state
+app.use(session({
+  secret:            process.env.SESSION_SECRET || 'change-me',
+  resave:            false,
+  saveUninitialized: false,
+  cookie:            { secure: process.env.NODE_ENV === 'production', httpOnly: true, sameSite: 'strict' },
+}));
+
+app.use(passport.initialize());
+
+// Global rate limiter (1000 req / 15 min)
+app.use(globalLimiter);
+
+// ──────────────────────────────────────────────────────────────────────────────
+//  Routes
+// ──────────────────────────────────────────────────────────────────────────────
+app.use('/api/auth',   authRoutes);
+app.use('/api/client', clientRoutes);
+app.use('/api/staff', staffRoutes);
+app.use('/api/admin',  adminRoutes);
+
+// Health check
+app.get('/api/health', (req, res) => {
+  res.json({ status: 'ok', timestamp: new Date().toISOString(), env: process.env.NODE_ENV });
+});
+
+// 404 handler
+app.use((req, res) => {
+  res.status(404).json({ status: 'error', message: 'Route not found.' });
+});
+
+// CSRF error handler (must be after routes)
+app.use(csrfErrorHandler);
+
+// Global error handler
+app.use((err, req, res, next) => {
+  console.error('[UNHANDLED ERROR]', err);
+  res.status(500).json({ status: 'error', message: 'Internal server error.' });
+});
+
+// ──────────────────────────────────────────────────────────────────────────────
+//  Database Sync + Listen
+// ──────────────────────────────────────────────────────────────────────────────
+(async () => {
+  try {
+    await sequelize.authenticate();
+    console.log('✅  Database connected.');
+
+    app.listen(PORT, () => {
+      console.log(`🚀  STARR Server running on http://localhost:${PORT}`);
+      console.log(`    Environment : ${process.env.NODE_ENV}`);
+    });
+  } catch (err) {
+    console.error('❌  Failed to start server:', err);
+    process.exit(1);
+  }
+})();