chore(config): Harden runtime config and audit fixes (#181)

* chore(server): Harden runtime configuration

* chore(deps): Refresh safe audit fixes

Author: IsaacCheng9

README.md

@@ -48,14 +48,16 @@ MONGODB_URI="<uri>"
 ```
 
 4. Save the file.
+5. Optional: add `CORS_ORIGIN="<origin>"` if the client is not served from
+   `http://localhost:3000`.
 
 ### Running the Server
 
 1. Open a terminal window.
 2. Ensure that you're in the root directory: `fairsplit`
 3. Navigate to the server directory: `cd server`
 4. Install dependencies: `npm install`
-5. Run the server: `node app`
+5. Run the server: `npm start`
 
 ### Running the Client
 

client/package-lock.json

@@ -1,46 +1,23 @@
 const express = require("express");
-const mongoose = require("mongoose");
-require("dotenv").config();
 const cors = require("cors");
 const usersRouter = require("./routes/users.js");
 const expensesRouter = require("./routes/expenses.js");
 const debtsRouter = require("./routes/debts.js");
 const { errorHandler } = require("./middleware/errors");
 
-const app = express();
-app.use(express.json());
-app.use(
-  cors({
-    origin: "http://localhost:3000",
-  }),
-);
-app.use(usersRouter);
-app.use(expensesRouter);
-app.use(debtsRouter);
-app.use(errorHandler);
+function createApp({ corsOrigin = "http://localhost:3000" } = {}) {
+  const app = express();
+  app.use(express.json());
+  app.use(
+    cors({
+      origin: corsOrigin,
+    }),
+  );
+  app.use(usersRouter);
+  app.use(expensesRouter);
+  app.use(debtsRouter);
+  app.use(errorHandler);
+  return app;
+}
 
-// !IMPORTANT: Create .env file with password
-const password = process.env.PASSWORD || "changePasswordHere";
-let devUrl = `mongodb+srv://admin:${password}@fairsplit.fjvgxmg.mongodb.net/?retryWrites=true&w=majority`;
-const mongoDB = process.env.MONGODB_URI || devUrl;
-// Set up the Mongoose connection.
-mongoose
-  .connect(mongoDB)
-  .catch((error) => console.error("MongoDB connection error:", error));
-let db = mongoose.connection;
-
-// Bind the connection to an error event to get notification of connection
-// errors.
-db.on("error", console.error.bind(console, "MongoDB connection error:"));
-// Displays a success message when the connection is successfully made.
-db.once("open", function () {
-  console.log("Connected successfully.");
-});
-
-// Set up the port to listen on.
-const port = process.env.PORT || 3001;
-app.listen(port, () => {
-  console.log(`Server is running at port ${port}.`);
-});
-
-module.exports = app;
+module.exports = { createApp };

server/app.js

@@ -0,0 +1,21 @@
+function parsePort(port) {
+  const parsedPort = Number(port);
+  if (!Number.isInteger(parsedPort) || parsedPort < 1) {
+    throw new Error("PORT must be a positive integer.");
+  }
+  return parsedPort;
+}
+
+function getServerConfig(env = process.env) {
+  if (!env.MONGODB_URI) {
+    throw new Error("MONGODB_URI must be set.");
+  }
+
+  return {
+    corsOrigin: env.CORS_ORIGIN || "http://localhost:3000",
+    mongoDB: env.MONGODB_URI,
+    port: parsePort(env.PORT || "3001"),
+  };
+}
+
+module.exports = { getServerConfig, parsePort };

server/config.js

@@ -0,0 +1,37 @@
+const { getServerConfig, parsePort } = require("./config");
+
+describe("server config", () => {
+  test("requires MONGODB_URI", () => {
+    expect(() => getServerConfig({})).toThrow(/MONGODB_URI/);
+  });
+
+  test("uses safe local defaults for optional runtime config", () => {
+    expect(
+      getServerConfig({
+        MONGODB_URI: "mongodb://localhost:27017/fairsplit",
+      }),
+    ).toEqual({
+      corsOrigin: "http://localhost:3000",
+      mongoDB: "mongodb://localhost:27017/fairsplit",
+      port: 3001,
+    });
+  });
+
+  test("reads explicit runtime config", () => {
+    expect(
+      getServerConfig({
+        CORS_ORIGIN: "https://example.com",
+        MONGODB_URI: "mongodb://localhost:27017/fairsplit",
+        PORT: "8080",
+      }),
+    ).toEqual({
+      corsOrigin: "https://example.com",
+      mongoDB: "mongodb://localhost:27017/fairsplit",
+      port: 8080,
+    });
+  });
+
+  test.each(["0", "-1", "abc", "3000.5"])("rejects invalid PORT %s", (port) => {
+    expect(() => parsePort(port)).toThrow(/PORT/);
+  });
+});

server/config.test.js

@@ -2,8 +2,9 @@
   "name": "server",
   "version": "1.0.0",
   "description": "",
-  "main": "app.js",
+  "main": "server.js",
   "scripts": {
+    "start": "node server.js",
     "test": "jest --verbose --coverage"
   },
   "keywords": [],

server/package-lock.json

@@ -0,0 +1,33 @@
+const mongoose = require("mongoose");
+require("dotenv").config();
+
+const { createApp } = require("./app");
+const { getServerConfig } = require("./config");
+
+async function startServer() {
+  const config = getServerConfig();
+  const app = createApp({ corsOrigin: config.corsOrigin });
+
+  mongoose.connection.on(
+    "error",
+    console.error.bind(console, "MongoDB connection error:"),
+  );
+  mongoose.connection.once("open", () => {
+    console.log("Connected successfully.");
+  });
+
+  await mongoose.connect(config.mongoDB);
+
+  return app.listen(config.port, () => {
+    console.log(`Server is running at port ${config.port}.`);
+  });
+}
+
+if (require.main === module) {
+  startServer().catch((error) => {
+    console.error("Failed to start server:", error.message);
+    process.exit(1);
+  });
+}
+
+module.exports = { startServer };