import { Response , Request , NextFunction } from 'express' ; import { NOT_ACCEPTABLE } from 'http-status' ; import config from '../config' ; export function getRemoteIpFromRequest ( req ) { let remoteIp = req . header ( 'cf-connecting-ip' ) || req . header ( 'x-real-ip' ) || req . ip ; if ( remoteIp . substr ( 0 , 7 ) === '::ffff:' ) { remoteIp = remoteIp . substr ( 7 ) ; } return remoteIp ; } export function httpsMiddleware ( req , res , next ) { if ( req . secure ) { res . setHeader ( 'Strict-Transport-Security' , 'max-age=31536000' ) ; } next ( ) ; } export function contentMiddleware ( req , res , next ) { if ( req . path . indexOf ( '/_metrics/' ) === 0 ) { return next ( ) ; } if ( req . method !== 'OPTIONS' ) { const acceptHeader = req . header ( 'Accept' ) || '' ; if ( acceptHeader !== 'application/json' && ! acceptHeader . includes ( 'application/vnd.wallets+json;' ) ) { return res . status ( NOT_ACCEPTABLE ) . json ( { message : 'Unsupported "Accept" header' } ) ; } const contentHeader = req . header ( 'Content-Type' ) || '' ; if ( contentHeader !== 'application/json' && ! contentHeader . includes ( 'application/x-www-form-urlencoded' ) ) { return res . status ( NOT_ACCEPTABLE ) . json ( { message : 'Unsupported "Content-Type"' } ) ; } } res . setHeader ( 'X-Content-Type-Options' , 'nosniff' ) ; res . setHeader ( 'X-Frame-Options' , 'deny' ) ; res . setHeader ( 'Content-Security-Policy' , 'default-src \'none\'' ) ; req . app . locals . remoteIp = getRemoteIpFromRequest ( req ) ; return next ( ) ; } export function corsMiddleware ( req , res , next ) { res . header ( 'Access-Control-Allow-Origin' , '*' ) ; res . header ( 'Access-Control-Allow-Headers' , 'Authorization, Origin, X-Requested-With, Content-Type, Accept' ) ; return next ( ) ; }