root
396 lines
16 KiB
TypeScript
396 lines
16 KiB
TypeScript
import express from 'express'
|
|
import cors from 'cors'
|
|
import helmet from 'helmet'
|
|
import morgan from 'morgan'
|
|
import http from 'http'
|
|
import { Server as SocketIOServer } from 'socket.io'
|
|
import cron from 'node-cron'
|
|
import jwt from 'jsonwebtoken'
|
|
import { z } from 'zod'
|
|
import { redis } from './lib/redis'
|
|
import { prisma } from './lib/prisma'
|
|
import { authLimiter, apiLimiter, publicLimiter, adminLimiter } from './middleware/rateLimiter'
|
|
|
|
// ─── Routes ───────────────────────────────────────────────────
|
|
import webhookRouter from './routes/webhooks'
|
|
import companyAuthRouter from './routes/auth.company'
|
|
import employeeAuthRouter from './routes/auth.employee'
|
|
import renterAuthRouter from './routes/auth.renter'
|
|
import vehiclesRouter from './routes/vehicles'
|
|
import reservationsRouter from './routes/reservations'
|
|
import teamRouter from './routes/team'
|
|
import customersRouter from './routes/customers'
|
|
import offersRouter from './routes/offers'
|
|
import analyticsRouter from './routes/analytics'
|
|
import notificationsRouter from './routes/notifications'
|
|
import marketplaceRouter from './routes/marketplace'
|
|
import adminRouter from './routes/admin'
|
|
import companiesRouter from './routes/companies'
|
|
import subscriptionsRouter from './routes/subscriptions'
|
|
import siteRouter from './routes/site'
|
|
import paymentsRouter from './routes/payments'
|
|
|
|
const app = express()
|
|
const server = http.createServer(app)
|
|
|
|
// Trust the first hop from a reverse proxy so req.ip and rate-limiting
|
|
// use the real client IP (from X-Forwarded-For) rather than the proxy's IP.
|
|
if (process.env.NODE_ENV === 'production') {
|
|
app.set('trust proxy', 1)
|
|
}
|
|
const v1 = '/api/v1'
|
|
const defaultCorsOrigins = [
|
|
'http://localhost:3000',
|
|
'http://localhost:3001',
|
|
'http://localhost:3002',
|
|
'http://localhost:3003',
|
|
'http://127.0.0.1:3000',
|
|
'http://127.0.0.1:3001',
|
|
'http://127.0.0.1:3002',
|
|
'http://127.0.0.1:3003',
|
|
]
|
|
const corsOrigins = process.env.CORS_ORIGINS
|
|
? process.env.CORS_ORIGINS.split(',').map((origin) => origin.trim()).filter(Boolean)
|
|
: defaultCorsOrigins
|
|
|
|
const routeDocs = [
|
|
{ method: 'GET', path: '/health', description: 'Health check' },
|
|
{ method: 'GET', path: `${v1}/docs`, description: 'Machine-readable API index' },
|
|
{ method: 'GET', path: `${v1}/auth/renter/me`, description: 'Current renter profile' },
|
|
{ method: 'GET', path: `${v1}/vehicles`, description: 'List company vehicles' },
|
|
{ method: 'POST', path: `${v1}/vehicles`, description: 'Create vehicle' },
|
|
{ method: 'GET', path: `${v1}/reservations`, description: 'List reservations' },
|
|
{ method: 'POST', path: `${v1}/reservations`, description: 'Create reservation' },
|
|
{ method: 'GET', path: `${v1}/customers`, description: 'List customers' },
|
|
{ method: 'POST', path: `${v1}/customers`, description: 'Create customer' },
|
|
{ method: 'GET', path: `${v1}/offers`, description: 'List offers' },
|
|
{ method: 'GET', path: `${v1}/analytics/dashboard`, description: 'Dashboard analytics' },
|
|
{ method: 'GET', path: `${v1}/analytics/report`, description: 'Analytics report' },
|
|
{ method: 'GET', path: `${v1}/notifications/company`, description: 'Company notifications' },
|
|
{ method: 'GET', path: `${v1}/marketplace/cities`, description: 'Marketplace cities' },
|
|
{ method: 'GET', path: `${v1}/marketplace/search`, description: 'Marketplace search' },
|
|
{ method: 'GET', path: `${v1}/site/:slug/brand`, description: 'Public site brand config' },
|
|
{ method: 'GET', path: `${v1}/companies/me`, description: 'Current company profile' },
|
|
{ method: 'GET', path: `${v1}/subscriptions/plans`, description: 'Subscription plans' },
|
|
{ method: 'POST', path: `${v1}/admin/auth/login`, description: 'Admin login' },
|
|
]
|
|
|
|
// ─── Socket.io ────────────────────────────────────────────────
|
|
const io = new SocketIOServer(server, {
|
|
cors: { origin: corsOrigins, credentials: true, methods: ['GET', 'POST'] },
|
|
})
|
|
|
|
const redisMessageSchema = z.object({
|
|
type: z.string(),
|
|
payload: z.unknown(),
|
|
})
|
|
|
|
// Authenticate socket connections via JWT before joining user rooms
|
|
io.use((socket, next) => {
|
|
const token = socket.handshake.auth?.token as string | undefined
|
|
if (!token) return next() // unauthenticated connections allowed; they just don't join rooms
|
|
try {
|
|
const payload = jwt.verify(token, process.env.JWT_SECRET!) as { sub: string; type: string }
|
|
;(socket as any).authenticatedUserId = payload.sub
|
|
next()
|
|
} catch {
|
|
next(new Error('invalid_token'))
|
|
}
|
|
})
|
|
|
|
io.on('connection', (socket) => {
|
|
const userId = (socket as any).authenticatedUserId as string | undefined
|
|
if (userId) {
|
|
socket.join(`user:${userId}`)
|
|
}
|
|
})
|
|
|
|
// Redis pub/sub → broadcast to connected clients
|
|
const subscriber = redis.duplicate()
|
|
subscriber.psubscribe('notifications:*', (err) => {
|
|
if (err) console.error('[Redis] Subscribe error:', err)
|
|
})
|
|
subscriber.on('pmessage', (_pattern, channel, message) => {
|
|
try {
|
|
const parsed = JSON.parse(message)
|
|
const validated = redisMessageSchema.parse(parsed)
|
|
const userId = channel.replace('notifications:', '')
|
|
io.to(`user:${userId}`).emit('notification', validated)
|
|
} catch (err) {
|
|
console.error('[Redis] Invalid notification message:', err)
|
|
}
|
|
})
|
|
|
|
// ─── Middleware ────────────────────────────────────────────────
|
|
// Serve local file storage
|
|
app.use('/storage', express.static(require('path').resolve(__dirname, 'lib/storage')))
|
|
|
|
// Webhook must use raw body BEFORE express.json()
|
|
app.use('/api/v1/webhooks', express.raw({ type: 'application/json' }), webhookRouter)
|
|
|
|
app.use(helmet())
|
|
app.use(cors({ origin: corsOrigins, credentials: true }))
|
|
app.use(morgan('combined'))
|
|
app.use(express.json({ limit: '10mb' }))
|
|
|
|
// ─── API Routes ───────────────────────────────────────────────
|
|
// Auth routes: strict brute-force protection
|
|
app.use(`${v1}/auth/renter`, authLimiter, renterAuthRouter)
|
|
app.use(`${v1}/auth/company`, authLimiter, companyAuthRouter)
|
|
app.use(`${v1}/auth/employee`, authLimiter, employeeAuthRouter)
|
|
|
|
// Admin routes: dedicated limit
|
|
app.use(`${v1}/admin`, adminLimiter, adminRouter)
|
|
|
|
// Public unauthenticated routes
|
|
app.use(`${v1}/marketplace`, publicLimiter, marketplaceRouter)
|
|
app.use(`${v1}/site`, publicLimiter, siteRouter)
|
|
|
|
// Authenticated company/renter routes
|
|
app.use(`${v1}/vehicles`, apiLimiter, vehiclesRouter)
|
|
app.use(`${v1}/reservations`, apiLimiter, reservationsRouter)
|
|
app.use(`${v1}/team`, apiLimiter, teamRouter)
|
|
app.use(`${v1}/customers`, apiLimiter, customersRouter)
|
|
app.use(`${v1}/offers`, apiLimiter, offersRouter)
|
|
app.use(`${v1}/analytics`, apiLimiter, analyticsRouter)
|
|
app.use(`${v1}/notifications`, apiLimiter, notificationsRouter)
|
|
app.use(`${v1}/companies`, apiLimiter, companiesRouter)
|
|
app.use(`${v1}/subscriptions`, apiLimiter, subscriptionsRouter)
|
|
app.use(`${v1}/payments`, apiLimiter, paymentsRouter)
|
|
|
|
// ─── Health check ─────────────────────────────────────────────
|
|
app.get('/health', (_req, res) => {
|
|
res.json({ status: 'ok', version: '1.0.0', timestamp: new Date().toISOString() })
|
|
})
|
|
|
|
app.get(`${v1}/docs`, (_req, res) => {
|
|
res.json({
|
|
name: 'rentaldrivego-api',
|
|
version: '1.0.0',
|
|
baseUrl: v1,
|
|
docsUrl: '/docs',
|
|
routes: routeDocs,
|
|
})
|
|
})
|
|
|
|
app.get('/docs', (_req, res) => {
|
|
const rows = routeDocs
|
|
.map(
|
|
(route) => `
|
|
<tr>
|
|
<td>${route.method}</td>
|
|
<td><code>${route.path}</code></td>
|
|
<td>${route.description}</td>
|
|
</tr>`,
|
|
)
|
|
.join('')
|
|
|
|
res.type('html').send(`<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<title>RentalDriveGo API Docs</title>
|
|
<style>
|
|
body { font-family: Arial, sans-serif; margin: 40px; color: #0f172a; background: #f8fafc; }
|
|
h1 { margin-bottom: 8px; }
|
|
p { color: #475569; }
|
|
.meta { margin-bottom: 24px; }
|
|
table { width: 100%; border-collapse: collapse; background: #fff; border-radius: 12px; overflow: hidden; }
|
|
th, td { text-align: left; padding: 12px 16px; border-bottom: 1px solid #e2e8f0; }
|
|
th { background: #e2e8f0; font-size: 12px; text-transform: uppercase; letter-spacing: 0.04em; }
|
|
code { background: #f1f5f9; padding: 2px 6px; border-radius: 6px; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<h1>RentalDriveGo API</h1>
|
|
<p class="meta">Base URL: <code>${v1}</code> · JSON index: <code>${v1}/docs</code></p>
|
|
<table>
|
|
<thead>
|
|
<tr>
|
|
<th>Method</th>
|
|
<th>Path</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>${rows}</tbody>
|
|
</table>
|
|
</body>
|
|
</html>`)
|
|
})
|
|
|
|
// ─── Error handler ────────────────────────────────────────────
|
|
app.use((err: any, _req: express.Request, res: express.Response, _next: express.NextFunction) => {
|
|
const statusCode = err.statusCode ?? 500
|
|
const message = err.message ?? 'Internal server error'
|
|
const code = err.code ?? 'internal_error'
|
|
|
|
if (statusCode >= 500) {
|
|
console.error('[API Error]', err)
|
|
}
|
|
|
|
// Zod validation error
|
|
if (err.name === 'ZodError') {
|
|
return res.status(400).json({ error: 'validation_error', message: 'Invalid request body', issues: err.issues, statusCode: 400 })
|
|
}
|
|
|
|
// Prisma not found
|
|
if (err.code === 'P2025') {
|
|
return res.status(404).json({ error: 'not_found', message: 'Resource not found', statusCode: 404 })
|
|
}
|
|
|
|
// Prisma unique constraint
|
|
if (err.code === 'P2002') {
|
|
return res.status(409).json({ error: 'conflict', message: 'A resource with this value already exists', statusCode: 409 })
|
|
}
|
|
|
|
res.status(statusCode).json({ error: code, message, statusCode })
|
|
})
|
|
|
|
// ─── Scheduled jobs ───────────────────────────────────────────
|
|
|
|
// Daily: flag expiring/expired licenses
|
|
cron.schedule('0 8 * * *', async () => {
|
|
const customers = await prisma.customer.findMany({ where: { licenseExpiry: { not: null } } })
|
|
for (const c of customers) {
|
|
if (!c.licenseExpiry) continue
|
|
const daysLeft = Math.ceil((c.licenseExpiry.getTime() - Date.now()) / (1000 * 60 * 60 * 24))
|
|
const expired = c.licenseExpiry <= new Date()
|
|
const expiring = !expired && daysLeft < 90
|
|
if (expired !== c.licenseExpired || expiring !== c.licenseExpiringSoon) {
|
|
await prisma.customer.update({ where: { id: c.id }, data: { licenseExpired: expired, licenseExpiringSoon: expiring, licenseValidationStatus: expired ? 'EXPIRED' : expiring ? 'EXPIRING' : 'VALID' } })
|
|
}
|
|
}
|
|
})
|
|
|
|
// Daily: send trial-ending reminders (3 days before trial end)
|
|
cron.schedule('0 9 * * *', async () => {
|
|
const soon = new Date(Date.now() + 3 * 24 * 60 * 60 * 1000)
|
|
const subscriptions = await prisma.subscription.findMany({
|
|
where: { status: 'TRIALING', trialEndAt: { lte: soon, gte: new Date() } },
|
|
include: { company: { include: { employees: { where: { role: 'OWNER' } } } } },
|
|
})
|
|
for (const sub of subscriptions) {
|
|
const owner = sub.company.employees[0]
|
|
if (owner) {
|
|
await prisma.notification.create({
|
|
data: { type: 'SUBSCRIPTION_TRIAL_ENDING', title: 'Your trial ends soon', body: 'Your 14-day free trial ends in 3 days. Add a payment method to keep access.', companyId: sub.companyId, employeeId: owner.id, channel: 'IN_APP', status: 'DELIVERED' },
|
|
})
|
|
}
|
|
}
|
|
})
|
|
|
|
// Daily: notify companies about upcoming and overdue vehicle maintenance (date- and odometer-based).
|
|
// Repeats every day until the owner logs a new service entry that pushes the due date/mileage into the future.
|
|
cron.schedule('0 8 * * *', async () => {
|
|
const now = new Date()
|
|
const in30Days = new Date(now.getTime() + 30 * 24 * 60 * 60 * 1000)
|
|
const oneDayAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000)
|
|
|
|
// Fetch all candidate logs (date-due or has an odometer target), ordered newest-first per vehicle+type.
|
|
// We keep only the LATEST log per vehicle+type so that once the owner logs a new service the
|
|
// old overdue log is superseded and notifications stop automatically.
|
|
const allCandidates = await prisma.maintenanceLog.findMany({
|
|
where: {
|
|
OR: [
|
|
{ nextDueAt: { lte: in30Days } },
|
|
{ nextDueMileage: { not: null } },
|
|
],
|
|
},
|
|
include: { vehicle: { include: { company: { include: { employees: { where: { role: { in: ['OWNER', 'MANAGER'] }, isActive: true }, take: 1 } } } } } },
|
|
orderBy: { performedAt: 'desc' },
|
|
})
|
|
|
|
// Keep only the most-recent log per vehicle+type combination
|
|
const latestByKey = new Map<string, typeof allCandidates[number]>()
|
|
for (const log of allCandidates) {
|
|
const key = `${log.vehicleId}:${log.type}`
|
|
if (!latestByKey.has(key)) latestByKey.set(key, log)
|
|
}
|
|
|
|
for (const log of latestByKey.values()) {
|
|
const vehicle = log.vehicle
|
|
const company = vehicle.company
|
|
const recipient = company.employees[0]
|
|
if (!recipient) continue
|
|
|
|
// Determine date-based urgency
|
|
let isOverdueByDate = false
|
|
let daysLeft: number | null = null
|
|
let dueSoonByDate = false
|
|
if (log.nextDueAt) {
|
|
daysLeft = Math.ceil((log.nextDueAt.getTime() - now.getTime()) / (1000 * 60 * 60 * 24))
|
|
isOverdueByDate = log.nextDueAt <= now
|
|
dueSoonByDate = !isOverdueByDate && daysLeft <= 30
|
|
}
|
|
|
|
// Determine odometer-based urgency
|
|
let isOverdueByOdometer = false
|
|
let kmLeft: number | null = null
|
|
let dueSoonByOdometer = false
|
|
if (log.nextDueMileage != null && vehicle.mileage != null) {
|
|
kmLeft = log.nextDueMileage - vehicle.mileage
|
|
isOverdueByOdometer = kmLeft <= 0
|
|
dueSoonByOdometer = !isOverdueByOdometer && kmLeft <= 500
|
|
}
|
|
|
|
// Skip if the latest log is no longer due (owner has updated it)
|
|
const isOverdue = isOverdueByDate || isOverdueByOdometer
|
|
const isDueSoon = !isOverdue && (dueSoonByDate || dueSoonByOdometer)
|
|
if (!isOverdue && !isDueSoon) continue
|
|
|
|
// Dedup: don't send more than once per day for the same log
|
|
const alreadySent = await prisma.notification.findFirst({
|
|
where: {
|
|
type: 'VEHICLE_MAINTENANCE_DUE',
|
|
companyId: company.id,
|
|
createdAt: { gte: oneDayAgo },
|
|
data: { path: ['maintenanceLogId'], equals: log.id },
|
|
},
|
|
})
|
|
if (alreadySent) continue
|
|
|
|
// Build human-readable description
|
|
const dueParts: string[] = []
|
|
if (isOverdueByDate) dueParts.push(`overdue since ${log.nextDueAt!.toLocaleDateString()}`)
|
|
else if (dueSoonByDate && daysLeft != null) dueParts.push(`due in ${daysLeft} day${daysLeft === 1 ? '' : 's'}`)
|
|
if (isOverdueByOdometer) dueParts.push(`overdue by odometer (${Math.abs(kmLeft!).toLocaleString()} km ago)`)
|
|
else if (dueSoonByOdometer && kmLeft != null) dueParts.push(`${kmLeft.toLocaleString()} km remaining`)
|
|
|
|
const title = isOverdue
|
|
? `Overdue: ${log.type} — ${vehicle.make} ${vehicle.model}`
|
|
: `${log.type} due soon — ${vehicle.make} ${vehicle.model}`
|
|
const body = `${log.type} for ${vehicle.make} ${vehicle.model} (${vehicle.licensePlate}): ${dueParts.join('; ')}. Please log the service to dismiss this reminder.`
|
|
|
|
await prisma.notification.create({
|
|
data: {
|
|
type: 'VEHICLE_MAINTENANCE_DUE',
|
|
title,
|
|
body,
|
|
data: {
|
|
vehicleId: vehicle.id,
|
|
maintenanceLogId: log.id,
|
|
maintenanceType: log.type,
|
|
isOverdue,
|
|
daysLeft,
|
|
kmLeft,
|
|
isOverdueByDate,
|
|
isOverdueByOdometer,
|
|
},
|
|
companyId: company.id,
|
|
employeeId: recipient.id,
|
|
channel: 'IN_APP',
|
|
status: 'DELIVERED',
|
|
},
|
|
})
|
|
}
|
|
})
|
|
|
|
// ─── Start ────────────────────────────────────────────────────
|
|
const PORT = process.env.API_PORT ?? 4000
|
|
server.listen(PORT, () => {
|
|
console.log(`[API] Server running on port ${PORT}`)
|
|
})
|
|
|
|
export { app, io }
|