Ludo API Node.js — Production Backend with Express, JWT & Docker

import express from 'express';
import http from 'http';
import { Server } from 'socket.io';
import cors from 'cors';
import helmet from 'helmet';
import rateLimit from 'express-rate-limit';
import pinoHttp from 'pino-http';
import { errorHandler } from './middleware/errorHandler';
import { authenticate } from './middleware/auth';
import { validateRequest } from './middleware/validateRequest';
import { redis } from './lib/redis';
import logger from './lib/logger';
import authRouter from './routes/auth';
import roomsRouter from './routes/rooms';
import gamesRouter from './routes/games';

const app = express();
const server = http.createServer(app);

// Trust proxies first — required for correct IP behind load balancer
app.set('trust proxy', 1);

// Security headers (HSTS, CSP, X-Frame-Options, etc.)
app.use(helmet({
  contentSecurityPolicy: false // Disable if serving HTML
}));

// CORS — restrict to your frontend origin in production
app.use(cors({
  origin: process.env.CLIENT_URL || 'http://localhost:3000',
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization', 'X-API-Key', 'Idempotency-Key', 'X-Request-ID']
}));

// Body parsing — limit prevents large payload DoS
app.use(express.json({ limit: '10kb' }));
app.use(express.urlencoded({ extended: true, limit: '10kb' }));

// Structured request/response logging
app.use(pinoHttp({ logger }));

// Global rate limiter — 100 requests / 15 minutes per IP
app.use(rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  standardHeaders: true,
  legacyHeaders: false,
  keyGenerator: (req) => req.headers['x-forwarded-for'] as string || req.ip,
  handler: (req, res) => {
    res.status(429).json({
      success: false,
      error: { code: 'RATE_LIMIT_EXCEEDED', status: 429, message: 'Too many requests' }
    });
  }
}));

// Strict route-specific rate limiters
const moveLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 30,
  keyGenerator: (req) => req.user?.id || req.ip
});

// Routes
app.use('/health', (req, res) => res.json({ status: 'ok', uptime: process.uptime() }));
app.use('/api/auth', authRouter);
app.use('/api/rooms', authenticate, roomsRouter);
app.use('/api/games', authenticate, gamesRouter);

// 404 handler
app.use((req, res) => {
  res.status(404).json({
    success: false,
    error: { code: 'NOT_FOUND', status: 404, message: 'Endpoint not found' }
  });
});

// Global error handler — MUST have 4 parameters (err, req, res, next)
app.use(errorHandler);

const PORT = process.env.PORT || 3001;
server.listen(PORT, () => {
  logger.info({ port: PORT }, 'Ludo API server started');
});

export { app, server };

// src/middleware/auth.ts
import { Request, Response, NextFunction } from 'express';
import jwt from 'jsonwebtoken';
import { redis } from '../lib/redis';
import logger from '../lib/logger';

export interface PlayerPayload {
  sub: string;        // playerId
  name: string;
  rank: string;
  role: 'player' | 'admin';
  iat: number;
  exp: number;
}

declare module 'express' {
  interface Request {
    user?: PlayerPayload;
  }
}

const JWT_SECRET = process.env.JWT_SECRET!;

export const authenticate = (req: Request, res: Response, next: NextFunction) => {
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) {
    return res.status(401).json({
      success: false,
      error: { code: 'UNAUTHORIZED', status: 401, message: 'Missing or malformed Authorization header' }
    });
  }

  const token = authHeader.split(' ')[1];
  try {
    req.user = jwt.verify(token, JWT_SECRET) as PlayerPayload;
    next();
  } catch (err) {
    if (err instanceof jwt.TokenExpiredError) {
      return res.status(401).json({
        success: false,
        error: { code: 'TOKEN_EXPIRED', status: 401, message: 'Access token expired. Use refresh token to get a new one.' }
      });
    }
    return res.status(401).json({
      success: false,
      error: { code: 'INVALID_TOKEN', status: 401, message: 'Invalid access token' }
    });
  }
};

export const requireRole = (role: PlayerPayload['role']) => {
  return (req: Request, res: Response, next: NextFunction) => {
    if (!req.user || req.user.role !== role) {
      return res.status(403).json({
        success: false,
        error: { code: 'FORBIDDEN', status: 403, message: 'Insufficient permissions for this action' }
      });
    }
    next();
  };
};

// src/services/authService.ts
export const generateTokens = async (player: { id: string; name: string; rank: string; role: 'player' | 'admin' }) => {
  const ACCESS_TOKEN_TTL = '1h';
  const REFRESH_TOKEN_TTL = 7 * 24 * 60 * 60; // 7 days in seconds

  const accessToken = jwt.sign(
    { sub: player.id, name: player.name, rank: player.rank, role: player.role },
    JWT_SECRET,
    { expiresIn: ACCESS_TOKEN_TTL, issuer: 'ludokingapi.site' }
  );

  const refreshToken = require('uuid').v4();
  await redis.setEx(`refresh:{player.id}:{refreshToken}`, REFRESH_TOKEN_TTL, JSON.stringify({
    playerId: player.id, issuedAt: Date.now()
  }));

  logger.info({ playerId: player.id }, 'Tokens issued');
  return { accessToken, refreshToken, expiresIn: 3600 };
};

export const refreshAccessToken = async (playerId: string, refreshToken: string) => {
  const stored = await redis.get(`refresh:{playerId}:{refreshToken}`);
  if (!stored) {
    throw new Error('Invalid or expired refresh token');
  }

  const playerData = JSON.parse(stored);
  const player = await db.getPlayer(playerData.playerId);
  if (!player) throw new Error('Player not found');

  return generateTokens(player);
};

export const revokeRefreshTokens = async (playerId: string) => {
  const keys = await redis.keys(`refresh:{playerId}:*`);
  if (keys.length > 0) await redis.del(keys);
  logger.info({ playerId, revokedCount: keys.length }, 'All refresh tokens revoked');
};