Middleware in Express

const path = require('node:path');
const express = require('express');
const app = express();

// --- Built-in middleware ---
app.use(express.json({ limit: '100kb' }));        // JSON bodies, with a size cap
app.use(express.urlencoded({ extended: true })); // HTML form posts

// Anchor the folder to THIS file — 'public' alone resolves against cwd
app.use(express.static(path.join(__dirname, 'public')));

// --- Custom Middleware: Request Logger ---
function logger(req, res, next) {
  const start = Date.now();
  res.on('finish', () => {
    const duration = Date.now() - start;
    console.log(`${req.method} ${req.url} ${res.statusCode} - ${duration}ms`);
  });
  next();
}
app.use(logger);

// --- Custom Middleware: Auth Check ---
function requireAuth(req, res, next) {
  const token = req.headers.authorization;
  if (!token) {
    return res.status(401).json({ error: 'No token provided' });
  }
  // Verify token here...
  next();
}

// Apply to specific routes only
app.get('/api/profile', requireAuth, (req, res) => {
  res.json({ user: 'Alice' });
});

const express = require('express');
const app = express();

app.use(express.json());

// Route that might throw an error
app.get('/api/users/:id', (req, res, next) => {
  try {
    const id = parseInt(req.params.id);
    if (isNaN(id)) {
      const error = new Error('Invalid user ID');
      error.statusCode = 400;
      throw error;
    }
    res.json({ id, name: 'Alice' });
  } catch (err) {
    next(err); // Pass error to error handler
  }
});

// 404 handler — must be after all routes
app.use((req, res, next) => {
  res.status(404).json({ error: 'Route not found' });
});

// Error handling middleware — Express recognises it by the FOUR arguments.
// Do not remove `next` even though it is unused; the count is the signal.
app.use((err, req, res, next) => {
  console.error(err.stack);              // full detail stays on the server

  const status = err.statusCode || 500;
  res.status(status).json({
    // Only messages you set deliberately are safe to show a client
    error: status < 500 ? err.message : 'Internal Server Error'
  });
});

app.listen(process.env.PORT || 3000);

// npm install morgan cors helmet

const express = require('express');
const morgan = require('morgan');   // HTTP request logger
const cors = require('cors');       // Cross-Origin Resource Sharing
const helmet = require('helmet');   // Security headers

const app = express();

// Security headers first — they should apply to everything below
app.use(helmet());

// Configure CORS ONCE. app.use(cors()) with no options allows every origin:
// acceptable for a public read-only API, wrong for anything with credentials.
app.use(cors({
  origin: process.env.CORS_ORIGIN || 'http://localhost:5173',
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  credentials: true
}));

app.use(morgan('dev'));         // GET /api/users 200 5ms
app.use(express.json({ limit: '100kb' }));

// Behind a proxy, this is what makes req.ip the real client address
// app.set('trust proxy', 1);

app.get('/api/data', (req, res) => {
  res.json({ message: 'Secured and logged!' });
});

app.listen(3000);

const cors = require('cors');

// Development: allow the frontend dev server you actually use
app.use(cors({ origin: 'http://localhost:5173' }));

// Production: read it from the environment, and be specific
app.use(cors({
  origin: process.env.CORS_ORIGIN,   // e.g. https://myapp.example
  credentials: true                  // only if you send cookies
}));

// This combination is INVALID and browsers reject it outright:
// app.use(cors({ origin: '*', credentials: true }));

// Register CORS BEFORE your routes, or the preflight OPTIONS request
// falls through to your 404 handler and the browser blocks the real one.
app.use('/api', apiRoutes);

// What the browser is actually reading, on the response:
//   Access-Control-Allow-Origin:  https://myapp.example
//   Access-Control-Allow-Headers: Content-Type, Authorization
//   Access-Control-Allow-Methods: GET, POST, PUT, DELETE

// And what CORS does NOT stop — this works regardless of any origin setting:
//   curl https://myapp.example/api/admin/users

// app.js — an ordering that holds up as the project grows
const path = require('node:path');
const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const morgan = require('morgan');

const app = express();

// 1. Security headers — cheap, and should cover everything below
app.use(helmet());

// 2. CORS — must answer preflight OPTIONS before any route sees it
app.use(cors({ origin: process.env.CORS_ORIGIN }));

// 3. Logging — above the parsers, so oversized bodies still get logged
app.use(morgan('dev'));

// 4. Body parsers — a route cannot read a body nobody parsed
app.use(express.json({ limit: '100kb' }));
app.use(express.urlencoded({ extended: true }));

// 5. Static files — keep this folder well away from your API paths
app.use(express.static(path.join(__dirname, '..', 'public')));

// 6. Your routes
app.use('/api/books', bookRoutes);
app.use('/api/auth', authRoutes);

// 7. Nothing matched
app.use((req, res) => res.status(404).json({ error: 'Not found' }));

// 8. Something failed — four arguments, and always last
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(err.statusCode || 500).json({ error: 'Internal Server Error' });
});

module.exports = app;

// NEVER do this — module scope is shared by every request in flight
// let currentUser = null;
// app.use((req, res, next) => { currentUser = req.user; next(); });