static

#!/usr/bin/env node

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

require('../lib/baseExceptions').addExceptionHandler();

const fs = require('fs');
const path = require('path');
const url = require('url');
const http = require('http');

const cachify = require('connect-cachify');
const connect_fonts = require('connect-fonts');
const connect_fonts_feurasans = require('connect-fonts-feurasans');
const connect_fonts_opensans = require('connect-fonts-opensans');
const express = require('express');
const hood = require('hood');
const i18n = require('i18n-abide');
const urlparse = require('urlparse');

const addP3PHeader = require('../lib/p3p.js');
const assets = require('../lib/static_resources').all;
const config = require('../lib/configuration.js');
const db = require('../lib/db.js');
const heartbeat = require('../lib/heartbeat.js');
const httputils = require('../lib/httputils.js');
const i18n_check = require('../lib/i18n_client_check');
const logger = require('../lib/logging/logging.js').getLogger('bid.bin.static');
const proxySecure = require('../lib/proxy-secure');
const shutdown = require('../lib/shutdown.js');
const statsd = require("../lib/logging/middleware/statsd");
const toobusy = require('../lib/busy_middleware.js');
const wsapi = require('../lib/wsapi.js');
const views = require('../lib/static/views.js');

var app = express.createServer();

logger.info("static starting up");

if (config.get('env') === 'production') {
  logger.info('node.js version: ' + process.version + ' at ' + process.execPath);
  logger.info('configuration: ', JSON.stringify(JSON.parse(config.toString())));
}

// Setup health check / heartbeat middleware.
// This is in front of logging on purpose.  see issue #537
heartbeat.setup(app);

// block requests when overloaded
app.use(toobusy);

// cover our head
app.use(proxySecure());
app.use(hood({
  csp: config.get('csp'),
  hsts: config.get('hsts'),
  xframe: config.get('x_frame_options')
}));

// logging!  all requests other than __heartbeat__ are logged
app.use(express.logger({
  format: config.get('express_log_format'),
  stream: {
    write: function(x) {
      logger.info(typeof x === 'string' ? x.trim() : x);
    }
  }
}));

// #2.1 - localization
app.use(i18n.abide({
  supported_languages: config.get('supported_languages'),
  default_lang: config.get('default_lang'),
  debug_lang: config.get('debug_lang'),
  translation_directory: config.get('translation_directory'),
  disable_locale_check: config.get('disable_locale_check')
}));

i18n_check();

app.use(statsd());

// Add P3P headers to please IE8
app.use(addP3PHeader);

var static_root = path.join(__dirname, "..", "resources", "static");

// #7 - perform response substitution to support local/dev/beta environments
// (specifically, this replaces URLs in responses, e.g. https://browserid.org
//  with https://diresworb.org)
config.performSubstitution(app);

var font_middleware = connect_fonts.setup({
  fonts: [ connect_fonts_opensans, connect_fonts_feurasans ],
  allow_origin: config.get('public_url'),
  ua: 'all'
});

app.use(cachify.setup(assets(config.get('supported_languages')),
        {
          prefix: config.get('cachify_prefix'),
          production: config.get('use_minified_resources'),
          root: static_root,
          url_to_paths: connect_fonts.urlToPaths
        }));

// #9 - handle views for dynamicish content
views.setup(app);

// add 'Access-Control-Allow-Origin' headers to static resources that will be served
// from the CDN.  We explicitly allow resources served from public_url to access these.
app.use(function(req, res, next) {
  res.on('header', function() {
    // this allows fonts to be requested cross domain
    res.setHeader("Access-Control-Allow-Origin", config.get('public_url'));
    // this makes sure caches properly consider language headers
    res.setHeader('Vary', 'Accept-Encoding,Accept-Language');
  });
  next();
});

app.use(font_middleware);

// catch urls that express can't handle (issue #2887)
app.use(function(req, res, next) {
  try {
    decodeURIComponent(req.url);
    next();
  } catch (e) {
    logger.info('invalid url requested: ' + req.url);
    httputils.notFound(res);
  }
});

app.use(express.static(static_root));

var bindTo = config.get('bind_to');
app.listen(bindTo.port, bindTo.host, function() {
  logger.info("running on http://" + app.address().address + ":" + app.address().port);
});

shutdown.handleTerminationSignals(app, toobusy.shutdown);