8729344991

Committed 17 Apr 2024 10:13PM UTC coverage: 32.074% (-0.006%) from 32.08%

Build # 8729344991

Build Type

push

github

Committed by

jimrandomh

Commit Message

Redirect ?commentId=... to #commentId

Run Details

4685 of 37966 branches covered (12.34%)

Branch coverage included in aggregate %.

2 of 16 new or added lines in 1 file covered. (12.5%)

1 existing line in 1 file now uncovered.

27172 of 61356 relevant lines covered (44.29%)

182.05 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

17.31

/packages/lesswrong/server/apolloServer.ts

import { ApolloServer } from 'apollo-server-express';
import { GraphQLError, GraphQLFormattedError } from 'graphql';

import { isDevelopment, getInstanceSettings, getServerPort, isProduction } from '../lib/executionEnvironment';
import { renderWithCache, getThemeOptionsFromReq } from './vulcan-lib/apollo-ssr/renderPage';

import { pickerMiddleware, addStaticRoute } from './vulcan-lib/staticRoutes';
import voyagerMiddleware from 'graphql-voyager/middleware/express';
import { graphiqlMiddleware } from './vulcan-lib/apollo-server/graphiql';
import getPlaygroundConfig from './vulcan-lib/apollo-server/playground';

import { getExecutableSchema } from './vulcan-lib/apollo-server/initGraphQL';
import { getUserFromReq, configureSentryScope, getContextFromReqAndRes } from './vulcan-lib/apollo-server/context';

import universalCookiesMiddleware from 'universal-cookie-express';

import { formatError } from 'apollo-errors';

import * as Sentry from '@sentry/node';
import express from 'express'
import { app } from './expressServer';
import path from 'path'
import { getPublicSettingsLoaded } from '../lib/settingsCache';
import { embedAsGlobalVar } from './vulcan-lib/apollo-ssr/renderUtil';
import { addStripeMiddleware } from './stripeMiddleware';
import { addAuthMiddlewares, expressSessionSecretSetting } from './authenticationMiddlewares';
import { addForumSpecificMiddleware } from './forumSpecificMiddleware';
import { addSentryMiddlewares, logGraphqlQueryStarted, logGraphqlQueryFinished } from './logging';
import { addClientIdMiddleware } from './clientIdMiddleware';
import { classesForAbTestGroups } from '../lib/abTestImpl';
import expressSession from 'express-session';
import MongoStore from './vendor/ConnectMongo/MongoStore';
import { ckEditorTokenHandler } from './ckEditor/ckEditorToken';
import { getEAGApplicationData } from './zohoUtils';
import { faviconUrlSetting, isEAForum, testServerSetting, performanceMetricLoggingEnabled, isDatadogEnabled } from '../lib/instanceSettings';
import { parseRoute, parsePath } from '../lib/vulcan-core/appContext';
import { globalExternalStylesheets } from '../themes/globalStyles/externalStyles';
import { addCypressRoutes } from './testingSqlClient';
import { addCrosspostRoutes } from './fmCrosspost/routes';
import { getUserEmail } from "../lib/collections/users/helpers";
import { inspect } from "util";
import { renderJssSheetPreloads } from './utils/renderJssSheetImports';
import { datadogMiddleware } from './datadog/datadogMiddleware';
import { Sessions } from '../lib/collections/sessions';
import { addServerSentEventsEndpoint } from "./serverSentEvents";
import { botRedirectMiddleware } from './botRedirect';
import { hstsMiddleware } from './hsts';
import { getClientBundle } from './utils/bundleUtils';
import { isElasticEnabled } from './search/elastic/elasticSettings';
import ElasticController from './search/elastic/ElasticController';
import type { ApolloServerPlugin, GraphQLRequestContext, GraphQLRequestListener } from 'apollo-server-plugin-base';
import { asyncLocalStorage, closePerfMetric, openPerfMetric, perfMetricMiddleware, setAsyncStoreValue } from './perfMetrics';
import { addAdminRoutesMiddleware } from './adminRoutesMiddleware'
import { createAnonymousContext } from './vulcan-lib/query';
import { getSiteUrl } from '../lib/vulcan-lib/utils';

/**
 * Try to set the response status, but log an error if the headers have already been sent.
 */
const trySetResponseStatus = ({ response, status }: { response: express.Response, status: number; }) => {
  if (!response.headersSent) {
    response.status(status);
  } else if (response.statusCode !== status) {
    const message = `Tried to set status to ${status} but headers have already been sent with status ${response.statusCode}. This may be due to enableResourcePrefetch wrongly being set to true.`;
    if (isProduction) {
      // eslint-disable-next-line no-console
      console.error(message);
    } else {
      throw new Error(message);
    }
  }

  return response;
}

/**
 * If allowed, write the prefetchPrefix to the response so the client can start downloading resources
 */
const maybePrefetchResources = async ({
  request,
  response,
  enableResourcePrefetch,
  prefetchPrefix
}: {
  request: express.Request;
  response: express.Response;
  enableResourcePrefetch?: boolean | ((req: express.Request, res: express.Response, context: ResolverContext) => Promise<boolean>);
  prefetchPrefix: string;
}) => {
  const prefetchResources =
    typeof enableResourcePrefetch === "function"
      ? await enableResourcePrefetch(request, response, createAnonymousContext())
      : enableResourcePrefetch;

  if (prefetchResources) {
    response.setHeader("X-Accel-Buffering", "no"); // force nginx to send start of response immediately
    trySetResponseStatus({ response, status: 200 });
    response.write(prefetchPrefix);
  }
  return prefetchResources;
};

class ApolloServerLogging implements ApolloServerPlugin<ResolverContext> {
  requestDidStart({ request, context }: GraphQLRequestContext<ResolverContext>): GraphQLRequestListener<ResolverContext> {
    const { operationName = 'unknownGqlOperation', query, variables } = request;

    //remove sensitive data from variables such as password
    let filteredVariables = variables;
    if (variables) {
      filteredVariables =  Object.keys(variables).reduce((acc, key) => {
        return (key === 'password') ?  acc : { ...acc, [key]: variables[key] };
      }, {});
    }

    let startedRequestMetric: IncompletePerfMetric;
    if (performanceMetricLoggingEnabled.get()) {
      startedRequestMetric = openPerfMetric({
        op_type: 'query',
        op_name: operationName,
        parent_trace_id: context.perfMetric?.trace_id,
        extra_data: filteredVariables,
        gql_string: query
      });  
    }

    if (query) {
      logGraphqlQueryStarted(operationName, query, variables);
    }
    
    return {
      willSendResponse() { // hook for transaction finished
        if (performanceMetricLoggingEnabled.get()) {
          closePerfMetric(startedRequestMetric);
        }

        if (query) {
          logGraphqlQueryFinished(operationName, query);
        }
      }
    };
  }
}

export type AddMiddlewareType = typeof app.use;

export function startWebserver() {
  const addMiddleware: AddMiddlewareType = (...args: any[]) => app.use(...args);
  const config = { path: '/graphql' };
  const expressSessionSecret = expressSessionSecretSetting.get()

  app.use(universalCookiesMiddleware());

  // Required for passport-auth0, and for login redirects
  if (expressSessionSecret) {
    // express-session middleware, with MongoStore providing it a collection
    // to store stuff in. This adds a `req.session` field to requests, with
    // fancy accessors/setters. The only thing we actually use this for, however,
    // is redirects that happen on return from an OAuth login. So we can scope
    // this to only routes that start with /auth without loss of functionality.
    // We do this because if we don't it adds a webserver-to-database roundtrip
    // (or sometimes three) to each request.
    const store = new MongoStore({
      collection: Sessions,
    });
    app.use('/auth', expressSession({
      secret: expressSessionSecret,
      resave: false,
      saveUninitialized: false,
      store,
      cookie: {
        // NB: Although the Set-Cookie HTTP header takes seconds,
        // express-session wants milliseconds for some reason
        maxAge: 1000 * 60 * 60 * 24 * 365 * 10
      }
    }))
  }

  app.use(express.urlencoded({ extended: true })); // We send passwords + username via urlencoded form parameters
  app.use('/analyticsEvent', express.json({ limit: '50mb' }));
  app.use('/ckeditor-webhook', express.json({ limit: '50mb' }));

  if (isElasticEnabled) {
    // We register this here (before the auth middleware) to avoid blocking
    // search requests whilst waiting to fetch the current user from Postgres,
    // which is never actually used.
    ElasticController.addRoutes(app);
  }

  addStripeMiddleware(addMiddleware);
  // Most middleware need to run after those added by addAuthMiddlewares, so that they can access the user that passport puts on the request.  Be careful if moving it!
  addAuthMiddlewares(addMiddleware);
  addAdminRoutesMiddleware(addMiddleware);
  addForumSpecificMiddleware(addMiddleware);
  addSentryMiddlewares(addMiddleware);
  addClientIdMiddleware(addMiddleware);
  if (isDatadogEnabled) {
    app.use(datadogMiddleware);
  }
  app.use(pickerMiddleware);
  app.use(botRedirectMiddleware);
  app.use(hstsMiddleware);
  
  // create server
  // given options contains the schema
  const apolloServer = new ApolloServer({
    // graphql playground (replacement to graphiql), available on the app path
    playground: getPlaygroundConfig(config.path),
    introspection: true,
    debug: isDevelopment,
    
    schema: getExecutableSchema(),
    formatError: (e: GraphQLError): GraphQLFormattedError => {
      Sentry.captureException(e);
      const {message, ...properties} = e;
      // eslint-disable-next-line no-console
      console.error(`[GraphQLError: ${message}]`, inspect(properties, {depth: null}));
      // TODO: Replace sketchy apollo-errors package with something first-party
      // and that doesn't require a cast here
      return formatError(e) as any;
    },
    //tracing: isDevelopment,
    tracing: false,
    cacheControl: true,
    context: async ({ req, res }: { req: express.Request, res: express.Response }) => {
      const context = await getContextFromReqAndRes(req, res);
      configureSentryScope(context);
      setAsyncStoreValue('resolverContext', context);
      return context;
    },
    plugins: [new ApolloServerLogging()],
  });

  app.use('/graphql', express.json({ limit: '50mb' }));
  app.use('/graphql', express.text({ type: 'application/graphql' }));
  app.use('/graphql', perfMetricMiddleware);
  apolloServer.applyMiddleware({ app })

  addStaticRoute("/js/bundle.js", ({query}, req, res, context) => {
    const {bundleHash, bundleBuffer, bundleBrotliBuffer} = getClientBundle();
    let headers: Record<string,string> = {}
    const acceptBrotli = req.headers['accept-encoding'] && req.headers['accept-encoding'].includes('br')

    if ((query.hash && query.hash !== bundleHash) || (acceptBrotli && bundleBrotliBuffer === null)) {
      // If the query specifies a hash, but it's wrong, this probably means there's a
      // version upgrade in progress, and the SSR and the bundle were handled by servers
      // on different versions. Serve whatever bundle we have (there's really not much
      // else to do), but set the Cache-Control header differently so that it will be
      // fixed on the next refresh.
      //
      // If the client accepts brotli compression but we don't have a valid brotli compressed bundle,
      // that either means we are running locally (in which case chache control isn't important), or that
      // the brotli bundle is currently being built (in which case set a short cache TTL to prevent the CDN
      // from serving the uncompressed bundle for too long).
      headers = {
        "Cache-Control": "public, max-age=60",
        "Content-Type": "text/javascript; charset=utf-8"
      }
    } else {
      headers = {
        "Cache-Control": "public, max-age=604800, immutable",
        "Content-Type": "text/javascript; charset=utf-8"
      }
    }

    if (bundleBrotliBuffer !== null && acceptBrotli) {
      headers["Content-Encoding"] = "br";
      res.writeHead(200, headers);
      res.end(bundleBrotliBuffer);
    } else {
      res.writeHead(200, headers);
      res.end(bundleBuffer);
    }
  });
  // Setup CKEditor Token
  app.use("/ckeditor-token", ckEditorTokenHandler)
  
  // Static files folder
  app.use(express.static(path.join(__dirname, '../../client')))
  app.use(express.static(path.join(__dirname, '../../../public'), {
    setHeaders: (res, requestPath) => {
      const relativePath = path.relative(__dirname, requestPath);
      if (relativePath.startsWith("../../../public/reactionImages")) {
        res.set("Cache-Control", "public, max-age=604800, immutable");
      }
    }
  }))
  
  // Voyager is a GraphQL schema visual explorer
  app.use("/graphql-voyager", voyagerMiddleware({
    endpointUrl: config.path,
  }));
  // Setup GraphiQL
  app.use("/graphiql", graphiqlMiddleware({
    endpointURL: config.path,
    passHeader: "'Authorization': localStorage['Meteor.loginToken']", // eslint-disable-line quotes
  }));
  
  app.get('/api/eag-application-data', async function(req, res, next) {
    if (!isEAForum) {
      next()
      return
    }
    
    const currentUser = await getUserFromReq(req)
    if (!currentUser) {
      res.status(403).send("Not logged in")
      return
    }

    const userEmail = getUserEmail(currentUser)
    if (!userEmail) {
      res.status(403).send("User does not have email")
      return
    }
    
    const eagApp = await getEAGApplicationData(userEmail)
  })

  addCrosspostRoutes(app);
  addCypressRoutes(app);

  if (testServerSetting.get()) {
    app.post('/api/quit', (_req, res) => {
      res.status(202).send('Quiting server');
      process.kill(estrellaPid, 'SIGQUIT');
    })
  }

  addServerSentEventsEndpoint(app);

  app.get('/node_modules/*', (req, res) => {
    // Under some circumstances (I'm not sure exactly what the trigger is), the
    // Chrome JS debugger tries to load a bunch of /node_modules/... paths
    // (presumably for some sort of source mapping). If these were treated as
    // normal pageloads, this would produce a ton of console-log spam, which is
    // disruptive. So instead just serve a minimal 404.
    res.status(404);
    res.end("");
  });

  app.get('*', async (request, response) => {
    if(await prefilterHandleRequest(request, response)) {
      return;
    }
    
    response.setHeader("Content-Type", "text/html; charset=utf-8"); // allows compression

    const {bundleHash} = getClientBundle();
    const clientScript = `<script defer src="/js/bundle.js?hash=${bundleHash}"></script>`
    const instanceSettingsHeader = embedAsGlobalVar("publicInstanceSettings", getInstanceSettings().public);

    // Check whether the requested route has enableResourcePrefetch. If it does,
    // we send HTTP status and headers early, before we actually rendered the
    // page, so that the browser can get started on loading the stylesheet and
    // JS bundle while SSR is still in progress.
    const parsedRoute = parseRoute({
      location: parsePath(request.url)
    });
    
    const user = await getUserFromReq(request);
    const themeOptions = getThemeOptionsFromReq(request, user);
    const jssStylePreload = renderJssSheetPreloads(themeOptions);
    const externalStylesPreload = globalExternalStylesheets.map(url =>
      `<link rel="stylesheet" type="text/css" href="${url}">`
    ).join("");
    
    const faviconHeader = `<link rel="shortcut icon" href="${faviconUrlSetting.get()}"/>`;
    
    // The part of the header which can be sent before the page is rendered.
    // This includes an open tag for <html> and <head> but not the matching
    // close tags, since there's stuff inside that depends on what actually
    // gets rendered. The browser will pick up any references in the still-open
    // tag and start fetching the, without waiting for the closing tag.
    const prefetchPrefix = (
      '<!doctype html>\n'
      + '<html lang="en">\n'
      + '<head>\n'
        + jssStylePreload
        + externalStylesPreload
        + instanceSettingsHeader
        + faviconHeader
        + clientScript
    );

    // Note: this may write to the response
    const prefetchResourcesPromise = maybePrefetchResources({
      request,
      response,
      enableResourcePrefetch: parsedRoute.currentRoute?.enableResourcePrefetch,
      prefetchPrefix
    });

    const renderResultPromise = performanceMetricLoggingEnabled.get()
      ? asyncLocalStorage.run({}, () => renderWithCache(request, response, user))
      : renderWithCache(request, response, user);

    const [prefetchingResources, renderResult] = await Promise.all([prefetchResourcesPromise, renderResultPromise]);

    if (renderResult.aborted) {
      trySetResponseStatus({ response, status: 499 });
      response.end();
      return;
    }

    const {
      ssrBody,
      headers,
      serializedApolloState,
      serializedForeignApolloState,
      jssSheets,
      status,
      redirectUrl,
      renderedAt,
      allAbTestGroups,
    } = renderResult;

    if (!getPublicSettingsLoaded()) throw Error('Failed to render page because publicSettings have not yet been initialized on the server')
    
    // TODO: Move this up into prefetchPrefix. Take the <link> that loads the stylesheet out of renderRequest and move that up too.
    const themeOptionsHeader = embedAsGlobalVar("themeOptions", themeOptions);
    
    // Finally send generated HTML with initial data to the client
    if (redirectUrl) {
      // eslint-disable-next-line no-console
      console.log(`Redirecting to ${redirectUrl}`);
      trySetResponseStatus({ response, status: status || 301 }).redirect(redirectUrl);
    } else {
      trySetResponseStatus({ response, status: status || 200 });

      response.write(
        (prefetchingResources ? '' : prefetchPrefix)
          + headers.join('\n')
          + themeOptionsHeader
          + jssSheets
        + '</head>\n'
        + '<body class="'+classesForAbTestGroups(allAbTestGroups)+'">\n'
          + ssrBody + '\n'
        + '</body>\n'
        + embedAsGlobalVar("ssrRenderedAt", renderedAt) + '\n'
        + serializedApolloState + '\n'
        + serializedForeignApolloState + '\n'
        + '</html>\n')
      response.end();
    }
  })

  // Start Server
  const port = getServerPort();
  const env = process.env.NODE_ENV || 'production'
  const server = app.listen({ port }, () => {
    // eslint-disable-next-line no-console
    return console.info(`Server running on http://localhost:${port} [${env}]`)
  })
  server.keepAliveTimeout = 120000;
  
  // Route used for checking whether the server is ready for an auto-refresh
  // trigger. Added last so that async stuff can't lead to auto-refresh
  // happening before the server is ready.
  addStaticRoute('/api/ready', ({query}, _req, res, next) => {
    res.end('true');
  });
}

async function prefilterHandleRequest(req: express.Request, res: express.Response): Promise<boolean> {
  const url = req.url;
  const baseUrl = getSiteUrl();
  const parsedUrl = new URL(url, baseUrl);
  
  // If the URL is of the form ...?commentId=id, serve a redirect to ...#commentId
  const commentId = parsedUrl.searchParams.get('commentId');
  if (commentId) {
    // Side-effectfully transform parsedUrl
    parsedUrl.searchParams.delete("commentId");
    parsedUrl.hash = commentId;

    res.status(301);
    res.redirect(parsedUrl.toString());
    res.end();
    return true;
  }
  
  return false;
}

1	import { ApolloServer } from 'apollo-server-express';	54✔
2	import { GraphQLError, GraphQLFormattedError } from 'graphql';
3
4	import { isDevelopment, getInstanceSettings, getServerPort, isProduction } from '../lib/executionEnvironment';	18✔
5	import { renderWithCache, getThemeOptionsFromReq } from './vulcan-lib/apollo-ssr/renderPage';	18✔
6
7	import { pickerMiddleware, addStaticRoute } from './vulcan-lib/staticRoutes';	18✔
8	import voyagerMiddleware from 'graphql-voyager/middleware/express';	18✔
9	import { graphiqlMiddleware } from './vulcan-lib/apollo-server/graphiql';	18✔
10	import getPlaygroundConfig from './vulcan-lib/apollo-server/playground';	18✔
11
12	import { getExecutableSchema } from './vulcan-lib/apollo-server/initGraphQL';	18✔
13	import { getUserFromReq, configureSentryScope, getContextFromReqAndRes } from './vulcan-lib/apollo-server/context';	18✔
14
15	import universalCookiesMiddleware from 'universal-cookie-express';	18✔
16
17	import { formatError } from 'apollo-errors';	18✔
18
19	import * as Sentry from '@sentry/node';	18✔
20	import express from 'express'	18✔
21	import { app } from './expressServer';	18✔
22	import path from 'path'	18✔
23	import { getPublicSettingsLoaded } from '../lib/settingsCache';	18✔
24	import { embedAsGlobalVar } from './vulcan-lib/apollo-ssr/renderUtil';	18✔
25	import { addStripeMiddleware } from './stripeMiddleware';	18✔
26	import { addAuthMiddlewares, expressSessionSecretSetting } from './authenticationMiddlewares';	18✔
27	import { addForumSpecificMiddleware } from './forumSpecificMiddleware';	18✔
28	import { addSentryMiddlewares, logGraphqlQueryStarted, logGraphqlQueryFinished } from './logging';	18✔
29	import { addClientIdMiddleware } from './clientIdMiddleware';	18✔
30	import { classesForAbTestGroups } from '../lib/abTestImpl';	18✔
31	import expressSession from 'express-session';	18✔
32	import MongoStore from './vendor/ConnectMongo/MongoStore';	18✔
33	import { ckEditorTokenHandler } from './ckEditor/ckEditorToken';	18✔
34	import { getEAGApplicationData } from './zohoUtils';	18✔
35	import { faviconUrlSetting, isEAForum, testServerSetting, performanceMetricLoggingEnabled, isDatadogEnabled } from '../lib/instanceSettings';	18✔
36	import { parseRoute, parsePath } from '../lib/vulcan-core/appContext';	18✔
37	import { globalExternalStylesheets } from '../themes/globalStyles/externalStyles';	18✔
38	import { addCypressRoutes } from './testingSqlClient';	18✔
39	import { addCrosspostRoutes } from './fmCrosspost/routes';	18✔
40	import { getUserEmail } from "../lib/collections/users/helpers";	18✔
41	import { inspect } from "util";	18✔
42	import { renderJssSheetPreloads } from './utils/renderJssSheetImports';	18✔
43	import { datadogMiddleware } from './datadog/datadogMiddleware';	18✔
44	import { Sessions } from '../lib/collections/sessions';	18✔
45	import { addServerSentEventsEndpoint } from "./serverSentEvents";	18✔
46	import { botRedirectMiddleware } from './botRedirect';	18✔
47	import { hstsMiddleware } from './hsts';	18✔
48	import { getClientBundle } from './utils/bundleUtils';	18✔
49	import { isElasticEnabled } from './search/elastic/elasticSettings';	18✔
50	import ElasticController from './search/elastic/ElasticController';	18✔
51	import type { ApolloServerPlugin, GraphQLRequestContext, GraphQLRequestListener } from 'apollo-server-plugin-base';
52	import { asyncLocalStorage, closePerfMetric, openPerfMetric, perfMetricMiddleware, setAsyncStoreValue } from './perfMetrics';	18✔
53	import { addAdminRoutesMiddleware } from './adminRoutesMiddleware'	18✔
54	import { createAnonymousContext } from './vulcan-lib/query';	18✔
55	import { getSiteUrl } from '../lib/vulcan-lib/utils';	18✔
56
57	/**
58	* Try to set the response status, but log an error if the headers have already been sent.
59	*/
60	const trySetResponseStatus = ({ response, status }: { response: express.Response, status: number; }) => {	18✔
61	if (!response.headersSent) {	×
62	response.status(status);	×
63	} else if (response.statusCode !== status) {	×
64	const message = `Tried to set status to ${status} but headers have already been sent with status ${response.statusCode}. This may be due to enableResourcePrefetch wrongly being set to true.`;	×
65	if (isProduction) {	×
66	// eslint-disable-next-line no-console
67	console.error(message);	×
68	} else {
69	throw new Error(message);	×
70	}
71	}
72
73	return response;	×
74	}
75
76	/**
77	* If allowed, write the prefetchPrefix to the response so the client can start downloading resources
78	*/
79	const maybePrefetchResources = async ({	18✔
80	request,
81	response,
82	enableResourcePrefetch,
83	prefetchPrefix
84	}: {
85	request: express.Request;
86	response: express.Response;
87	enableResourcePrefetch?: boolean \| ((req: express.Request, res: express.Response, context: ResolverContext) => Promise<boolean>);
88	prefetchPrefix: string;
89	}) => {
90	const prefetchResources =
91	typeof enableResourcePrefetch === "function"	×
92	? await enableResourcePrefetch(request, response, createAnonymousContext())	×
93	: enableResourcePrefetch;
94
95	if (prefetchResources) {	×
96	response.setHeader("X-Accel-Buffering", "no"); // force nginx to send start of response immediately	×
97	trySetResponseStatus({ response, status: 200 });	×
98	response.write(prefetchPrefix);	×
99	}
100	return prefetchResources;	×
101	};
102
103	class ApolloServerLogging implements ApolloServerPlugin<ResolverContext> {
104	requestDidStart({ request, context }: GraphQLRequestContext<ResolverContext>): GraphQLRequestListener<ResolverContext> {
105	const { operationName = 'unknownGqlOperation', query, variables } = request;	×
106
107	//remove sensitive data from variables such as password
108	let filteredVariables = variables;	×
109	if (variables) {	×
110	filteredVariables = Object.keys(variables).reduce((acc, key) => {	×
111	return (key === 'password') ? acc : { ...acc, [key]: variables[key] };	×
112	}, {});
113	}
114
115	let startedRequestMetric: IncompletePerfMetric;
116	if (performanceMetricLoggingEnabled.get()) {	×
117	startedRequestMetric = openPerfMetric({	×
118	op_type: 'query',
119	op_name: operationName,
120	parent_trace_id: context.perfMetric?.trace_id,	×
121	extra_data: filteredVariables,
122	gql_string: query
123	});
124	}
125
126	if (query) {	×
127	logGraphqlQueryStarted(operationName, query, variables);	×
128	}
129
130	return {	×
131	willSendResponse() { // hook for transaction finished
132	if (performanceMetricLoggingEnabled.get()) {	×
133	closePerfMetric(startedRequestMetric);	×
134	}
135
136	if (query) {	×
137	logGraphqlQueryFinished(operationName, query);	×
138	}
139	}
140	};
141	}
142	}
143
144	export type AddMiddlewareType = typeof app.use;
145
146	export function startWebserver() {
147	const addMiddleware: AddMiddlewareType = (...args: any[]) => app.use(...args);	×
148	const config = { path: '/graphql' };	×
149	const expressSessionSecret = expressSessionSecretSetting.get()	×
150
151	app.use(universalCookiesMiddleware());	×
152
153	// Required for passport-auth0, and for login redirects
154	if (expressSessionSecret) {	×
155	// express-session middleware, with MongoStore providing it a collection
156	// to store stuff in. This adds a `req.session` field to requests, with
157	// fancy accessors/setters. The only thing we actually use this for, however,
158	// is redirects that happen on return from an OAuth login. So we can scope
159	// this to only routes that start with /auth without loss of functionality.
160	// We do this because if we don't it adds a webserver-to-database roundtrip
161	// (or sometimes three) to each request.
162	const store = new MongoStore({	×
163	collection: Sessions,
164	});
165	app.use('/auth', expressSession({	×
166	secret: expressSessionSecret,
167	resave: false,
168	saveUninitialized: false,
169	store,
170	cookie: {
171	// NB: Although the Set-Cookie HTTP header takes seconds,
172	// express-session wants milliseconds for some reason
173	maxAge: 1000 * 60 * 60 * 24 * 365 * 10
174	}
175	}))
176	}
177
178	app.use(express.urlencoded({ extended: true })); // We send passwords + username via urlencoded form parameters	×
179	app.use('/analyticsEvent', express.json({ limit: '50mb' }));	×
180	app.use('/ckeditor-webhook', express.json({ limit: '50mb' }));	×
181
182	if (isElasticEnabled) {	×
183	// We register this here (before the auth middleware) to avoid blocking
184	// search requests whilst waiting to fetch the current user from Postgres,
185	// which is never actually used.
186	ElasticController.addRoutes(app);	×
187	}
188
189	addStripeMiddleware(addMiddleware);	×
190	// Most middleware need to run after those added by addAuthMiddlewares, so that they can access the user that passport puts on the request. Be careful if moving it!
191	addAuthMiddlewares(addMiddleware);	×
192	addAdminRoutesMiddleware(addMiddleware);	×
193	addForumSpecificMiddleware(addMiddleware);	×
194	addSentryMiddlewares(addMiddleware);	×
195	addClientIdMiddleware(addMiddleware);	×
196	if (isDatadogEnabled) {	×
197	app.use(datadogMiddleware);	×
198	}
199	app.use(pickerMiddleware);	×
200	app.use(botRedirectMiddleware);	×
201	app.use(hstsMiddleware);	×
202
203	// create server
204	// given options contains the schema
205	const apolloServer = new ApolloServer({	×
206	// graphql playground (replacement to graphiql), available on the app path
207	playground: getPlaygroundConfig(config.path),
208	introspection: true,
209	debug: isDevelopment,
210
211	schema: getExecutableSchema(),
212	formatError: (e: GraphQLError): GraphQLFormattedError => {
213	Sentry.captureException(e);	×
214	const {message, ...properties} = e;	×
215	// eslint-disable-next-line no-console
216	console.error(`[GraphQLError: ${message}]`, inspect(properties, {depth: null}));	×
217	// TODO: Replace sketchy apollo-errors package with something first-party
218	// and that doesn't require a cast here
219	return formatError(e) as any;	×
220	},
221	//tracing: isDevelopment,
222	tracing: false,
223	cacheControl: true,
224	context: async ({ req, res }: { req: express.Request, res: express.Response }) => {
225	const context = await getContextFromReqAndRes(req, res);	×
226	configureSentryScope(context);	×
227	setAsyncStoreValue('resolverContext', context);	×
228	return context;	×
229	},
230	plugins: [new ApolloServerLogging()],
231	});
232
233	app.use('/graphql', express.json({ limit: '50mb' }));	×
234	app.use('/graphql', express.text({ type: 'application/graphql' }));	×
235	app.use('/graphql', perfMetricMiddleware);	×
236	apolloServer.applyMiddleware({ app })	×
237
238	addStaticRoute("/js/bundle.js", ({query}, req, res, context) => {	×
239	const {bundleHash, bundleBuffer, bundleBrotliBuffer} = getClientBundle();	×
240	let headers: Record<string,string> = {}	×
241	const acceptBrotli = req.headers['accept-encoding'] && req.headers['accept-encoding'].includes('br')	×
242
243	if ((query.hash && query.hash !== bundleHash) \|\| (acceptBrotli && bundleBrotliBuffer === null)) {	×
244	// If the query specifies a hash, but it's wrong, this probably means there's a
245	// version upgrade in progress, and the SSR and the bundle were handled by servers
246	// on different versions. Serve whatever bundle we have (there's really not much
247	// else to do), but set the Cache-Control header differently so that it will be
248	// fixed on the next refresh.
249	//
250	// If the client accepts brotli compression but we don't have a valid brotli compressed bundle,
251	// that either means we are running locally (in which case chache control isn't important), or that
252	// the brotli bundle is currently being built (in which case set a short cache TTL to prevent the CDN
253	// from serving the uncompressed bundle for too long).
254	headers = {	×
255	"Cache-Control": "public, max-age=60",
256	"Content-Type": "text/javascript; charset=utf-8"
257	}
258	} else {
259	headers = {	×
260	"Cache-Control": "public, max-age=604800, immutable",
261	"Content-Type": "text/javascript; charset=utf-8"
262	}
263	}
264
265	if (bundleBrotliBuffer !== null && acceptBrotli) {	×
266	headers["Content-Encoding"] = "br";	×
267	res.writeHead(200, headers);	×
268	res.end(bundleBrotliBuffer);	×
269	} else {
270	res.writeHead(200, headers);	×
271	res.end(bundleBuffer);	×
272	}
273	});
274	// Setup CKEditor Token
275	app.use("/ckeditor-token", ckEditorTokenHandler)	×
276
277	// Static files folder
278	app.use(express.static(path.join(__dirname, '../../client')))	×
279	app.use(express.static(path.join(__dirname, '../../../public'), {	×
280	setHeaders: (res, requestPath) => {
281	const relativePath = path.relative(__dirname, requestPath);	×
282	if (relativePath.startsWith("../../../public/reactionImages")) {	×
283	res.set("Cache-Control", "public, max-age=604800, immutable");	×
284	}
285	}
286	}))
287
288	// Voyager is a GraphQL schema visual explorer
289	app.use("/graphql-voyager", voyagerMiddleware({	×
290	endpointUrl: config.path,
291	}));
292	// Setup GraphiQL
293	app.use("/graphiql", graphiqlMiddleware({	×
294	endpointURL: config.path,
295	passHeader: "'Authorization': localStorage['Meteor.loginToken']", // eslint-disable-line quotes
296	}));
297
298	app.get('/api/eag-application-data', async function(req, res, next) {	×
299	if (!isEAForum) {	×
300	next()	×
301	return	×
302	}
303
304	const currentUser = await getUserFromReq(req)	×
305	if (!currentUser) {	×
306	res.status(403).send("Not logged in")	×
307	return	×
308	}
309
310	const userEmail = getUserEmail(currentUser)	×
311	if (!userEmail) {	×
312	res.status(403).send("User does not have email")	×
313	return	×
314	}
315
316	const eagApp = await getEAGApplicationData(userEmail)	×
317	})
318
319	addCrosspostRoutes(app);	×
320	addCypressRoutes(app);	×
321
322	if (testServerSetting.get()) {	×
323	app.post('/api/quit', (_req, res) => {	×
324	res.status(202).send('Quiting server');	×
325	process.kill(estrellaPid, 'SIGQUIT');	×
326	})
327	}
328
329	addServerSentEventsEndpoint(app);	×
330
331	app.get('/node_modules/*', (req, res) => {	×
332	// Under some circumstances (I'm not sure exactly what the trigger is), the
333	// Chrome JS debugger tries to load a bunch of /node_modules/... paths
334	// (presumably for some sort of source mapping). If these were treated as
335	// normal pageloads, this would produce a ton of console-log spam, which is
336	// disruptive. So instead just serve a minimal 404.
337	res.status(404);	×
338	res.end("");	×
339	});
340
341	app.get('*', async (request, response) => {	×
NEW 342	if(await prefilterHandleRequest(request, response)) {	×
NEW 343	return;	×
344	}
345
UNCOV 346	response.setHeader("Content-Type", "text/html; charset=utf-8"); // allows compression	×
347
348	const {bundleHash} = getClientBundle();	×
349	const clientScript = `<script defer src="/js/bundle.js?hash=${bundleHash}"></script>`	×
350	const instanceSettingsHeader = embedAsGlobalVar("publicInstanceSettings", getInstanceSettings().public);	×
351
352	// Check whether the requested route has enableResourcePrefetch. If it does,
353	// we send HTTP status and headers early, before we actually rendered the
354	// page, so that the browser can get started on loading the stylesheet and
355	// JS bundle while SSR is still in progress.
356	const parsedRoute = parseRoute({	×
357	location: parsePath(request.url)
358	});
359
360	const user = await getUserFromReq(request);	×
361	const themeOptions = getThemeOptionsFromReq(request, user);	×
362	const jssStylePreload = renderJssSheetPreloads(themeOptions);	×
363	const externalStylesPreload = globalExternalStylesheets.map(url =>	×
364	`<link rel="stylesheet" type="text/css" href="${url}">`	×
365	).join("");
366
367	const faviconHeader = `<link rel="shortcut icon" href="${faviconUrlSetting.get()}"/>`;	×
368
369	// The part of the header which can be sent before the page is rendered.
370	// This includes an open tag for <html> and <head> but not the matching
371	// close tags, since there's stuff inside that depends on what actually
372	// gets rendered. The browser will pick up any references in the still-open
373	// tag and start fetching the, without waiting for the closing tag.
374	const prefetchPrefix = (
375	'<!doctype html>\n'	×
376	+ '<html lang="en">\n'
377	+ '<head>\n'
378	+ jssStylePreload
379	+ externalStylesPreload
380	+ instanceSettingsHeader
381	+ faviconHeader
382	+ clientScript
383	);
384
385	// Note: this may write to the response
386	const prefetchResourcesPromise = maybePrefetchResources({	×
387	request,
388	response,
389	enableResourcePrefetch: parsedRoute.currentRoute?.enableResourcePrefetch,	×
390	prefetchPrefix
391	});
392
393	const renderResultPromise = performanceMetricLoggingEnabled.get()	×
394	? asyncLocalStorage.run({}, () => renderWithCache(request, response, user))	×
395	: renderWithCache(request, response, user);
396
397	const [prefetchingResources, renderResult] = await Promise.all([prefetchResourcesPromise, renderResultPromise]);	×
398
399	if (renderResult.aborted) {	×
400	trySetResponseStatus({ response, status: 499 });	×
401	response.end();	×
402	return;	×
403	}
404
405	const {
406	ssrBody,
407	headers,
408	serializedApolloState,
409	serializedForeignApolloState,
410	jssSheets,
411	status,
412	redirectUrl,
413	renderedAt,
414	allAbTestGroups,
415	} = renderResult;	×
416
417	if (!getPublicSettingsLoaded()) throw Error('Failed to render page because publicSettings have not yet been initialized on the server')	×
418
419	// TODO: Move this up into prefetchPrefix. Take the <link> that loads the stylesheet out of renderRequest and move that up too.
420	const themeOptionsHeader = embedAsGlobalVar("themeOptions", themeOptions);	×
421
422	// Finally send generated HTML with initial data to the client
423	if (redirectUrl) {	×
424	// eslint-disable-next-line no-console
425	console.log(`Redirecting to ${redirectUrl}`);	×
426	trySetResponseStatus({ response, status: status \|\| 301 }).redirect(redirectUrl);	×
427	} else {
428	trySetResponseStatus({ response, status: status \|\| 200 });	×
429
430	response.write(	×
431	(prefetchingResources ? '' : prefetchPrefix)	×
432	+ headers.join('\n')
433	+ themeOptionsHeader
434	+ jssSheets
435	+ '</head>\n'
436	+ '<body class="'+classesForAbTestGroups(allAbTestGroups)+'">\n'
437	+ ssrBody + '\n'
438	+ '</body>\n'
439	+ embedAsGlobalVar("ssrRenderedAt", renderedAt) + '\n'
440	+ serializedApolloState + '\n'
441	+ serializedForeignApolloState + '\n'
442	+ '</html>\n')
443	response.end();	×
444	}
445	})
446
447	// Start Server
448	const port = getServerPort();	×
449	const env = process.env.NODE_ENV \|\| 'production'	×
450	const server = app.listen({ port }, () => {	×
451	// eslint-disable-next-line no-console
452	return console.info(`Server running on http://localhost:${port} [${env}]`)	×
453	})
454	server.keepAliveTimeout = 120000;	×
455
456	// Route used for checking whether the server is ready for an auto-refresh
457	// trigger. Added last so that async stuff can't lead to auto-refresh
458	// happening before the server is ready.
459	addStaticRoute('/api/ready', ({query}, _req, res, next) => {	×
460	res.end('true');	×
461	});
462	}
463
464	async function prefilterHandleRequest(req: express.Request, res: express.Response): Promise<boolean> {
NEW 465	const url = req.url;	×
NEW 466	const baseUrl = getSiteUrl();	×
NEW 467	const parsedUrl = new URL(url, baseUrl);	×
468
469	// If the URL is of the form ...?commentId=id, serve a redirect to ...#commentId
NEW 470	const commentId = parsedUrl.searchParams.get('commentId');	×
NEW 471	if (commentId) {	×
472	// Side-effectfully transform parsedUrl
NEW 473	parsedUrl.searchParams.delete("commentId");	×
NEW 474	parsedUrl.hash = commentId;	×
475
NEW 476	res.status(301);	×
NEW 477	res.redirect(parsedUrl.toString());	×
NEW 478	res.end();	×
NEW 479	return true;	×
480	}
481
NEW 482	return false;	×
483	}

ForumMagnum / ForumMagnum / 8729344991

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous