new secure measures

package.json

@@ -14,9 +14,13 @@
     "apollo-server": "^2.9.12",
     "apollo-server-express": "^2.9.12",
     "bcryptjs": "^2.4.3",
+    "compression": "^1.7.4",
+    "cors": "^2.8.5",
     "env-cmd": "^10.0.1",
     "express": "^4.17.1",
+    "express-rate-limit": "^5.0.0",
     "graphql": "^14.5.8",
+    "helmet": "^3.21.2",
     "jsonwebtoken": "^8.5.1",
     "path": "^0.12.7",
     "prisma-client-lib": "^1.34.10"

resolvers/mutation.resolver.js

@@ -7,6 +7,8 @@ const Mutation = {
   createUser: async (parent, { data }, { prisma }, info) => {
     const emailTaken = await prisma.$exists.user({ email: data.email });
     if (emailTaken) throw new Error("Email taken.");
+    if (data.name.length < 3 || data.password.length < 3)
+      throw new Error("credentials must have at least 3 char");
     const hash = await hashPassword(data.password);
     const user = await prisma.createUser({ ...data, password: hash });
     return {

src/apollo-sever.js

@@ -1,8 +1,41 @@
-const { ApolloServer } = require("apollo-server");
+const { ApolloServer } = require("apollo-server-express");
+const express = require("express");
+const cors = require("cors");
+const helmet = require("helmet");
+const compression = require("compression");
+const rateLimit = require("express-rate-limit");
 const { resolvers } = require("../resolvers/index.resolver");
 const { prisma } = require("../prisma/generated/prisma-client/index");
 const { schema } = require("./squema");
 
+const limiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100 // limit each IP to 100 requests per windowMs
+});
+
+const csp = helmet.contentSecurityPolicy({
+  directives: {
+    defaultSrc: ["'self'"],
+    styleSrc: ["'seft'"]
+  }
+});
+
+const whitelist = ["https://jeancarlos-cpu.github.io/blog"];
+
+const corsOptions = {
+  origin: (origin, callback) =>
+    whitelist.indexOf(origin) !== -1
+      ? callback(null, true)
+      : callback(new Error("Cross-origin resource sharing not allowed!"))
+};
+
+const app = express();
+app.use(helmet());
+app.use(csp);
+app.use(cors(corsOptions));
+app.use(limiter);
+app.use(compression());
+
 const server = new ApolloServer({
   typeDefs: schema,
   resolvers,
@@ -12,9 +45,12 @@ const server = new ApolloServer({
   })
 });
 
-server
-  .listen({ port: process.env.PORT || 4000 })
-  .then(console.log("its working!"));
+server.applyMiddleware({ app });
+app.listen(4000, () => console.log("server up."));
+
+// server
+//   .listen({ port: process.env.PORT || 4000 })
+//   .then(console.log("its working!"));
 
 // const app = express();
 // // app.use("/text", (res, req) => {
@@ -28,7 +64,5 @@ server
 //   console.log(err);
 //   res.download("src/files/enade.pdf", "enade.pdf");
 //   });
-  
+
 // })
-// server.applyMiddleware({ app });
-// app.listen(4000, () => console.log("server up."));