src/app.module.ts - main - goncharovchik/secure-api-d

src/app.module.ts
111 строк5 KB
Aleksey Goncharov
feat: secure API with 26 OWASP security measures
29 апр 2026, 13:30
29 апр 2026, 13:30449fe34
import { Module, MiddlewareConsumer, NestModule } from '@nestjs/common';
import { ConfigModule, ConfigService } from '@nestjs/config';
import { TypeOrmModule } from '@nestjs/typeorm';
import { ScheduleModule } from '@nestjs/schedule';
import { WinstonModule } from 'nest-winston';
import { APP_GUARD, APP_INTERCEPTOR, APP_FILTER, APP_PIPE } from '@nestjs/core';
import { PostgresConnectionOptions } from 'typeorm/driver/postgres/PostgresConnectionOptions';

import appConfig from './config/app.config';
import databaseConfig from './config/database.config';
import jwtConfig from './config/jwt.config';
import redisConfig from './config/redis.config';
import securityConfig from './config/security.config';
import { winstonConfig } from './logger/winston.config';

import { UsersModule } from './modules/users/users.module';
import { AuthModule } from './modules/auth/auth.module';
import { BotsModule } from './modules/bots/bots.module';
import { ServersModule } from './modules/servers/servers.module';
import { SecurityModule } from './modules/security/security.module';
import { AuditModule } from './modules/audit/audit.module';

import { JwtAuthGuard } from './common/guards/jwt-auth.guard';
import { RolesGuard } from './common/guards/roles.guard';
import { RateLimiterGuard } from './modules/security/rate-limiter/rate-limiter.guard';
import { AuditLogInterceptor } from './common/interceptors/audit-log.interceptor';
import { TimeoutInterceptor } from './common/interceptors/timeout.interceptor';
import { SanitizeInterceptor } from './common/interceptors/sanitize.interceptor';
import { PaginationInterceptor } from './common/interceptors/pagination.interceptor';
import { AllExceptionsFilter } from './common/filters/all-exceptions.filter';
import { ThrottleExceptionFilter } from './common/filters/throttle-exception.filter';
import { globalValidationPipe } from './common/pipes/validation.pipe';
import { RequestIdMiddleware } from './common/middleware/request-id.middleware';
import { JsonDepthMiddleware } from './common/middleware/json-depth.middleware';
import { FingerprintMiddleware } from './common/middleware/fingerprint.middleware';
import { MemoryWatchdogService } from './common/services/memory-watchdog.service';

/**
 * Корневой модуль (SECURE).
 * Интегрирует все защитные механизмы, модули логирования и аудита.
 */
@Module({
  imports: [
    ConfigModule.forRoot({
      isGlobal: true,
      load: [appConfig, databaseConfig, jwtConfig, redisConfig, securityConfig],
    }),

    WinstonModule.forRoot(winstonConfig),
    ScheduleModule.forRoot(),

    TypeOrmModule.forRootAsync({
      imports: [ConfigModule],
      inject: [ConfigService],
      useFactory: (config: ConfigService) => {
        const options: PostgresConnectionOptions & { autoLoadEntities: boolean; poolSize: number; extra: any } = {
          type: 'postgres',
          host: config.get<string>('database.host'),
          port: config.get<number>('database.port'),
          username: config.get<string>('database.username'),
          password: config.get<string>('database.password'),
          database: config.get<string>('database.database')!,
          autoLoadEntities: true,
          // Мера #12: Безопасность БД
          synchronize: process.env.NODE_ENV !== 'production', // В проде используются миграции
          poolSize: 10, // Ограничение пула соединений
          extra: {
            statement_timeout: 30000, // Отмена зависших запросов (30 сек)
            query_timeout: 30000,
          },
        };
        return options;
      },
    }),

    UsersModule,
    AuthModule,
    BotsModule,
    ServersModule,
    SecurityModule,
    AuditModule,
  ],
  providers: [
    MemoryWatchdogService,
    // Глобальные Guards (порядок важен)
    { provide: APP_GUARD, useClass: RateLimiterGuard }, // Мера #16
    { provide: APP_GUARD, useClass: JwtAuthGuard },     // Мера #1
    { provide: APP_GUARD, useClass: RolesGuard },       // Мера #6

    // Глобальные Interceptors
    { provide: APP_INTERCEPTOR, useClass: TimeoutInterceptor },  // Мера #19
    { provide: APP_INTERCEPTOR, useClass: AuditLogInterceptor }, // Мера #22
    { provide: APP_INTERCEPTOR, useClass: SanitizeInterceptor }, // Мера #10
    { provide: APP_INTERCEPTOR, useClass: PaginationInterceptor }, // Мера #18

    // Глобальные Filters
    { provide: APP_FILTER, useClass: AllExceptionsFilter }, // Мера #23
    { provide: APP_FILTER, useClass: ThrottleExceptionFilter },

    // Глобальный Validation Pipe
    { provide: APP_PIPE, useValue: globalValidationPipe }, // Мера #9
  ],
})
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    // Применяем глобальные middlewares
    consumer
      .apply(RequestIdMiddleware, FingerprintMiddleware, JsonDepthMiddleware)
      .forRoutes('*');
  }
}