| 6 | import { graphqlUploadExpress } from 'graphql-upload-minimal'; |
| 7 | import { json } from 'express'; |
| 8 | import { PreviewService } from './project/preview.service'; |
| 9 | import { mountPreviewProxy } from './project/preview-proxy'; |
| 10 | |
| 11 | async function bootstrap() { |
| 12 | const logger = new Logger('Bootstrap'); |
| 13 | dotenv.config(); |
| 14 | |
| 15 | const app = await NestFactory.create(AppModule, { rawBody: true }); |
| 16 | |
| 17 | app.enableCors({ |
| 18 | // Reflected rather than `*`, and credentialed: the preview handshake sets |
| 19 | // a cookie that the preview iframe — served from this origin — has to send |
| 20 | // back. A wildcard origin makes the browser drop credentialed responses, |
| 21 | // so the cookie was never stored and every deployed preview answered 404. |
| 22 | origin: true, |
| 23 | credentials: true, |
| 24 | methods: ['GET', 'POST', 'OPTIONS'], |
| 25 | allowedHeaders: [ |
| 26 | 'Content-Type', |
| 27 | 'Accept', |
| 28 | 'Authorization', |
| 29 | 'Access-Control-Allow-Origin', |
| 30 | 'Access-Control-Allow-Credentials', |
| 31 | 'Apollo-Require-Preflight', |
| 32 | 'x-refresh-token', |
| 33 | ], |
| 34 | }); |
| 35 | |
| 36 | app.use( |
| 37 | '/graphql', |
| 38 | graphqlUploadExpress({ maxFileSize: 50000000, maxFiles: 10 }), |
| 39 | ); |
| 40 | |
| 41 | // Pasted screenshots reach /api/chat as base64 in the JSON body, which blows |
| 42 | // straight past Express's 100kb default. Bounded by ArrayMaxSize(4) on the DTO. |
| 43 | app.use(json({ limit: '25mb' })); |
| 44 | |
| 45 | // Necessarily *before* Nest's router: Nest answers an unmatched path with |
| 46 | // its own 404 rather than calling next(), so a proxy mounted after it never |
| 47 | // runs. Being first means it must decline this server's own routes itself — |
| 48 | // see OURS in preview-proxy. |
| 49 | mountPreviewProxy( |
| 50 | app.getHttpAdapter().getInstance(), |
| 51 | app.get(PreviewService), |
| 52 | ); |
| 53 | |
| 54 | console.log('process.env.PORT:', process.env.PORT); |
| 55 | // The old `await server.close()` after `app.close()` was a no-op: Nest's |
| 56 | // close already shuts the http server down, and `http.Server.close()` |
| 57 | // returns the server rather than a promise. |