Method setupMiddleware

server/src/http.ts:578–821

()

  }

  private setupMiddleware(): void {
    // Trust the first proxy (Fly.io) for accurate client IP detection
    // Required for express-rate-limit and other middleware that use req.ip
    this.app.set('trust proxy', 1);

    // Serve JSON schemas (aliases + static files + discovery) before body-parsing,
    // cookie, and CSRF middleware so these high-traffic reads stay cheap.
    const distPath = process.env.NODE_ENV === 'production'
      ? __dirname
      : path.join(__dirname, "../../dist");
    mountSchemasRoutes(this.app, path.join(distPath, 'schemas'));
    mountComplianceRoutes(this.app, path.join(distPath, 'compliance'));
    mountProtocolRoutes(this.app, path.join(distPath, 'protocol'));

    // Track slow API responses and alert ops
    this.app.use(slowResponseTracker);

    // Capture request duration metrics for all API calls
    this.app.use(requestMetrics);

    // Use JSON parser for all routes EXCEPT those that need raw body for signature verification
    // Limit increased to 10MB to support base64-encoded logo uploads in member profiles
    this.app.use((req, res, next) => {
      // Skip global JSON parser for routes that need raw body capture:
      // - Stripe webhooks: need raw body for webhook signature verification
      // - Resend inbound webhooks: need raw body for Svix signature verification
      // - WorkOS webhooks: need raw body for WorkOS signature verification
      // - Zoom webhooks: need raw body for HMAC signature verification
      // - Slack routes: need raw body for Slack signature verification
      //   (both JSON for events and URL-encoded for commands)
      if (req.path === '/api/webhooks/stripe' ||
          req.path === '/api/webhooks/resend-inbound' ||
          req.path === '/api/webhooks/resend-tracking' ||
          req.path === '/api/webhooks/workos' ||
          req.path === '/api/webhooks/zoom' ||
          req.path.startsWith('/api/slack/')) {
        next();
      } else {
        // `verify` captures raw body bytes before JSON parses them — required
        // for RFC 9421 request-signature verification on the training-agent
        // `/mcp` endpoint, which rehashes the exact bytes the signer signed.
        // Cheap (one utf-8 decode per request) and unused elsewhere.
        express.json({
          limit: '10mb',
          verify: (req, _res, buf) => {
            (req as unknown as { rawBody?: string }).rawBody = buf.toString('utf8');
          },
        })(req, res, next);
      }
    });
    this.app.use(cookieParser());
    this.app.use(csrfProtection);

    // Serve brand.json for both AAO domains.
    // AdCP domain redirects to the AAO house. AAO domain redirects to the DB-managed hosted brand.
    this.app.get('/.well-known/brand.json', (req, res) => {
      res.setHeader('Cache-Control', 'public, max-age=3600');
      if (this.isAdcpDomain(req)) {