Function createApp

api/src/app.ts:95–433

()

const require = createRequire(import.meta.url);

export default async function createApp(): Promise<express.Application> {
	const env = useEnv();
	const logger = useLogger();
	const helmet = await import('helmet');

	await validateDatabaseConnection();

	if ((await isInstalled()) === false) {
		logger.error(`Database doesn't have Directus tables installed.`);
		process.exit(1);
	}

	if ((await validateMigrations()) === false) {
		logger.warn(`Database migrations have not all been run`);
	}

	if (!env['SECRET']) {
		logger.warn(
			`"SECRET" env variable is missing. Using a random value instead. Tokens will not persist between restarts. This is not appropriate for production usage.`,
		);
	}

	if (typeof env['SECRET'] === 'string' && Buffer.byteLength(env['SECRET']) < 32) {
		logger.warn(
			'"SECRET" env variable is shorter than 32 bytes which is insecure. This is not appropriate for production usage.',
		);
	}

	if (!new Url(env['PUBLIC_URL'] as string).isAbsolute()) {
		logger.warn('"PUBLIC_URL" should be a full URL');
	}

	if (env['MCP_OAUTH_ENABLED'] === true) {
		if (toBoolean(env['MCP_ENABLED']) !== true) {
			logger.warn('MCP_OAUTH_ENABLED requires MCP_ENABLED=true. OAuth disabled.');
			env['MCP_OAUTH_ENABLED'] = false;
		}
	}

	await validateDatabaseExtensions();
	await validateStorage();

	await getLicenseManager().initialize();
	getEntitlementManager().initialize();

	await registerAuthProviders();
	registerDeploymentDrivers();
	await ensureDeploymentWebhooks();

	const extensionManager = getExtensionManager();
	const flowManager = getFlowManager();

	await extensionManager.initialize();
	await flowManager.initialize();

	const app = express();

	app.disable('x-powered-by');