first commit

api/app/middleware/auth_middleware.ts

@@ -0,0 +1,20 @@
+import type { HttpContext } from '@adonisjs/core/http'
+import type { NextFn } from '@adonisjs/core/types/http'
+import type { Authenticators } from '@adonisjs/auth/types'
+
+/**
+ * Auth middleware is used authenticate HTTP requests and deny
+ * access to unauthenticated users.
+ */
+export default class AuthMiddleware {
+  async handle(
+    ctx: HttpContext,
+    next: NextFn,
+    options: {
+      guards?: (keyof Authenticators)[]
+    } = {}
+  ) {
+    await ctx.auth.authenticateUsing(options.guards)
+    return next()
+  }
+}

api/app/middleware/container_bindings_middleware.ts

@@ -0,0 +1,19 @@
+import { Logger } from '@adonisjs/core/logger'
+import { HttpContext } from '@adonisjs/core/http'
+import { type NextFn } from '@adonisjs/core/types/http'
+
+/**
+ * The container bindings middleware binds classes to their request
+ * specific value using the container resolver.
+ *
+ * - We bind "HttpContext" class to the "ctx" object
+ * - And bind "Logger" class to the "ctx.logger" object
+ */
+export default class ContainerBindingsMiddleware {
+  handle(ctx: HttpContext, next: NextFn) {
+    ctx.containerResolver.bindValue(HttpContext, ctx)
+    ctx.containerResolver.bindValue(Logger, ctx.logger)
+
+    return next()
+  }
+}

api/app/middleware/force_json_response_middleware.ts

@@ -0,0 +1,16 @@
+import type { HttpContext } from '@adonisjs/core/http'
+import type { NextFn } from '@adonisjs/core/types/http'
+
+/**
+ * The API always answers in JSON, including the errors raised before the
+ * route middleware (CSRF) and the EventSource requests: an unauthenticated
+ * stream gets a 401 instead of a redirect.
+ */
+export default class ForceJsonResponseMiddleware {
+  handle(ctx: HttpContext, next: NextFn) {
+    if (ctx.request.url().startsWith('/api/')) {
+      ctx.request.request.headers.accept = 'application/json'
+    }
+    return next()
+  }
+}

api/app/middleware/security_headers_middleware.ts

@@ -0,0 +1,39 @@
+import app from '@adonisjs/core/services/app'
+import type { HttpContext } from '@adonisjs/core/http'
+import type { NextFn } from '@adonisjs/core/types/http'
+
+/**
+ * Only same-origin resources. Angular puts the component styles in
+ * <style> tags, hence "unsafe-inline" for styles (not for scripts).
+ */
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self'",
+  "connect-src 'self'",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  "frame-ancestors 'none'",
+].join('; ')
+
+/**
+ * Sets the security headers on every response, including the static
+ * files served before the router (which shield does not cover).
+ */
+export default class SecurityHeadersMiddleware {
+  handle({ response }: HttpContext, next: NextFn) {
+    response.header('Content-Security-Policy', CONTENT_SECURITY_POLICY)
+    response.header('X-Frame-Options', 'DENY')
+    response.header('X-Content-Type-Options', 'nosniff')
+    response.header('Referrer-Policy', 'no-referrer')
+    response.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=()')
+    response.header('Cross-Origin-Opener-Policy', 'same-origin')
+    if (app.inProduction) {
+      response.header('Strict-Transport-Security', 'max-age=15552000')
+    }
+    return next()
+  }
+}