chore: initial commit for main

apps/api/Dockerfile

@@ -0,0 +1,47 @@
+FROM node:20-alpine AS base
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
+WORKDIR /app
+
+# --- Dependencies ---
+FROM base AS deps
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
+COPY apps/api/package.json apps/api/
+COPY packages/database/package.json packages/database/
+COPY packages/shared/package.json packages/shared/
+COPY packages/ui/package.json packages/ui/
+RUN pnpm install --frozen-lockfile --prod=false
+
+# --- Build ---
+FROM base AS build
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=deps /app/apps/api/node_modules ./apps/api/node_modules
+COPY --from=deps /app/packages/database/node_modules ./packages/database/node_modules
+COPY --from=deps /app/packages/shared/node_modules ./packages/shared/node_modules
+COPY . .
+RUN pnpm --filter @source/shared build && \
+    pnpm --filter @source/database build && \
+    pnpm --filter @source/api build
+
+# --- Production ---
+FROM node:20-alpine AS production
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
+WORKDIR /app
+
+ENV NODE_ENV=production
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=build /app/apps/api/dist ./apps/api/dist
+COPY --from=build /app/apps/api/package.json ./apps/api/
+COPY --from=build /app/packages/database/dist ./packages/database/dist
+COPY --from=build /app/packages/database/package.json ./packages/database/
+COPY --from=build /app/packages/shared/dist ./packages/shared/dist
+COPY --from=build /app/packages/shared/package.json ./packages/shared/
+COPY --from=deps /app/packages/database/node_modules ./packages/database/node_modules
+COPY --from=deps /app/packages/shared/node_modules ./packages/shared/node_modules
+COPY --from=deps /app/apps/api/node_modules ./apps/api/node_modules
+COPY pnpm-workspace.yaml package.json ./
+
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s CMD wget -qO- http://localhost:3000/api/health || exit 1
+
+CMD ["node", "apps/api/dist/index.js"]

apps/api/package.json

@@ -12,7 +12,9 @@
   "dependencies": {
     "@fastify/cookie": "^11.0.0",
     "@fastify/cors": "^10.0.0",
+    "@fastify/helmet": "^13.0.2",
     "@fastify/jwt": "^9.0.0",
+    "@fastify/rate-limit": "^10.3.0",
     "@fastify/websocket": "^11.0.0",
     "@sinclair/typebox": "^0.34.0",
     "@source/database": "workspace:*",

apps/api/src/index.ts

@@ -1,6 +1,8 @@
 import Fastify from 'fastify';
 import cors from '@fastify/cors';
 import cookie from '@fastify/cookie';
+import helmet from '@fastify/helmet';
+import rateLimit from '@fastify/rate-limit';
 import dbPlugin from './plugins/db.js';
 import authPlugin from './plugins/auth.js';
 import authRoutes from './routes/auth/index.js';
@@ -19,12 +21,21 @@ const app = Fastify({
   },
 });
 
-// Plugins
+// Security plugins
+await app.register(helmet, {
+  contentSecurityPolicy: process.env.NODE_ENV === 'production' ? undefined : false,
+});
+
 await app.register(cors, {
   origin: process.env.CORS_ORIGIN || 'http://localhost:5173',
   credentials: true,
 });
 
+await app.register(rateLimit, {
+  max: Number(process.env.RATE_LIMIT_MAX) || 100,
+  timeWindow: Number(process.env.RATE_LIMIT_WINDOW_MS) || 60_000,
+});
+
 await app.register(cookie);
 await app.register(dbPlugin);
 await app.register(authPlugin);
@@ -47,10 +58,20 @@ app.setErrorHandler((error: Error & { validation?: unknown; statusCode?: number;
     });
   }
 
+  // Rate limit errors
+  if (error.statusCode === 429) {
+    return reply.code(429).send({
+      error: 'Too Many Requests',
+      message: 'Rate limit exceeded, please try again later',
+    });
+  }
+
   app.log.error(error);
-  return reply.code(500).send({
+  return reply.code(error.statusCode ?? 500).send({
     error: 'Internal Server Error',
-    message: 'An unexpected error occurred',
+    message: process.env.NODE_ENV === 'production'
+      ? 'An unexpected error occurred'
+      : error.message,
   });
 });