Files
Void-Homelab/server.js
root 1208b3bd40 fix(api): drop err.message from 500 response body (CWE-209)
Catch-all error handlers in lib/api/errors.js and server.js were
echoing raw err.message to clients. Replace with a fixed generic
message; the full error continues to be logged server-side via pino.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-31 20:45:08 +10:00

40 lines
1.0 KiB
JavaScript

import 'dotenv/config';
import express from 'express';
import { pool } from './lib/db/pool.js';
import { log } from './lib/log.js';
import { mountApi } from './lib/api/index.js';
const VERSION = '2.0.0-alpha.1';
export function createApp() {
const app = express();
app.use(express.json({ limit: '10mb' }));
app.get('/health', async (_req, res) => {
let db_ok = false;
try {
await pool.query('SELECT 1');
db_ok = true;
} catch (e) {
log.error({ err: e }, 'healthcheck db ping failed');
}
res.json({ ok: true, db_ok, version: VERSION });
});
mountApi(app);
app.use((_req, res) => res.status(404).json({ error: { code: 'not_found' } }));
app.use((err, _req, res, _next) => {
log.error({ err }, 'unhandled');
res.status(500).json({ error: { code: 'internal', message: 'internal server error' } });
});
return app;
}
if (import.meta.url === `file://${process.argv[1]}`) {
const port = process.env.PORT || 3000;
createApp().listen(port, () => log.info({ port }, 'void-server listening'));
}