Migrate backend to ESM #959

ajhollid · 2024-10-15T04:01:45Z

This PR migrates the project to use ESM. This is the offical standard of JavaScript and will afford us better compatability. It will also allow us to eventually do things like tree shaking and static analysis which we can use for optimization.

Migrate BE to use ESM
- Update all imports and exports
- Resolve minor errors
Migrate tests
- Find solution for mocking sslchecker
  - Rewrote fetchMonitorCertificate to skip using sslchecker

Server/routes/checkRoute.js

+const router = Router();
+
+router.get("/:monitorId", getChecks);
+router.post("/:monitorId", verifyOwnership(Monitor, "monitorId"), createCheck);


To fix the problem, we will introduce a rate-limiting middleware using the express-rate-limit package. This middleware will limit the number of requests to the routes that perform database access, specifically the POST and DELETE routes that use the verifyOwnership middleware.

Install the express-rate-limit package.

Import the express-rate-limit package in the Server/routes/checkRoute.js file.

Configure the rate limiter to allow a maximum of 100 requests per 15 minutes.

Apply the rate limiter to the POST and DELETE routes that use the verifyOwnership middleware.

Server/routes/checkRoute.js

-  isAllowed(["admin", "superadmin"]),
-  checkController.updateChecksTTL
-);
+router.put("/team/ttl", isAllowed(["admin", "superadmin"]), updateChecksTTL);


To fix the problem, we will introduce rate limiting to the route handler on line 32. We will use the express-rate-limit package to set up a rate limiter and apply it to the specific route. This will ensure that the route is protected against excessive requests, mitigating the risk of DoS attacks.

Install the express-rate-limit package if it is not already installed.

Import the express-rate-limit package in the Server/routes/checkRoute.js file.

Set up a rate limiter with appropriate configuration (e.g., maximum of 100 requests per 15 minutes).

Apply the rate limiter to the route handler on line 32.

Server/routes/checkRoute.js

-  isAllowed(["admin", "superadmin"]),
-  checkController.updateChecksTTL
-);
+router.put("/team/ttl", isAllowed(["admin", "superadmin"]), updateChecksTTL);


To fix the problem, we will introduce a rate-limiting middleware using the express-rate-limit package. This middleware will be applied to the updateChecksTTL route to ensure that the number of requests to this endpoint is controlled, thereby mitigating the risk of denial-of-service attacks.

Install the express-rate-limit package if it is not already installed.

Import the express-rate-limit package in the Server/routes/checkRoute.js file.

Configure a rate limiter with appropriate settings (e.g., a maximum of 100 requests per 15 minutes).

Apply the rate limiter to the updateChecksTTL route.

Server/routes/maintenanceWindowRoute.js

-router.post("/", maintenanceWindowController.createMaintenanceWindows);
+const router = Router();
+
+router.post("/", createMaintenanceWindows);


To fix the problem, we will use the express-rate-limit package to add rate limiting to the createMaintenanceWindows route. This will ensure that the endpoint is protected against excessive requests, which could otherwise lead to performance degradation or service unavailability.

Install the express-rate-limit package if it is not already installed.

Import the express-rate-limit package in the Server/routes/maintenanceWindowRoute.js file.

Set up a rate limiter with appropriate configuration (e.g., a maximum of 100 requests per 15 minutes).

Apply the rate limiter to the createMaintenanceWindows route.

Server/routes/maintenanceWindowRoute.js

 );

-router.get("/team/", maintenanceWindowController.getMaintenanceWindowsByTeamId);
+router.get("/team/", getMaintenanceWindowsByTeamId);


To fix the issue, we will introduce rate limiting to the Express application using the express-rate-limit package. This will help prevent denial-of-service attacks by limiting the number of requests a client can make to the server within a specified time window. We will apply the rate limiter middleware to the specific route handler getMaintenanceWindowsByTeamId.

Install the express-rate-limit package.

Import the express-rate-limit package in the Server/routes/maintenanceWindowRoute.js file.

Configure the rate limiter with appropriate settings (e.g., maximum number of requests and time window).

Apply the rate limiter middleware to the getMaintenanceWindowsByTeamId route.

Server/routes/monitorRoute.js

-  isAllowed(["admin", "superadmin"]),
-  monitorController.addDemoMonitors
-);
+router.post("/demo", isAllowed(["admin", "superadmin"]), addDemoMonitors);


To fix the problem, we will add rate limiting to the route handler on line 40. We will use the express-rate-limit package to set up a rate limiter and apply it to the specific route. This will help prevent denial-of-service attacks by limiting the number of requests that can be made to this endpoint within a specified time window.

Install the express-rate-limit package if it is not already installed.

Import the express-rate-limit package in the Server/routes/monitorRoute.js file.

Set up a rate limiter with appropriate configuration (e.g., maximum number of requests per minute).

Apply the rate limiter to the route handler on line 40.

Server/routes/monitorRoute.js

-  isAllowed(["admin", "superadmin"]),
-  monitorController.addDemoMonitors
-);
+router.post("/demo", isAllowed(["admin", "superadmin"]), addDemoMonitors);


To fix the problem, we will introduce a rate-limiting middleware using the express-rate-limit package. This middleware will be applied specifically to the addDemoMonitors route to limit the number of requests that can be made to this endpoint within a specified time window.

Install the express-rate-limit package if it is not already installed.

Import the express-rate-limit package in the Server/routes/monitorRoute.js file.

Configure the rate limiter with appropriate settings (e.g., a maximum of 5 requests per minute).

Apply the rate limiter to the addDemoMonitors route.

Server/routes/settingsRoute.js


-module.exports = router;
+router.get("/", getAppSettings);
+router.put("/", isAllowed(["superadmin"]), updateAppSettings);


To fix the problem, we will add rate limiting to the updateAppSettings route using the express-rate-limit package. This will ensure that the route is protected against excessive requests, mitigating the risk of DoS attacks.

Install the express-rate-limit package if it is not already installed.

Import the express-rate-limit package in the Server/routes/settingsRoute.js file.

Configure a rate limiter with appropriate settings (e.g., a maximum of 100 requests per 15 minutes).

Apply the rate limiter to the updateAppSettings route.

Server/index.js

+
+	//routes
+	app.use("/api/v1/auth", authRouter);
+	app.use("/api/v1/settings", verifyJWT, settingsRouter);


To fix the problem, we will introduce a rate-limiting middleware using the express-rate-limit package. This middleware will be applied to the routes that use the verifyJWT middleware to ensure that these routes are protected against DoS attacks. Specifically, we will:

Install the express-rate-limit package.

Configure a rate limiter with appropriate settings.

Apply the rate limiter to the routes that use the verifyJWT middleware.

Server/index.js

+	app.use("/api/v1/auth", authRouter);
+	app.use("/api/v1/settings", verifyJWT, settingsRouter);
+	app.use("/api/v1/invite", inviteRouter);
+	app.use("/api/v1/monitors", verifyJWT, monitorRouter);


To fix the problem, we will introduce a rate-limiting middleware using the express-rate-limit package. This middleware will be applied to the routes that use the verifyJWT middleware to ensure that these routes are protected against excessive requests. We will configure the rate limiter to allow a maximum of 100 requests per 15 minutes from a single IP address.

Install the express-rate-limit package.

Import the express-rate-limit package in the Server/index.js file.

Configure the rate limiter with appropriate settings.

Apply the rate limiter to the routes that use the verifyJWT middleware.

Server/index.js

+	app.use("/api/v1/settings", verifyJWT, settingsRouter);
+	app.use("/api/v1/invite", inviteRouter);
+	app.use("/api/v1/monitors", verifyJWT, monitorRouter);
+	app.use("/api/v1/checks", verifyJWT, checkRouter);


To fix the problem, we will introduce rate limiting to the routes that use the verifyJWT middleware. We will use the express-rate-limit package to achieve this. Specifically, we will:

Install the express-rate-limit package.

Configure a rate limiter with appropriate settings.

Apply the rate limiter to the routes that use the verifyJWT middleware.

Server/index.js

+	app.use("/api/v1/invite", inviteRouter);
+	app.use("/api/v1/monitors", verifyJWT, monitorRouter);
+	app.use("/api/v1/checks", verifyJWT, checkRouter);
+	app.use("/api/v1/maintenance-window", verifyJWT, maintenanceWindowRouter);


To fix the issue, we will introduce rate limiting to the Express application using the express-rate-limit package. This will involve the following steps:

Install the express-rate-limit package.

Import the express-rate-limit package in the Server/index.js file.

Set up a rate limiter with appropriate configuration (e.g., maximum of 100 requests per 15 minutes).

Apply the rate limiter to the routes that use the verifyJWT middleware.

Server/index.js

+	app.use("/api/v1/monitors", verifyJWT, monitorRouter);
+	app.use("/api/v1/checks", verifyJWT, checkRouter);
+	app.use("/api/v1/maintenance-window", verifyJWT, maintenanceWindowRouter);
+	app.use("/api/v1/queue", verifyJWT, queueRouter);


To fix the issue, we will introduce rate limiting to the Express application using the express-rate-limit package. This will involve the following steps:

Install the express-rate-limit package.

Import the express-rate-limit package in the Server/index.js file.

Configure a rate limiter with appropriate settings (e.g., a maximum of 100 requests per 15 minutes).

Apply the rate limiter to the routes that use the verifyJWT middleware.

Server/tests/controllers/authController.test.js

+		req = {
+			params: { userId: "123" },
+			body: { password: "Password1!", newPassword: "Password2!" },
+			headers: { authorization: "Bearer token" },


Server/tests/controllers/authController.test.js

+	beforeEach(() => {
+		req = {
+			headers: {
+				authorization: "Bearer token",


Server/tests/controllers/monitorController.test.js

+		});
+		req = {
+			headers: {
+				authorization: "Bearer token",


Server/tests/controllers/monitorController.test.js

+		});
+		req = {
+			headers: {
+				authorization: "Bearer token",


jennifer-gan · 2024-10-16T17:19:07Z

This looks like lots of code refactoring and formatting, tests are all running on my end as well,
please fix the conflict and it should be good to merge

ajhollid · 2024-10-17T02:55:18Z

This looks like lots of code refactoring and formatting, tests are all running on my end as well, please fix the conflict and it should be good to merge

Thanks for checking it over, conflicts resovled and ready to go

Server/tests/controllers/authController.test.js

+		const error = new Error("jwt.sign error");
+		stub = sinon.stub(jwt, "sign").throws(error);
+		const payload = { id: "123" };
+		const appSettings = { jwtSecret: "my_secret" };


Server/tests/controllers/authController.test.js

+
+	it("should return a token if jwt.sign is successful and appSettings.jwtTTL is not defined", () => {
+		const payload = { id: "123" };
+		const appSettings = { jwtSecret: "my_secret" };


Server/tests/controllers/authController.test.js

+
+	it("should return a token if jwt.sign is successful and appSettings.jwtTTL is defined", () => {
+		const payload = { id: "123" };
+		const appSettings = { jwtSecret: "my_secret", jwtTTL: "1s" };


Server/tests/controllers/authController.test.js

+
+	it("should return a refresh token if jwt.sign is successful and appSettings.refreshTokenTTL is not defined", () => {
+		const payload = {};
+		const appSettings = { refreshTokenSecret: "my_refresh_secret" };


Server/tests/controllers/authController.test.js

+	it("should return a refresh token if jwt.sign is successful and appSettings.refreshTokenTTL is defined", () => {
+		const payload = {};
+		const appSettings = {
+			refreshTokenSecret: "my_refresh_secret",


coderabbitai · 2024-10-17T03:03:48Z

Caution

Review failed

The pull request is closed.

Walkthrough

This pull request introduces significant changes across both client and server components, primarily focusing on transitioning from CommonJS to ES6 module syntax. Key modifications include the addition of a new Mocha configuration file, updates to existing files for consistent formatting, and the introduction of new functions in various controllers. The DetailsPage component received formatting adjustments, while multiple model and controller files were refactored to improve readability and maintainability.

Changes

File Path	Change Summary
Client/src/Pages/Monitors/Details/index.jsx	Reformatted `DetailsPage` component for improved readability; prop types declaration reformatted.
Server/.mocharc.cjs	New Mocha configuration file added.
Server/.mocharc.js	Deleted old Mocha configuration file.
Server/configs/db.js	Export mechanism updated to ES6 module syntax.
Server/controllers/authController.js	Transitioned to ES6 module syntax; renamed constant and reformatted structure.
Server/controllers/checkController.js	Transitioned to ES6 module syntax; updated export statement.
Server/controllers/controllerUtils.js	Reformatted functions and added `fetchMonitorCertificate`.
Server/controllers/inviteController.js	Transitioned to ES6 module syntax; updated export statement.
Server/controllers/maintenanceWindowController.js	Transitioned to ES6 module syntax; updated export statement.
Server/controllers/monitorController.js	Transitioned to ES6 module syntax; removed `sslChecker` dependency.
Server/controllers/queueController.js	Transitioned to ES6 module syntax; updated export statement.
Server/controllers/settingsController.js	Transitioned to ES6 module syntax; updated export statement.
Server/db/models/*.js	All model files transitioned to ES6 module syntax; import/export statements updated.
Server/db/mongo/*.js	All mongo module files transitioned to ES6 module syntax; import/export statements updated.
Server/index.js	Transitioned to ES6 module syntax; modified database connection logic for async imports.
Server/middleware/*.js	All middleware files transitioned to ES6 module syntax; export statements updated.
Server/package.json	Updated to indicate ECMAScript modules; modified testing setup and dependencies.
Server/routes/*.js	All route files transitioned to ES6 module syntax; export statements updated.
Server/service/*.js	All service files transitioned to ES6 module syntax; export statements updated.
Server/tests/controllers/*.test.js	All test files transitioned to ES6 module syntax; import statements updated.
Server/utils/*.js	All utility files transitioned to ES6 module syntax; export statements updated.
Server/validation/joi.js	Transitioned to ES6 module syntax; corrected a typo in a variable name.

Possibly related PRs

Implement monitor states for Pagespeed pages #823: Changes in the MonitorTable component may relate to the DetailsPage component's formatting adjustments.
Feat/load monitors, resolves #793 #830: Modifications to the uptimeMonitorsSlice and the Settings component could be relevant as they deal with monitor management.
Feat/be/ttl, #764 #835: Changes in monitorController.js may connect with the overall structure and functionality of the DetailsPage component.
Feat/be/error handling #837: Enhancements to error handling in controllers could improve the robustness of the application, affecting the DetailsPage.
Use getMonitorsByTeamId endpoint #840: Changes in the PageSpeed component may relate to the DetailsPage logic for displaying monitor details.
Pagespeed dashboard revamp #841: Revamp of the Pagespeed dashboard may connect with the DetailsPage component's formatting improvements.
Feat/search component #853: Implementation of a search component enhances user interaction with monitor data, similar to improvements in the DetailsPage.
Create delete all monitors and clear all stats windows using dialog component, Resolves #901 #939: Introduction of a dialog component for confirming actions may relate to user interactions within the DetailsPage.
Generate refresh token & add it to response #960: Addition of refresh tokens and updates to authentication could indirectly relate to the DetailsPage.

Suggested reviewers

marcelluscaio: Suggested for review due to familiarity with the codebase.

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

‼️ IMPORTANT
Auto-reply has been disabled for this repository in the CodeRabbit settings. The CodeRabbit bot will not respond to your replies unless it is explicitly tagged.

Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai generate unit testing code for this file.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and generate unit testing code.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

ajhollid added 3 commits October 15, 2024 11:57

migrate to esm

f057807

Migrate tests to ESM

896b343

use C8 instead of nyc for test coverage

0bf271e

github-advanced-security bot found potential problems Oct 15, 2024

View reviewed changes

ajhollid added 10 commits October 16, 2024 10:57

Merge branch 'develop' into feat/be/esm

35ddd20

Refactor getting certificate to use TLS instead of SSL-checker

ced1bf9

Remove ssl-checker

7b8e5a1

Refactor FE to make proper use of date

6753446

Add missing variable def to User model

05dae6b

Prettier formatting

3ace148

Prettier formatting

5f6e063

Use new fetchMonitorCertificate method, prettier formatting

81d3b8d

Add tests for fetchCertificates

c356843

Fix coverage for auth

4a05157

ajhollid marked this pull request as ready for review October 16, 2024 06:20

github-advanced-security bot found potential problems Oct 16, 2024

View reviewed changes

ajhollid added 2 commits October 17, 2024 10:42

Merge branch 'develop' into feat/be/esm

81f1fe4

Resolve conflicts, update tests

63e39ed

ajhollid merged commit d8e2b06 into develop Oct 17, 2024
1 of 2 checks passed

ajhollid deleted the feat/be/esm branch October 17, 2024 02:55

github-advanced-security bot found potential problems Oct 17, 2024

View reviewed changes

@@ -1,2 +1,3 @@
             import { Router } from "express";
+            import rateLimit from "express-rate-limit";
             import {
@@ -15,6 +16,12 @@
+            const limiter = rateLimit({
+              windowMs: 15 * 60 * 1000, // 15 minutes
+              max: 100, // max 100 requests per windowMs
+            });
             router.get("/:monitorId", getChecks);
-            router.post("/:monitorId", verifyOwnership(Monitor, "monitorId"), createCheck);
+            router.post("/:monitorId", limiter, verifyOwnership(Monitor, "monitorId"), createCheck);
             router.delete(
               "/:monitorId",
+              limiter,
               verifyOwnership(Monitor, "monitorId"),

@@ -33,3 +33,4 @@
             		"swagger-ui-express": "5.0.1",
-            		"winston": "^3.13.0"
+            		"winston": "^3.13.0",
+            		"express-rate-limit": "^7.4.1"
             	},

Package	Version	Security advisories
express-rate-limit (npm)	7.4.1	None

@@ -1,2 +1,3 @@
             import { Router } from "express";
+            import rateLimit from "express-rate-limit";
             import {
@@ -15,2 +16,7 @@
+            const limiter = rateLimit({
+              windowMs: 15 * 60 * 1000, // 15 minutes
+              max: 100, // limit each IP to 100 requests per windowMs
+            });
             router.get("/:monitorId", getChecks);
@@ -31,3 +37,3 @@
-            router.put("/team/ttl", isAllowed(["admin", "superadmin"]), updateChecksTTL);
+            router.put("/team/ttl", limiter, isAllowed(["admin", "superadmin"]), updateChecksTTL);

@@ -33,3 +33,4 @@
             		"swagger-ui-express": "5.0.1",
-            		"winston": "^3.13.0"
+            		"winston": "^3.13.0",
+            		"express-rate-limit": "^7.4.1"
             	},

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Migrate backend to ESM #959

Migrate backend to ESM #959

ajhollid commented Oct 15, 2024 •

edited

Loading

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

jennifer-gan commented Oct 16, 2024

ajhollid commented Oct 17, 2024

coderabbitai bot commented Oct 17, 2024

Review failed

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

Documentation and Community

@@ -1,2 +1,3 @@
             import { Router } from "express";
+            import rateLimit from "express-rate-limit";
             import {
@@ -20,2 +21,7 @@
+            const demoMonitorLimiter = rateLimit({
+            	windowMs: 1 * 60 * 1000, // 1 minute
+            	max: 5, // limit each IP to 5 requests per windowMs
+            });
             router.get("/", getAllMonitors);
@@ -39,3 +45,3 @@
-            router.post("/demo", isAllowed(["admin", "superadmin"]), addDemoMonitors);
+            router.post("/demo", isAllowed(["admin", "superadmin"]), demoMonitorLimiter, addDemoMonitors);

@@ -5,2 +5,3 @@
             import express from "express";
+            import rateLimit from "express-rate-limit";
             import helmet from "helmet";
@@ -63,2 +64,8 @@
+            	// Rate limiter middleware
+            	const limiter = rateLimit({
+            		windowMs: 15 * 60 * 1000, // 15 minutes
+            		max: 100, // limit each IP to 100 requests per windowMs
+            	});
             	// middlewares
@@ -89,8 +96,8 @@
             	app.use("/api/v1/auth", authRouter);
-            	app.use("/api/v1/settings", verifyJWT, settingsRouter);
+            	app.use("/api/v1/settings", limiter, verifyJWT, settingsRouter);
             	app.use("/api/v1/invite", inviteRouter);
-            	app.use("/api/v1/monitors", verifyJWT, monitorRouter);
-            	app.use("/api/v1/checks", verifyJWT, checkRouter);
-            	app.use("/api/v1/maintenance-window", verifyJWT, maintenanceWindowRouter);
-            	app.use("/api/v1/queue", verifyJWT, queueRouter);
+            	app.use("/api/v1/monitors", limiter, verifyJWT, monitorRouter);
+            	app.use("/api/v1/checks", limiter, verifyJWT, checkRouter);
+            	app.use("/api/v1/maintenance-window", limiter, verifyJWT, maintenanceWindowRouter);
+            	app.use("/api/v1/queue", limiter, verifyJWT, queueRouter);

Migrate backend to ESM #959

Migrate backend to ESM #959

Conversation

ajhollid commented Oct 15, 2024 • edited Loading

jennifer-gan commented Oct 16, 2024

ajhollid commented Oct 17, 2024

coderabbitai bot commented Oct 17, 2024

Review failed

Walkthrough

Changes

Possibly related PRs

Suggested reviewers

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

Documentation and Community

ajhollid commented Oct 15, 2024 •

edited

Loading