diff --git a/src/app.ts b/src/app.ts index b50bd06..dc40d2b 100644 --- a/src/app.ts +++ b/src/app.ts @@ -1,3 +1,198 @@ -import express from "express"; +import express, { Express, Request, Response } from 'express'; +import cors from 'cors'; +import helmet from 'helmet'; +import rateLimit from 'express-rate-limit'; +import hpp from 'hpp'; +import { errorHandler } from './middleware/error.middleware.js'; +import { SEP10AuthService } from './services/sep10.service.js'; +import { SEP12KYCService } from './services/sep12.service.js'; +import { SEP24SettlementService } from './services/sep24.service.js'; +import { createAuthRouter } from './routes/auth.routes.js'; +import { createKYCRouter } from './routes/kyc.routes.js'; +import { createSettlementRouter } from './routes/settlement.routes.js'; -export const app = express(); +export function createApp(): Express { + const app = express(); + + // Security Middleware + app.use(helmet()); + app.use(cors()); + + // Rate Limiting (100 requests per 15 minutes per IP) + const limiter = rateLimit({ + windowMs: 15 * 60 * 1000, + max: 100, + message: { error: { code: 'RATE_LIMIT_EXCEEDED', message: 'Too many requests from this IP, please try again later.' } } + }); + app.use('/api/', limiter); + + // Payload Limits & HTTP Parameter Pollution protection + app.use(express.json({ limit: '1mb' })); + app.use(express.urlencoded({ extended: true, limit: '1mb' })); + app.use(hpp()); + + // Instantiate services + const authService = new SEP10AuthService(); + const kycService = new SEP12KYCService(); + const settlementService = new SEP24SettlementService(); + + // Root endpoint (API Splash Page) + app.get('/', (_req: Request, res: Response) => { + res.send(` + + + + + + HaloPay Settlement API + + + +
+

HaloPay Settlement API Online

+

This is the backend settlement engine for the HaloPay Protocol. It acts as the bridge between the offline-first Merchant POS and the Stellar network, handling authentication, KYC ingestion, and automated fiat off-ramping.

+ +

REST Endpoints

+ +
+
GET /health
+
System health check and version verification.
+
+ +
+
GET /api/v1/auth/
+
SEP-10 Stellar Authentication. Initiates the challenge/response flow for merchant wallets to authenticate securely with the backend.
+
+ +
+
POST /api/v1/kyc/customer
+
SEP-12 KYC Ingestion. Accepts multipart/form-data for merchant government ID and photo uploads (up to 10MB limit), securely routing them to the MoneyGram anchor.
+
+ +
+
POST /api/v1/settlement/withdraw
+
SEP-24 Fiat Off-Ramp Orchestration. Triggers the interactive withdrawal process to convert aggregated merchant USDC balances into local fiat.
+
+ +

WebSocket Endpoints

+ +
+
WS /ws/payments
+
Persistent Horizon listener. Broadcasts incoming on-chain Stellar payments to connected POS terminals in real-time.
+
+ +
+ Documentation Site → + Launch POS Terminal → +
+
+ + + `); + }); + + // Health check endpoint + app.get('/health', (_req: Request, res: Response) => { + res.status(200).json({ + status: 'OK', + service: 'halopay-api', + version: '0.1.0', + timestamp: new Date().toISOString() + }); + }); + + // Mount API routers + app.use('/api/v1/auth', createAuthRouter(authService)); + app.use('/api/v1/kyc', createKYCRouter(kycService)); + app.use('/api/v1/settlement', createSettlementRouter(settlementService)); + + // Global Error Handler + app.use(errorHandler); + + return app; +}