From cebed0a904b079be98bb919cdd421a595d3897ee Mon Sep 17 00:00:00 2001 From: nutcas3 Date: Thu, 30 Apr 2026 22:53:09 +0300 Subject: [PATCH] feat: Add CSRF protection middleware and Swagger annotations, remove GraphQL handler setup - Add github.com/utrack/gin-csrf import for CSRF protection - Remove internal/graphql import and resolver initialization - Add Swagger API documentation annotations (@title, @version, @description, @host, @BasePath, @securityDefinitions) - Add CSRF middleware with configurable secret from CSRF_SECRET environment variable - Add warning log when using default CSRF secret - Add return statement after database --- apps/api-server/cmd/server.go | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/apps/api-server/cmd/server.go b/apps/api-server/cmd/server.go index 055d6a9..423bd03 100644 --- a/apps/api-server/cmd/server.go +++ b/apps/api-server/cmd/server.go @@ -14,22 +14,31 @@ import ( "github.com/gin-gonic/gin" swaggerFiles "github.com/swaggo/files" ginSwagger "github.com/swaggo/gin-swagger" + csrf "github.com/utrack/gin-csrf" "github.com/nutcas3/telecom-platform/apps/api-server/internal/config" "github.com/nutcas3/telecom-platform/apps/api-server/internal/database" "github.com/nutcas3/telecom-platform/apps/api-server/internal/discovery" - "github.com/nutcas3/telecom-platform/apps/api-server/internal/graphql" "github.com/nutcas3/telecom-platform/apps/api-server/internal/middleware" "github.com/nutcas3/telecom-platform/apps/api-server/internal/monitoring" "github.com/nutcas3/telecom-platform/apps/api-server/internal/websocket" ) +// @title Telecom Platform API +// @version 1.0 +// @description API for Telecom Platform +// @host localhost:8080 +// @BasePath /api/v1 +// @securityDefinitions.apikey BearerAuth +// @in header +// @name Authorization func main() { cfg := config.LoadConfig() db, err := database.NewDatabase(&cfg.Database) if err != nil { log.Fatalf("Failed to initialize database: %v", err) + return } defer db.Close() @@ -72,10 +81,17 @@ func main() { } }() - resolver := graphql.NewResolver(db, cfg) - router := gin.Default() - graphql.SetupGraphQLHandler(router, resolver) + + // Add CSRF protection middleware + csrfSecret := os.Getenv("CSRF_SECRET") + if csrfSecret == "" { + csrfSecret = "change-me-in-production-csrf-secret-32-chars-min" + log.Printf("WARNING: Using default CSRF secret, set CSRF_SECRET environment variable") + } + router.Use(csrf.Middleware(csrf.Options{ + Secret: csrfSecret, + })) router.Use(func(c *gin.Context) { next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { c.Next() }) @@ -136,7 +152,7 @@ func main() { go func() { log.Printf("Starting API server on port %s", cfg.Server.Port) if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed { - log.Fatalf("Server failed to start: %v", err) + log.Printf("Server failed to start: %v", err) } }()