47f10f62c7
Add Fastify server with config validation (Zod), health/healthz endpoints, auth middleware (Bearer token + session lookup), security plugins (CORS, Helmet, rate limiting), error handler, audit logging, and graceful shutdown. 36 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
25 lines
665 B
TypeScript
25 lines
665 B
TypeScript
import type { FastifyInstance } from 'fastify';
|
|
import cors from '@fastify/cors';
|
|
import helmet from '@fastify/helmet';
|
|
import rateLimit from '@fastify/rate-limit';
|
|
import type { McpdConfig } from '../config/index.js';
|
|
|
|
export async function registerSecurityPlugins(
|
|
app: FastifyInstance,
|
|
config: McpdConfig,
|
|
): Promise<void> {
|
|
await app.register(cors, {
|
|
origin: config.corsOrigins,
|
|
methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
|
|
});
|
|
|
|
await app.register(helmet, {
|
|
contentSecurityPolicy: false, // API server, no HTML
|
|
});
|
|
|
|
await app.register(rateLimit, {
|
|
max: config.rateLimitMax,
|
|
timeWindow: config.rateLimitWindowMs,
|
|
});
|
|
}
|