Merge branch 'finos:main' into add-cli-tool

.github/workflows/nodejs.yml

@@ -43,7 +43,7 @@ jobs:
     - name: Test
       id: test
       run: |
-        npm run test-coverage-ci || echo "Silently ignoring coverage threshold limit..."
+        npm run test-coverage-ci
 
     - name: Upload test coverage report
       uses: codecov/codecov-action@v4.1.0

package.json

@@ -14,7 +14,7 @@
     "server-test": "mocha --exit",
     "test": "mocha --exit",
     "test-coverage": "nyc npm run test",
-    "test-coverage-ci": "nyc --reporter=lcovonly --reporter=text --check-coverage npm run test",
+    "test-coverage-ci": "nyc --reporter=lcovonly --reporter=text npm run test",
     "prepare": "node ./scripts/prepare.js",
     "lint": "eslint --fix . --ext .js,.jsx",
     "gen-schema-doc": "node ./scripts/doc-schema.js"
@@ -41,6 +41,7 @@
     "email-validator": "^2.0.4",
     "express": "^4.18.2",
     "express-http-proxy": "^2.0.0",
+    "express-rate-limit": "^7.1.5",
     "express-session": "^1.17.1",
     "generate-password": "^1.5.1",
     "history": "5.3.0",
@@ -79,7 +80,7 @@
     "eslint-plugin-prettier": "^5.0.0",
     "eslint-plugin-promise": "^6.0.0",
     "eslint-plugin-react": "^7.21.5",
-    "eslint-plugin-standard": "^4.0.1",
+    "eslint-plugin-standard": "^5.0.0",
     "husky": "^9.0.0",
     "mocha": "^10.2.0",
     "nyc": "^15.1.0",

src/service/index.js

@@ -3,6 +3,12 @@ const session = require('express-session');
 const http = require('http');
 const cors = require('cors');
 const app = express();
+const rateLimit = require('express-rate-limit');
+
+const limiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100, // limit each IP to 100 requests per windowMs
+});
 
 const { GIT_PROXY_UI_PORT: uiPort } = require('../config/env').Vars;
 
@@ -16,11 +22,12 @@ const corsOptions = {
 };
 
 const start = async () => {
-  // confiugraiton of passport is async
+  // configuration of passport is async
   // Before we can bind the routes - we need the passport
   const passport = await require('./passport').configure();
   const routes = require('./routes');
   app.use(cors(corsOptions));
+  app.use(limiter);
   app.use(
     session({
       secret: 'keyboard cat',

src/service/routes/auth.js

@@ -117,7 +117,12 @@ router.post('/password', async (req, res) => {
         throw new Error('current password did not match the given');
       }
     } catch (e) {
-      res.status(500).send(e).end();
+      res
+        .status(500)
+        .send({
+          message: 'An error occurred',
+        })
+        .end();
     }
   } else {
     res.status(401).end();