feat: Implement rate limiting, request timeouts, and security headers for improved server protection

server/index.js

@@ -10,6 +10,7 @@ import { apiError, describe } from "./errors.js";
 import { createHash } from "node:crypto";
 import { timetable } from "./timetable.js";
 import { catalogDiagnostics } from "./diagnostics.js";
+import { securityHeaders, requestTimeout } from "./protect.js";
 import {
   getIndex,
   indexStatus,
@@ -35,8 +36,23 @@ app.disable("x-powered-by");
 // Behind Caddy or a tunnel on this host, the client's address comes from X-Forwarded-For;
 // only proxies on private networks are believed, so a client cannot forge its own.
 app.set("trust proxy", "loopback, linklocal, uniquelocal");
+const dist = fileURLToPath(new URL("../dist/", import.meta.url));
+app.use(securityHeaders(dist + "index.html"));
 // gzip or brotli: a semester of lessons is about 200 KB of JSON and shrinks tenfold.
 app.use(compression());
+// A generous limit per address: students behind one dormitory or university NAT share it, so
+// it only stops scrapers and runaway clients. Health checks are not counted.
+app.use(
+  "/api",
+  rateLimit({
+    max: Number(process.env.PSU_API_RATE_LIMIT) || 300,
+    windowMs: 60 * 1000,
+    message: "Слишком много запросов с вашего адреса. Подождите минуту.",
+    skip: (req) => req.path === "/health" || req.path === "/ready",
+  }),
+);
+// Parsing an import may wait for a LibreOffice conversion and other imports.
+app.use("/api", requestTimeout(Number(process.env.PSU_REQUEST_TIMEOUT_MS) || 30_000, { "/import": 90_000 }));
 app.use("/api", (_req, res, next) => {
   // Clients may keep a response but must ask again each time; Express's ETag turns an
   // unchanged answer into an empty 304, so a phone re-downloads a timetable only when it changed.
@@ -49,8 +65,9 @@ app.use("/api", (_req, res, next) => {
 // 5 — error codes (`code` beside `error`, see server/errors.js), timetable 304 before any work;
 // 6 — the timetable carries the group's exams and credits from other catalog documents;
 // 7 — /api/diagnostics, cells the parser could not read with confidence;
-// 8 — /api/ready, and `ready` in /api/health.
-const API_VERSION = 8;
+// 8 — /api/ready, and `ready` in /api/health;
+// 9 — a request limit on /api (429 too_many_requests), a 30 s time limit (504 timeout), security headers.
+const API_VERSION = 9;
 
 /**
  * What the server still waits for before it answers from memory: the catalog, the week table
@@ -59,10 +76,13 @@ const API_VERSION = 8;
 const waitingFor = (sources, directory) =>
   [!sources.catalog && "catalog", !sources.calendar && "calendar", !directory.builtAt && "index"].filter(Boolean);
 // Liveness plus what the server currently reads from the university, without network calls.
-app.get("/api/health", async (_req, res) => {
+app.get("/api/health", async (req, res) => {
   const sources = await sourceStatus().catch((e) => ({ error: e.message }));
   res.json({
     ok: true,
+    // The caller's address as the server sees it: behind a proxy it must be the client's own,
+    // or every visitor shares one request limit.
+    client: req.ip,
     ready: waitingFor(sources, indexStatus()).length === 0,
     apiVersion: API_VERSION,
     parserVersion: PARSER_VERSION,
@@ -264,7 +284,6 @@ app.post("/api/import", importLimit, upload.single("file"), async (req, res, nex
     next(e.status || e.code === "LIMIT_FILE_SIZE" ? e : apiError(422, "unreadable_file", e.message));
   }
 });
-const dist = fileURLToPath(new URL("../dist/", import.meta.url));
 app.use(express.static(dist, { maxAge: 0 }));
 app.get("/{*path}", (req, res, next) =>
   req.path.startsWith("/api/")
@@ -273,6 +292,8 @@ app.get("/{*path}", (req, res, next) =>
 );
 app.use((error, req, res, _next) => {
   const { status, code, message } = describe(error);
+  // Answered already, by the time limit: the late error is only logged.
+  if (res.headersSent) return console.error(`${req.method} ${req.originalUrl} после ответа: ${error.message}`);
   // Faults of the server keep their stack; expected errors need a line.
   if (status >= 500 && code === "internal") console.error(req.method, req.originalUrl, error);
   else console.error(`${req.method} ${req.originalUrl} → ${status} ${code}: ${error.message}`);
@@ -282,12 +303,17 @@ export { app };
 
 /** Starts listening and loads the week table and the whole catalog in the background. */
 export function start(port = Number(process.env.PORT || 3001), host = process.env.HOST || "127.0.0.1") {
-  return app.listen(port, host, () => {
+  const server = app.listen(port, host, () => {
     console.log(`API и PWA: http://127.0.0.1:${port}`);
     // So the first visit and the first search do not wait for the university.
     getCalendar().catch((e) => console.error(`Таблица недель: ${e.message}`));
     getIndex().catch((e) => console.error(`Индекс: ${e.message}`));
   });
+  // A client must send its headers within 15 s and the whole request (a Word upload of up to
+  // 10 MB on a slow phone) within two minutes, so slow connections cannot pile up.
+  server.headersTimeout = 15_000;
+  server.requestTimeout = 120_000;
+  return server;
 }
 // `node server/index.js` serves; tests import the app without listening.
 if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) start();