Effective Hapi: Lessons learned leveraging the web-server framework

'use strict'

require('dotenv').config()
const Hapi = require('hapi')

const init = async () => {
  const server = Hapi.server({
    port: process.env.PORT || 3000,
    host: 'localhost'
  })

  // ... configuration of plugins, logging and view templates ...

  server.route({
    method: 'GET',
    path: '/',
    handler: (request, h) => 'Hello world'
  })

  await server.start()
  console.log(`Server running at: ${server.info.uri}`)
  return server
}

// exit immediately on unhandled promises
process.on('unhandledRejection', err => {
  console.log(err)
  process.exit(1)
})

// only start server if file is called directly
if (require.main === module) {
  init()
}

// export init function so that it can be reached by tests.
module.exports = init

import test from 'ava'
import initServer from './server'
import rp from 'request-promise-native'

let server = null
let testUrl = null

test.before(async t => {
  process.env.PORT = 0
  server = await initServer()
  testUrl = `http://localhost:${server.info.port}`
})

test.after(async t => {
  await server.stop()
})

test('visiting index unauthenticated redirects to /login', async t => {
  const response = await rp({
    method: 'GET',
    uri: `${testUrl}/`,
    simple: false,
    resolveWithFullResponse: true
  })
  t.is(
    response.toJSON().request.uri.pathname,
    '/login',
    'Expected to be redirected to /login'
  )
})

/**
 * Hapi has great facilities for setting up multiple data storages
 * backed by in-memory implementations or more full-fledged databases.
 */
server.app.tokenStore = server.cache({
  segment: 'tokens',
  expiresIn: 1000 * 60 * 60 * 3 // three hours
})

/**
 * Encrypted cookies? No problem.
 */
const server = Hapi.server({
  port: process.env.PORT || 3000,
  host: 'localhost',
  state: {
    ttl: 1000 * 60 * 60 * 12, // twelve hours
    strictHeader: true,
    ignoreErrors: true,
    // cookies should only be set on https connections, except in testing.
    isSecure: process.env.NODE_ENV !== 'test',
    isHttpOnly: true,
    isSameSite: 'Strict',
    encoding: 'iron',
    password: process.env.IRON_SECRET
  }
})

// Hapi has many events that you can use to great advantage.
// Here we decorate all responses with additional security headers.
// This hardens usage of javascript and iFrames.
server.ext('onPreResponse', (request, h) => {
  // exception responses returned by Boom can't be manipulated, exit early.
  if (!request.response.header) {
    return h.continue
  }
  // Disallow site being showed in an iFrame.
  request.response.header('X-FRAME-OPTIONS', 'deny')
  if (process.env.NODE_ENV !== 'test') {
    // CSP breaks browser-sync, so we ignore it for development
    // Disallow inline javascript, and JS served from other sites.
    request.response.header('Content-Security-Policy', "default-src 'self'")
  }
  return h.continue
})

// Sample route
server.route({
  method: 'POST',
  path: '/',
  options: { auth: false },
  // Here we require a route handler exactly where it's used.
  // This is advantageous because we don't have to travel up and
  // down the server.js file to understand which import is used
  // where.
  handler: require('./src/authorization.handler')
    .exchangeAuthorizationCodeForToken
})

// It's great to add more specialised packages in route handlers
// to avoid cluttering the growing server.js file.
const Boom = require('boom')
const uuidv4 = require('uuid/v4')

// I try hard to verbalise the purpose of my functions.
// life's too short for misunderstandings.
const authorizeCreationOfAuthorizationCode = async (request, h) => {
  if (!request.auth.isAuthenticated) {
    return Boom.unauthorized()
  }
  const { state, redirect_uri, client_id, me, scope } = request.payload
  const code = uuidv4()
  // Notice that we can reach the server instance with request.server
  // Furthermore, you can attach objects to server.app to make them
  // available in all your routes.
  //
  // If you remember the earlier example we called server.cache() to
  // create a in-memory store before attaching it to server.app.
  // Shazam, we have it available in a route without requiring a module.
  await request.server.app.tokenStore.set(code, {
    redirect_uri,
    client_id,
    me,
    scope
  })
  return h.redirect(
    // In addition to server.app you can also use server.methods to
    // make commonly used functions available throughout your app. As
    // an added bonus it comes with caching built-in.
    request.server.methods.createStatefulUrl({
      url: redirect_uri,
      state: { code, state }
    })
  )
}

module.exports = {
  authorizeCreationOfAuthorizationCode
  // ... other related handlers ...
}