server.js

// Core dependencies
const crypto = require('crypto');
const path = require('path');

// NPM dependencies
const bodyParser = require('body-parser');
const browserSync = require('browser-sync');
const dotenv = require('dotenv');
const express = require('express');
const nunjucks = require('nunjucks');
const session = require('express-session');

// Local dependencies
const config = require('./app/config.js');
const documentationRoutes = require('./docs/documentation_routes.js');
const packageJson = require('./package.json');
const routes = require('./app/routes.js');
const utils = require('./lib/utils.js');

const app = express();
const documentationApp = express();
dotenv.config();

// Set up configuration variables
var releaseVersion = packageJson.version;
var username = process.env.USERNAME;
var password = process.env.PASSWORD;
var env = process.env.NODE_ENV || 'development';
var useAuth = process.env.USE_AUTH || config.useAuth;
var useAutoStoreData =
  process.env.USE_AUTO_STORE_DATA || config.useAutoStoreData;
var useHttps = process.env.USE_HTTPS || config.useHttps;
var useBrowserSync = config.useBrowserSync;
var analyticsId = process.env.ANALYTICS_TRACKING_ID;
var gtmId = process.env.GOOGLE_TAG_MANAGER_TRACKING_ID;

env = env.toLowerCase();
useAuth = useAuth.toLowerCase();
useHttps = useHttps.toLowerCase();
useBrowserSync = useBrowserSync.toLowerCase();

var useDocumentation = config.useDocumentation === 'true';

// Promo mode redirects the root to /docs - so our landing page is docs when published on heroku
var promoMode = process.env.PROMO_MODE || 'false';
promoMode = promoMode.toLowerCase();

// Disable promo mode if docs aren't enabled
if (!useDocumentation) promoMode = 'false';

// Force HTTPS on production. Do this before using basicAuth to avoid
// asking for username/password twice (for `http`, then `https`).
var isSecure = env === 'production' && useHttps === 'true';
if (isSecure) {
  app.use(utils.forceHttps);
  app.set('trust proxy', 1); // needed for secure cookies on heroku
}

// Ask for username and password on production
if (env === 'production' && useAuth === 'true') {
  app.use(utils.basicAuth(username, password));
}

// Set up App
var appViews = [
  path.join(__dirname, '/app/views/'),
  path.join(__dirname, '/lib/'),
  path.join(__dirname, '/node_modules/govuk-frontend'), // template path
  path.join(__dirname, '/node_modules/govuk-frontend/components')
];

var nunjucksAppEnv = nunjucks.configure(appViews, {
  autoescape: true,
  express: app,
  noCache: true,
  watch: true
});

// Add Nunjucks filters
utils.addNunjucksFilters(nunjucksAppEnv);

// Set views engine
app.set('view engine', 'html');

// Middleware to serve static assets
app.use(
  '/assets',
  express.static(path.join(__dirname, '/node_modules/govuk-frontend/assets'))
);
app.use('/public', express.static(path.join(__dirname, '/public')));

// load govuk-frontend 'all' js
app.use(
  '/public/javascripts',
  express.static(path.join(__dirname, '/node_modules/govuk-frontend'))
);

// hightlightJS styles
app.use(
  '/public/vendor/highlight',
  express.static(path.join(__dirname, '/node_modules/highlight.js/styles'))
);

// Set up documentation app
if (useDocumentation) {
  var documentationViews = [
    path.join(__dirname, '/docs/views/'),
    path.join(__dirname, '/lib/'),
    path.join(__dirname, '/node_modules/govuk-frontend'), // template path
    path.join(__dirname, '/node_modules/govuk-frontend/components')
  ];

  var nunjucksDocumentationEnv = nunjucks.configure(documentationViews, {
    autoescape: true,
    express: documentationApp,
    noCache: true,
    watch: true
  });
  // Nunjucks filters
  utils.addNunjucksFilters(nunjucksDocumentationEnv);

  // Set views engine
  documentationApp.set('view engine', 'html');
}

// Support for parsing data in POSTs
app.use(bodyParser.json());
app.use(
  bodyParser.urlencoded({
    extended: true
  })
);

// Add global variable to determine if DoNotTrack is enabled.
// This indicates a user has explicitly opted-out of tracking.
// Therefore we can avoid injecting third-party scripts that do not respect this decision.
app.use(function(req, res, next) {
  // See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT
  app.locals.doNotTrackEnabled = req.header('DNT') === '1';
  next();
});

app.locals.analyticsId = analyticsId;
app.locals.gtmId = gtmId;
app.locals.asset_path = '/public/';
app.locals.useAutoStoreData = useAutoStoreData === 'true';
app.locals.cookieText = config.cookieText;
app.locals.promoMode = promoMode;
app.locals.releaseVersion = 'v' + releaseVersion;
app.locals.serviceName = config.serviceName;

// Support session data
app.use(
  session({
    cookie: {
      maxAge: 1000 * 60 * 60 * 4, // 4 hours
      secure: isSecure
    },
    // use random name to avoid clashes with other prototypes
    name: 'govuk-prototype-kit-' + crypto.randomBytes(64).toString('hex'),
    resave: false,
    saveUninitialized: false,
    secret: crypto.randomBytes(64).toString('hex')
  })
);

// Automatically store all data users enter
if (useAutoStoreData === 'true') {
  app.use(utils.autoStoreData);
  utils.addCheckedFunction(nunjucksAppEnv);
  utils.addCheckedFunction(nunjucksDocumentationEnv);
}

// Clear all data in session if you open /prototype-admin/clear-data
app.get('/prototype-admin/clear-data', function(req, res) {
  req.session.destroy();
  res.render('prototype-admin/clear-data');
});

// Send another email when link clicked
// app.get('/request-another-email', function(req, res) {
//   console.log(req.session.data.email);
//   res.redirect('back');
// });

// Redirect root to /docs when in promo mode.
if (promoMode === 'true') {
  console.log('Prototype Kit running in promo mode');

  app.locals.cookieText =
    'GOV.UK uses cookies to make the site simpler. <a href="/docs/cookies">Find out more about cookies</a>';

  app.get('/', function(req, res) {
    res.redirect('/docs');
  });

  // Allow search engines to index the Prototype Kit promo site
  app.get('/robots.txt', function(req, res) {
    res.type('text/plain');
    res.send('User-agent: *\nAllow: /');
  });
} else {
  // Prevent search indexing
  app.use(function(req, res, next) {
    // Setting headers stops pages being indexed even if indexed pages link to them.
    res.setHeader('X-Robots-Tag', 'noindex');
    next();
  });

  app.get('/robots.txt', function(req, res) {
    res.type('text/plain');
    res.send('User-agent: *\nDisallow: /');
  });
}

// Load routes (found in app/routes.js)
if (typeof routes !== 'function') {
  console.log(routes.bind);
  console.log(
    'Warning: the use of bind in routes is deprecated - please check the Prototype Kit documentation for writing routes.'
  );
  routes.bind(app);
} else {
  app.use('/', routes);
}

// Redirect to the zip of the latest release of the Prototype Kit on GitHub
app.get('/prototype-admin/download-latest', function(req, res) {
  var url = utils.getLatestRelease();
  res.redirect(url);
});

if (useDocumentation) {
  // Copy app locals to documentation app locals
  documentationApp.locals = Object.assign({}, app.locals);
  documentationApp.locals.serviceName = 'Prototype Kit';

  // Create separate router for docs
  app.use('/docs', documentationApp);

  // Docs under the /docs namespace
  documentationApp.use('/', documentationRoutes);
}

// Strip .html and .htm if provided
app.get(/\.html?$/i, function(req, res) {
  var path = req.path;
  var parts = path.split('.');
  parts.pop();
  path = parts.join('.');
  res.redirect(path);
});

// Auto render any view that exists

// App folder routes get priority
app.get(/^\/([^.]+)$/, function(req, res) {
  utils.matchRoutes(req, res);
});

if (useDocumentation) {
  // Documentation  routes
  documentationApp.get(/^\/([^.]+)$/, function(req, res) {
    if (!utils.matchMdRoutes(req, res)) {
      utils.matchRoutes(req, res);
    }
  });
}

// Redirect all POSTs to GETs - this allows users to use POST for autoStoreData
app.post(/^\/([^.]+)$/, function(req, res) {
  res.redirect('/' + req.params[0]);
});

console.log('\nGOV.UK Prototype Kit v' + releaseVersion);
console.log(
  '\nNOTICE: the kit is for building prototypes, do not use it for production services.'
);

// Find a free port and start the server
utils.findAvailablePort(app, function(port) {
  console.log('Listening on port ' + port + '   url: http://localhost:' + port);
  if (env === 'production' || useBrowserSync === 'false') {
    app.listen(port);
  } else {
    app.listen(port - 50, function() {
      browserSync({
        proxy: 'localhost:' + (port - 50),
        port: port,
        ui: false,
        files: ['public/**/*.*', 'app/views/**/*.*'],
        ghostmode: false,
        open: false,
        notify: false,
        logLevel: 'error'
      });
    });
  }
});

module.exports = app;