Add helmet package and base URL configuration

.env.example

@@ -12,3 +12,5 @@ OPENAI_API_KEY=
 OPENAI_MODEL=
 OPENAI_TEMPERATURE=
 OPENAI_MAX_TOKENS=
+
+BASE_URL=

package.json

@@ -29,6 +29,7 @@
     "dotenv": "^16.0.3",
     "express": "^4.18.2",
     "gpt3-tokenizer": "^1.1.5",
+    "helmet": "^7.1.0",
     "lodash": "^4.17.21",
     "mariadb": "^3.2.3",
     "mysql2": "^3.2.0",

src/config.ts

@@ -4,12 +4,17 @@ dotenv.config();
 
 const config = {
   bot: {
-    name: process.env.BOT_NAME || 'WumpusGPT',
+    name: process.env.BOT_NAME || 'Bocchi',
     instruction:
-      process.env.BOT_INSTRUCTION || 'You are WumpusGPT, a helpful assistant.',
+      process.env.BOT_INSTRUCTION || 'You are Bocchi, a helpful assistant.',
     invite_url: `https://discord.com/api/oauth2/authorize?client_id=${process.env.DISCORD_CLIENT_ID}&permissions=395137067008&scope=bot`,
     thread_prefix: process.env.BOT_THREAD_PREFIX || '💬',
     prune_interval: process.env.BOT_PRUNE_INTERVAL || 0,
+    base_url:
+      process.env.BASE_URL ||
+      (process.env.RAILWAY_PUBLIC_DOMAIN
+        ? `https://${process.env.RAILWAY_PUBLIC_DOMAIN}`
+        : 'http://localhost:3000'),
   },
   database: {
     url: process.env.DATABASE_URL,

src/index.ts

@@ -1,5 +1,6 @@
 import express from 'express';
 import bodyParser from 'body-parser';
+import helmet from 'helmet';
 import { Client } from '@biscxit/discord-module-loader';
 import { GatewayIntentBits } from 'discord.js';
 import config from '@/config';
@@ -11,11 +12,10 @@ import { registerRoutes } from '@/webhooks';
 import WebhookRoutes from './models/webhookRoutes';
 
 const isDev = process.argv.some((arg) => arg.includes('ts-node'));
-
 const app: express.Application = express();
-
 const port: number = parseInt(process.env.PORT || '3000');
 
+app.use(helmet());
 app.use(bodyParser.json());
 
 const client = new Client({

src/webhooks/index.ts

@@ -149,6 +149,17 @@ export async function registerRoutes(client: Client) {
 
   await Promise.all(routePromises);
 
+  router.all('*', (req, res) => {
+    const matchedRoute = router.stack.find(
+      (route) => route.route.path === req.path
+    );
+    if (matchedRoute && !matchedRoute.route.methods[req.method.toLowerCase()]) {
+      res.status(405).send('Method Not Allowed');
+    } else {
+      res.status(404).send('Not Found');
+    }
+  });
+
   const groupedRoutes = routes.reduce((acc, route) => {
     if (!acc[route.path]) {
       acc[route.path] = {};

src/webhooks/routes/railway.ts

@@ -5,27 +5,50 @@ export const path = '/railway';
 export const isProtected = true;
 export function post(client: Client) {
   return async function (req: Request, res: Response) {
-    const { type, timestamp, project, environment, deployment, meta } =
-      req.body;
-    const embed = new EmbedBuilder()
-      .setTitle('Railway Status')
-      .setColor(Colors.Purple)
-      .setDescription(
-        `A status of ${type} has been made to the ${project.name} project`
-      )
-      .addFields({ name: 'Environment', value: environment.name })
-      .addFields({ name: 'Deployed By', value: deployment.creator.name })
-      .setThumbnail(deployment.creator.avatar)
-      .setTimestamp(new Date(timestamp))
-      .setFooter({ text: 'Railway' });
+    try {
+      const { type, timestamp, project, environment, deployment, meta } =
+        req.body;
 
-    const channelId = req.query.channelId as string | undefined;
-    if (!channelId) {
-      res.status(400).send('Missing channelId');
-      return;
+      if (
+        typeof type !== 'string' ||
+        typeof timestamp !== 'string' ||
+        typeof project !== 'object' ||
+        typeof environment !== 'object' ||
+        typeof deployment !== 'object'
+      ) {
+        res.status(400).send('Invalid request body');
+        return;
+      }
+
+      const embed = new EmbedBuilder()
+        .setTitle('Railway Status')
+        .setColor(Colors.Purple)
+        .setDescription(
+          `A status of ${type} has been made to the ${project.name} project`
+        )
+        .addFields({ name: 'Environment', value: environment.name })
+        .addFields({ name: 'Deployed By', value: deployment.creator.name })
+        .setThumbnail(deployment.creator.avatar)
+        .setTimestamp(new Date(timestamp))
+        .setFooter({ text: 'Railway' });
+
+      const channelId = req.query.channelId as string | undefined;
+      if (!channelId) {
+        res.status(400).send('Missing channelId');
+        return;
+      }
+
+      const channel = (await client.channels.fetch(channelId)) as TextChannel;
+      if (!channel) {
+        res.status(404).send('Channel not found');
+        return;
+      }
+
+      channel.send({ embeds: [embed] });
+      res.send('OK');
+    } catch (error) {
+      console.error(error);
+      res.status(500).send('An error occurred');
     }
-    const channel = (await client.channels.fetch(channelId)) as TextChannel;
-    channel.send({ embeds: [embed] });
-    res.send('OK');
   };
 }