deploy: POST /api/wallets + full swagger

apps/api/src/app.ts

@@ -8,8 +8,10 @@ import { swaggerSpec } from './config/swagger';
 import { traceMiddleware } from './middleware/trace';
 import { authMiddleware } from './middleware/auth';
 import { csrfMiddleware } from './middleware/csrf';
+import { globalLimiter, mutateLimiter, sensitiveLimiter } from './middleware/rate-limit';
 import { errorHandler } from './middleware/error-handler';
 import walletRoutes from './routes/wallet.routes';
+import vaultRoutes from './routes/vault.routes';
 import relayProxyRoutes from './routes/relay-proxy.routes';
 import tronProxyRoutes from './routes/tron-proxy.routes';
 import solSwapProxyRoutes from './routes/sol-swap-proxy.routes';
@@ -19,9 +21,17 @@ import bscSwapProxyRoutes from './routes/bsc-swap-proxy.routes';
 
 const app = express();
 
+// Trust proxy для корректного req.ip за reverse proxy / load balancer
+app.set('trust proxy', 1);
+
 app.use(helmet());
-app.use(cors({ origin: env.cors.origins, credentials: env.cors.allowCredentials }));
-app.use(express.json());
+app.use(
+  cors({
+    origin: env.cors.origins.length > 0 ? env.cors.origins : false,
+    credentials: env.cors.allowCredentials,
+  }),
+);
+app.use(express.json({ limit: '64kb' })); // защита от больших payload-DoS
 app.use(cookieParser());
 app.use(traceMiddleware);
 
@@ -35,16 +45,24 @@ app.get('/api/docs/swagger.json', (_req, res) => {
   res.json(swaggerSpec);
 });
 
-// ── PROTECTED endpoints (JWT + CSRF for mutating methods) ────────────────────
+// ── Глобальный rate limit на весь API после public endpoints ────────────────
+app.use('/api', globalLimiter);
+
+// ── PROTECTED endpoints (JWT + CSRF) ─────────────────────────────────────────
 const protect = [authMiddleware, csrfMiddleware];
 
-app.use('/api/wallets', ...protect, walletRoutes);
-app.use('/api/relay', ...protect, relayProxyRoutes);
-app.use('/api/tron', ...protect, tronProxyRoutes);
-app.use('/api/sol/swap', ...protect, solSwapProxyRoutes);
-app.use('/api/tron/swap', ...protect, tronSwapProxyRoutes);
-app.use('/api/btc', ...protect, btcProxyRoutes);
-app.use('/api/bsc/swap', ...protect, bscSwapProxyRoutes);
+// Sensitive (send / vault) — самый строгий лимит
+app.use('/api/wallets/:chain/send', ...protect, sensitiveLimiter);
+app.use('/api/vault', ...protect, sensitiveLimiter, vaultRoutes);
+
+// Mutating (создание кошельков / broadcast / build) — повышенный лимит
+app.use('/api/wallets', ...protect, mutateLimiter, walletRoutes);
+app.use('/api/relay', ...protect, mutateLimiter, relayProxyRoutes);
+app.use('/api/tron', ...protect, mutateLimiter, tronProxyRoutes);
+app.use('/api/sol/swap', ...protect, mutateLimiter, solSwapProxyRoutes);
+app.use('/api/tron/swap', ...protect, mutateLimiter, tronSwapProxyRoutes);
+app.use('/api/btc', ...protect, mutateLimiter, btcProxyRoutes);
+app.use('/api/bsc/swap', ...protect, mutateLimiter, bscSwapProxyRoutes);
 
 app.use(errorHandler);