app.js

const express = require('express');
const http = require('http');
const socketio = require('socket.io');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const path = require('path');

const app = express();
const server = http.createServer(app);
const io = socketio(server);

// Security headers
app.use(helmet({
    contentSecurityPolicy: {
        directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'", "'unsafe-inline'", "https://cdnjs.cloudflare.com"],
            styleSrc: ["'self'", "'unsafe-inline'"],
            connectSrc: ["'self'", "ws:", "wss:"]
        }
    },
    crossOriginEmbedderPolicy: false
}));

// Rate limiting for HTTP requests
const limiter = rateLimit({
    windowMs: 1 * 60 * 1000, // 1 minute
    max: 100 // limit each IP to 100 requests per windowMs
});
app.use(limiter);

app.use(express.static('public'));

// Restrict CORS to same origin
app.use((req, res, next) => {
    const allowedOrigins = [req.headers.origin];
    if (allowedOrigins.includes(req.headers.origin)) {
        res.header('Access-Control-Allow-Origin', req.headers.origin);
    }
    res.header('Access-Control-Allow-Methods', 'GET, POST');
    res.header('Access-Control-Allow-Headers', 'Content-Type');
    next();
});

app.get('/', (req, res) => {
    res.sendFile(path.join(__dirname, 'public', 'index.html'));
});

app.get('/room/:id', (req, res) => {
    // Validate room ID
    const roomId = req.params.id;
    if (!/^[a-zA-Z0-9_-]{1,50}$/.test(roomId)) {
        return res.status(400).send('Invalid room ID');
    }
    res.sendFile(path.join(__dirname, 'public', 'room.html'));
})

// Socket.io rate limiting
const socketMessageLimiter = new Map();

io.on('connection', (socket) => {
    // Initialize rate limiter for this socket
    socketMessageLimiter.set(socket.id, {
        messages: 0,
        resetTime: Date.now() + 60000 // 1 minute
    });
    
    socket.on('join', (roomId) => {
        // Validate room ID
        if (typeof roomId !== 'string' || !/^[a-zA-Z0-9_-]{1,50}$/.test(roomId)) {
            return;
        }
        
        socket.join(roomId);

        const clients = io.sockets.adapter.rooms.get(roomId);
        io.to(roomId).emit('clients', clients.size);

        if (clients.size > 2) {
            io.to(roomId).emit('full-room');
        }

        io.to(roomId).emit('room-id', roomId);
    });

    socket.on('chat message', (msg, roomId) => {
        // Rate limiting check
        const limiter = socketMessageLimiter.get(socket.id);
        if (limiter) {
            if (Date.now() > limiter.resetTime) {
                limiter.messages = 0;
                limiter.resetTime = Date.now() + 60000;
            }
            
            if (limiter.messages >= 30) { // 30 messages per minute
                socket.emit('rate-limit', 'Too many messages. Please wait.');
                return;
            }
            limiter.messages++;
        }
        
        // Validate message
        if (typeof msg !== 'string' || msg.length > 5000) { // Max 5KB per message
            return;
        }
        
        // Validate room ID
        if (typeof roomId !== 'string' || !/^[a-zA-Z0-9_-]{1,50}$/.test(roomId)) {
            return;
        }
        
        const clients = io.sockets.adapter.rooms.get(roomId);
        if (!clients || clients.size > 2) {   
            io.to(socket.id).emit('full-room');
            return;
        }
        io.to(roomId).emit('chat message', msg);
    });
    
    socket.on('disconnect', () => {
        // Clean up rate limiter
        socketMessageLimiter.delete(socket.id);
    });
});
  
app.all('*', (req, res) => {
    res.status(404).send('<style>body { font-family: monospace; text-align: center; margin-top: 20%; }</style><h1>404 Not Found</h1>');
});

server.listen(process.env.PORT, () => {
    console.log('listening on *:3000');
});