GATE Improve with type safety and reorganize into smaller files

[codastream]

User story

AS A dev, I WOULD LIKE to secure gateway service, so that

• error debugging becomes easier
• linting issues in CI can be progressively enabled
• develop features more quickly

Potential issues

code

• typing (cf ESLint)

• code readability
  -> have separate files utils/error-handler.ts, etc

• many defensive syntax for env : process?.xxx
  -> validate and export env var with envalid or another lib

websockets

• gateway is parsing websocket messages to check type
  -> this should be done by real consumer (frontend)

controllers

• manual reconstruction of URL + copy of headers

logger

-> harmonize logging pattern in prevision of ELK - cf https://github.com/users/codastream/projects/3?pane=issue&itemId=145595477

-> move logging to http-proxy hooks (onResponse, onError, ...)

routing

• fetch vs proxying : use of app.decorate('fetchInternal', ...) or fetch in proxy.ts

  • awaits answer before sending -> risk of latency
  • buffering into Node memory -> risk of resource overload if large payloads are sent or many users connected
    -> @fastify/http-proxy could handle some of gateway logic (prefixing, request tracking, pre handlers if some route have role based access control, ...)

• public route matching -> includes(url) is fragile if public url contains query params
  -> split on ?

• hardcoded CORS -> can break on deployment

security

• rate limit detection -> does request.ip point really to client or docker internal router in keyGenerator: (req) => req.ip ?
  -> enable trustProxy ?

• token verification is manual
  -> check if fastify-jwt plugin is allowed

misc

• app.listen -> should be guarded during tests

Example of structure after reorg

src/
├── index.ts                    # Entry point only (app creation + start)
├── config/
│   ├── env.ts 
│   ├── cors.ts 
│   ├── logger-config.ts 
│   └── rate-limit.ts 
├── middleware/
│   ├── auth.ts
│   └── logging.ts
├── routes/
│   ├── health.ts                    
│   ├── public-routes.ts 
│   └── internal-routes.ts
├── proxy/
│   ├── proxy-handler.ts
│   ├── websocket-proxy.ts
│   └── route-matcher.ts
├── utils/
│   ├── error-handler.ts
│   └── logger.ts
└── types/
    └── types.ts

Acceptance criterias

• reorganize structure
• env variable validation
• no ESLint error
• reduce size of proxy.ts and rely on fastify plugin
• http requests are streamed, not buffered
• websockets are proxied without JSON.parse

nice to have

• standardized logging
• trustProxy
• externalized CORS config
• improved public routes matching
• unit tests

Subtasks

• setup envalid
• Install @fastify/http-proxy
• extract
• refactor apiRoutes to register proxies instead of controllers
• test : check that public and internal routes work