Initial commit: STL Storage Application

- Complete web-based STL file storage and 3D viewer
- Express.js backend with SQLite database
- Interactive Three.js 3D viewer with orbit controls
- File upload with drag-and-drop support
- Security features: rate limiting, input validation, helmet
- Container deployment with Docker/Podman
- Production-ready configuration management
- Comprehensive logging and monitoring

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

config/config.js

@@ -0,0 +1,46 @@
+require('dotenv').config();
+
+const config = {
+    // Server configuration
+    port: parseInt(process.env.PORT) || 3000,
+    host: process.env.HOST || '0.0.0.0',
+    nodeEnv: process.env.NODE_ENV || 'development',
+    
+    // Database configuration
+    database: {
+        path: process.env.DB_PATH || './stl_storage.db',
+        uploadDir: process.env.UPLOAD_DIR || './uploads'
+    },
+    
+    // File upload configuration
+    upload: {
+        maxFileSize: parseInt(process.env.MAX_FILE_SIZE) || 100 * 1024 * 1024, // 100MB
+        maxFiles: parseInt(process.env.MAX_FILES_PER_REQUEST) || 5,
+        allowedExtensions: (process.env.ALLOWED_EXTENSIONS || '.stl,.STL').split(','),
+        destination: './uploads/stl'
+    },
+    
+    // Security configuration
+    security: {
+        sessionSecret: process.env.SESSION_SECRET || 'change-this-secret-key',
+        bcryptRounds: parseInt(process.env.BCRYPT_ROUNDS) || 12,
+        rateLimitWindow: parseInt(process.env.RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
+        rateLimitMax: parseInt(process.env.RATE_LIMIT_MAX_REQUESTS) || 100
+    },
+    
+    // Logging configuration
+    logging: {
+        level: process.env.LOG_LEVEL || 'info',
+        file: process.env.LOG_FILE || './logs/app.log'
+    }
+};
+
+// Validate required configuration
+const requiredEnvVars = [];
+const missingVars = requiredEnvVars.filter(varName => !process.env[varName]);
+
+if (missingVars.length > 0) {
+    throw new Error(`Missing required environment variables: ${missingVars.join(', ')}`);
+}
+
+module.exports = config;

config/logger.js

@@ -0,0 +1,47 @@
+const winston = require('winston');
+const path = require('path');
+const fs = require('fs');
+
+// Ensure logs directory exists
+const logDir = path.join(__dirname, '..', 'logs');
+if (!fs.existsSync(logDir)) {
+    fs.mkdirSync(logDir, { recursive: true });
+}
+
+const logLevel = process.env.LOG_LEVEL || 'info';
+const logFile = process.env.LOG_FILE || path.join(logDir, 'app.log');
+
+const logger = winston.createLogger({
+    level: logLevel,
+    format: winston.format.combine(
+        winston.format.timestamp(),
+        winston.format.errors({ stack: true }),
+        winston.format.json()
+    ),
+    defaultMeta: { service: 'stl-storage' },
+    transports: [
+        new winston.transports.File({ 
+            filename: path.join(logDir, 'error.log'), 
+            level: 'error',
+            maxsize: 5242880, // 5MB
+            maxFiles: 5
+        }),
+        new winston.transports.File({ 
+            filename: logFile,
+            maxsize: 5242880, // 5MB
+            maxFiles: 5
+        })
+    ]
+});
+
+// Add console transport for development
+if (process.env.NODE_ENV !== 'production') {
+    logger.add(new winston.transports.Console({
+        format: winston.format.combine(
+            winston.format.colorize(),
+            winston.format.simple()
+        )
+    }));
+}
+
+module.exports = logger;

config/security.js

@@ -0,0 +1,69 @@
+const rateLimit = require('express-rate-limit');
+const helmet = require('helmet');
+const { body, param, query } = require('express-validator');
+
+// Rate limiting configuration
+const createRateLimit = (windowMs = 15 * 60 * 1000, max = 100) => rateLimit({
+    windowMs,
+    max,
+    message: 'Too many requests from this IP, please try again later.',
+    standardHeaders: true,
+    legacyHeaders: false,
+});
+
+// API rate limits
+const apiLimiter = createRateLimit(
+    parseInt(process.env.RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000, // 15 minutes
+    parseInt(process.env.RATE_LIMIT_MAX_REQUESTS) || 100
+);
+
+// Stricter rate limit for uploads
+const uploadLimiter = createRateLimit(
+    15 * 60 * 1000, // 15 minutes
+    10 // 10 uploads per window
+);
+
+// Security headers configuration
+const securityHeaders = helmet({
+    contentSecurityPolicy: {
+        directives: {
+            defaultSrc: ["'self'"],
+            styleSrc: ["'self'", "'unsafe-inline'"],
+            scriptSrc: ["'self'", "https://cdn.jsdelivr.net", "https://unpkg.com"],
+            imgSrc: ["'self'", "data:", "blob:"],
+            connectSrc: ["'self'"],
+            fontSrc: ["'self'"],
+            objectSrc: ["'none'"],
+            mediaSrc: ["'self'"],
+            frameSrc: ["'none'"],
+        },
+    },
+    crossOriginEmbedderPolicy: false, // Required for Three.js
+});
+
+// Input validation schemas
+const fileValidation = [
+    body('description').optional().isLength({ max: 500 }).trim().escape(),
+    body('tags').optional().isLength({ max: 200 }).trim(),
+    body('printSettings').optional().isJSON(),
+    body('dimensions').optional().isJSON(),
+];
+
+const fileIdValidation = [
+    param('id').isInt({ min: 1 }).withMessage('Valid file ID required')
+];
+
+const searchValidation = [
+    query('search').optional().isLength({ max: 100 }).trim().escape(),
+    query('limit').optional().isInt({ min: 1, max: 100 }).withMessage('Limit must be between 1 and 100'),
+    query('offset').optional().isInt({ min: 0 }).withMessage('Offset must be non-negative')
+];
+
+module.exports = {
+    apiLimiter,
+    uploadLimiter,
+    securityHeaders,
+    fileValidation,
+    fileIdValidation,
+    searchValidation
+};