API Security & Middleware

Relevant source files

The following files were used as context for generating this wiki page:

• backend/src/interfaces/http/middleware/validation.middleware.ts
• backend/src/app.ts
• src/middleware/auth.js
• server.js
• infrastructure/nginx/nginx.conf
• backend/src/config/index.ts

API Security & Middleware in AtlasCleanAI Enterprise comprises a multi-layered defense system protecting the platform's core services. The system implements request filtering, authentication, rate limiting, and input validation to ensure operational integrity and data security for customer, cleaner, and management applications. Sources: README.md, backend/src/app.ts

The middleware stack operates at both the infrastructure level (via NGINX) and the application level (Express.js). It enforces security principles such as TLS termination, least-privilege access, and automated vulnerability protection. Sources: README.md, infrastructure/nginx/nginx.conf

Request Processing Flow

The platform processes incoming requests through a sequential pipeline of security and utility middleware before they reach the application logic. Sources: backend/src/app.ts:200-215, server.js:15-30

The diagram above illustrates the multi-tier validation a request undergoes, starting from the external edge down to the specific route handler. Sources: backend/src/app.ts, infrastructure/nginx/nginx.conf

Infrastructure Security

Security begins at the ingress layer. NGINX handles TLS termination and provides an initial layer of request throttling. Sources: infrastructure/nginx/nginx.conf:81-125

NGINX Configuration

The reverse proxy enforces several security headers and limits:

• TLS Protocol: Enforces TLSv1.2 and TLSv1.3 for encrypted communication.
• Rate Limiting: Uses a shared memory zone (api_limit) to restrict requests to 20 per second per IP with a burst of 40.
• Security Headers: Adds X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a strict Content-Security-Policy.
• Request Size: Limits client body size to 20MB.

Sources: infrastructure/nginx/nginx.conf:23, infrastructure/nginx/nginx.conf:45-50, infrastructure/nginx/nginx.conf:118-123

Application Middleware

The Express.js application integrates several standard and custom middleware components to harden the API. Sources: backend/src/app.ts:200-210

Middleware Component	Implementation / Package	Purpose
Helmet	helmet()	Sets various HTTP headers to prevent common attacks like Clickjacking and XSS.
CORS	cors()	Controls cross-origin resource sharing based on config.clientUrl.
Compression	compression()	Compresses response bodies to improve performance.
JSON Parser	express.json({ limit: '1mb' })	Limits JSON payload size to prevent memory exhaustion.
Rate Limiter	apiRateLimiter	Prevents brute-force and DoS attacks at the application level.

Sources: backend/src/app.ts:202-212, backend/package.json:34-40

Authentication & Authorization

The system employs different authentication strategies depending on the service type. Sources: backend/src/app.ts:197, src/middleware/auth.js:8

JWT Authentication

For standard business operations (bookings, payments, AI services), the system uses createAuthMiddleware. This middleware validates Bearer tokens using JwtService. Sources: backend/src/app.ts:197, backend/src/app.ts:228-235

API Key Authentication

For Atlas AI chat endpoints, a specific apiKeyAuth middleware is used. It checks for an x-api-key header. Sources: src/middleware/auth.js:8-12

• Logic: If ATLAS_API_KEY is not set in the environment, authentication is skipped (development mode).
• Security: Uses timingSafeEqual to compare the provided key with the configured key, preventing timing attacks.
• Failure: Returns a 401 Unauthorized status if the key is missing or invalid.

Sources: src/middleware/auth.js:14-27

Data Validation

AtlasCleanAI Enterprise uses schema-based validation to ensure all incoming data conforms to expected formats before processing. Sources: backend/src/interfaces/http/middleware/validation.middleware.ts:6-10

Schema Validation Middleware

The validate function creates a middleware that:

1. Takes a Zod schema and a source (body, query, or params).
2. Passes the data to the validateSchema utility.
3. Assigns the parsed (and stripped) result back to the request object.
4. Triggers the error handler if validation fails.

Sources: backend/src/interfaces/http/middleware/validation.middleware.ts:6-15

Chat Validation

The Atlas AI module includes specialized validation for conversation history. Sources: src/validation/chat.js:5-10

Constraint	Value	Source
MAX_MESSAGES	20	src/validation/chat.js:1
MAX_MESSAGE_LENGTH	4,000 characters	src/validation/chat.js:2
MAX_TOTAL_CONTENT	16,000 characters	src/validation/chat.js:3

The validateMessages function checks that the input is a non-empty array and that every message contains a valid role (user or assistant) and non-empty content. Sources: src/validation/chat.js:11-20

Summary

The API Security & Middleware architecture provides a comprehensive defense-in-depth strategy. By combining infrastructure-level throttling in NGINX, application-level security headers via Helmet, and strict schema validation with Zod and custom chat logic, the platform protects against both common web vulnerabilities and resource exhaustion. Sources: backend/src/app.ts, infrastructure/nginx/nginx.conf, src/validation/chat.js