ntp&modercontent_front

backend/package-lock.json

@@ -12,6 +12,8 @@
         "cors": "^2.8.5",
         "dotenv": "^17.2.1",
         "express": "^5.1.0",
+        "express-rate-limit": "^8.6.2",
+        "helmet": "^8.3.0",
         "mammoth": "^1.9.1",
         "mysql2": "^3.14.2",
         "node-cron": "^4.2.1",
@@ -598,6 +600,25 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/express-rate-limit": {
+      "version": "8.6.2",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.6.2.tgz",
+      "integrity": "sha512-YH4ru+eOJxQABscKFfRCy9R7x9QFGdezclVMwwgFFndzS2Xnm0uo6B0ABZsLhcpeptGv2qvuJVWlQr9gQZoC3A==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "ip-address": "^10.2.0"
+      },
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/express-rate-limit"
+      },
+      "peerDependencies": {
+        "express": ">= 4.11"
+      }
+    },
     "node_modules/fecha": {
       "version": "4.2.3",
       "resolved": "https://registry.npmjs.org/fecha/-/fecha-4.2.3.tgz",
@@ -791,6 +812,18 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/helmet": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.3.0.tgz",
+      "integrity": "sha512-Qgpiaws3Sm30Av8Eah6sjMCZZwjlBu+E68rhpCWBshY1lb09HtLwj5GviX0OyQIn+ulUS0iX0AxN5n3tLZzz1w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/EvanHahn"
+      }
+    },
     "node_modules/http-errors": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
@@ -846,6 +879,15 @@
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
+    "node_modules/ip-address": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz",
+      "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
     "node_modules/ipaddr.js": {
       "version": "1.9.1",
       "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",

backend/package.json

@@ -15,6 +15,8 @@
     "cors": "^2.8.5",
     "dotenv": "^17.2.1",
     "express": "^5.1.0",
+    "express-rate-limit": "^8.6.2",
+    "helmet": "^8.3.0",
     "mammoth": "^1.9.1",
     "mysql2": "^3.14.2",
     "node-cron": "^4.2.1",

backend/src/routes/employee.js

@@ -21,7 +21,7 @@ async function readJson(filePath) {
 /**
  * Получение mock-данных сотрудника из config.json
  */
-async function getMockEmployee(searchParam, type = 'card') {
+async function getMockEmployee(searchParam) {
     try {
         const configPath = path.join(__dirname, '../../config.json');
         const config = await readJson(configPath);
@@ -31,14 +31,20 @@ async function getMockEmployee(searchParam, type = 'card') {
         }
         
         const mockEmployees = config.mockData.employees || [];
+        const paramStr = String(searchParam);
         
-        if (type === 'card') {
-            return mockEmployees.find(e => String(e.cardNumber) === String(searchParam)) || null;
-        } else if (type === 'id') {
-            return mockEmployees.find(e => e.id === parseInt(searchParam)) || null;
+        // Сначала пробуем найти по cardNumber (как строка, без приведения)
+        let employee = mockEmployees.find(e => String(e.cardNumber) === paramStr);
+        
+        // Если не нашли — пробуем по id (как число)
+        if (!employee) {
+            const paramNum = parseInt(paramStr);
+            if (!isNaN(paramNum)) {
+                employee = mockEmployees.find(e => e.id === paramNum);
+            }
         }
         
-        return null;
+        return employee || null;
     } catch (err) {
         logger.error('[MOCK ERROR]', { error: err.message });
         return null;

backend/src/server.js

@@ -6,7 +6,13 @@ const { connectDB } = require('./config/db');
 const { logger } = require('./config/logger');
 const handbookRoutes = require('./routes/handbook');
 const employeeRoutes = require('./routes/employee');
+const helmet = require('helmet');
+const rateLimit = require('express-rate-limit');
 require('dotenv').config({ path: path.join(__dirname, '../config.env') });
+const limiter = rateLimit({
+    windowMs: 15 * 60 * 1000,
+    max: 100
+});
 
 async function readJson(filePath) {
     const data = await fs.readFile(filePath, 'utf8');
@@ -58,11 +64,20 @@ async function connectToNetworkShare(config) {
 const app = express();
 app.use(cors());
 app.use(express.json());
+app.use((req, res, next) => {
+    if (req.method === 'POST' || req.method === 'PUT') {
+        if (!req.is('application/json')) {
+            return res.status(415).json({ message: 'Only JSON allowed' });
+        }
+    }
+    next();
+});
 
 // ============================================
 // 📍 Маршруты API
 // ============================================
-
+app.use(helmet());
+app.use('/api/', limiter);
 app.use('/api/handbook', handbookRoutes);
 app.use('/api/employee', employeeRoutes);
 
@@ -320,7 +335,12 @@ app.get('/api/db-status', async (req, res) => {
         res.status(500).json({ status: 'error', message: 'DB connection failed' });
     }
 });
-
+app.get('/api/time', (req, res) => {
+    res.json({
+        time: new Date().toISOString(),
+        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone
+    });
+});
 async function startServer() {
     try {
         const configPath = path.join(__dirname, '../config.json');
@@ -328,6 +348,14 @@ async function startServer() {
         const { host, port } = config.server;
 
         await connectDB();
+app.get('/api/time', (req, res) => {
+    const now = new Date();
+    logger.info(`[TIME] Запрос времени от ${req.ip || req.connection.remoteAddress}`);
+    res.json({
+        time: now.toISOString(),
+        timestamp: now.getTime()
+    });
+});
         app.listen(port, host, () => {
             logger.info(`Server is running on http://${host}:${port}`);
         });
@@ -339,5 +367,8 @@ async function startServer() {
         }
     }
 }
-
+app.use((err, req, res, next) => {
+    logger.error('Unhandled error', { error: err.message, stack: err.stack });
+    res.status(500).json({ message: 'Внутренняя ошибка сервера' });
+});
 startServer();