Merge pull request #23 from ShieldTech-Ltd/fix/vercel-proxy-rate-limit

fix: trust Vercel proxy for API rate limiting

Author: TFT444

server.js

@@ -11,6 +11,7 @@ const path = require('path');
 
 // Middleware
 app.disable('x-powered-by');
+app.set('trust proxy', 1);
 app.use(helmet({ contentSecurityPolicy: false, crossOriginEmbedderPolicy: false }));
 app.use(express.json({ limit: '32kb' }));
 app.use('/api/', rateLimit({ windowMs: 60_000, limit: 120, standardHeaders: 'draft-7', legacyHeaders: false }));
@@ -375,6 +376,7 @@ app.use((req, res) => res.status(404).json({ error: 'Not found' }));
 app.use((error, req, res, next) => {
     console.error(error.message);
     if (res.headersSent) return next(error);
+    if (error.type === 'entity.parse.failed') return res.status(400).json({ error: 'Invalid JSON body' });
     return res.status(502).json({ error: 'Upstream service unavailable' });
 });
 

test/api.test.js

@@ -22,6 +22,11 @@ test('validates scanner and payslip input', async () => {
     await request(app).post('/api/v1/payslip/decode').send({ grossSalary: -1, pensionRate: 5 }).expect(400);
 });
 
+test('returns 400 for malformed JSON', async () => {
+    await request(app).post('/api/v1/scan')
+        .set('Content-Type', 'application/json').send('{broken').expect(400, { error: 'Invalid JSON body' });
+});
+
 test('caption analysis is explicitly not OCR', async () => {
     const response = await request(app).post('/api/v1/scan/ocr')
         .send({ rawCaption: 'Guaranteed 50x leverage returns' }).expect(200);