fix(contorller): env corrections on where to look for the file when running

app/src/pkg/db/schema/servers.ts

@@ -0,0 +1,49 @@
+import {
+    boolean,
+    integer,
+    pgTable,
+    text,
+    timestamp,
+    uniqueIndex,
+    uuid,
+} from "drizzle-orm/pg-core";
+import { createInsertSchema, createSelectSchema } from "drizzle-zod";
+import z from "zod";
+
+export const serverData = pgTable(
+    "serverData",
+    {
+        server_id: uuid("server_id").defaultRandom().primaryKey(),
+        name: text("name").notNull(),
+        serverDNS: text("serverDNS").notNull(),
+        plantToken: text("plantToken").notNull(),
+        ipAddress: text("ipAddress").notNull(),
+        greatPlainsPlantCode: integer("greatPlainsPlantCode").notNull(),
+        streetAddress: text("streetAddress"),
+        cityState: text("cityState"),
+        zipcode: integer("zipcode"),
+        contactEmail: text("contactEmail"),
+        contactPhone: text("contactPhone"),
+        customerTiAcc: text("customerTiAcc"),
+        lstServerPort: integer("lstServerPort").notNull(),
+        active: boolean("active").default(true),
+        serverLoc: text("serverLoc").notNull(),
+        lastUpdated: timestamp("lastUpdated").defaultNow(),
+        isUpgrading: boolean("isUpgrading").default(false),
+    },
+
+    (table) => [
+        // uniqueIndex('emailUniqueIndex').on(sql`lower(${table.email})`),
+        uniqueIndex("plantToken").on(table.plantToken),
+    ]
+);
+
+export const selectServerDataSchema = createSelectSchema(serverData);
+
+export const insertServerDataSchema = createInsertSchema(serverData).extend({
+    contactEmail: z.email().optional(),
+    // zipcode: z
+    //     .string()
+    //     .regex(/^\d{5}$/)
+    //     .optional(),
+});

app/src/pkg/middleware/restrictToHosts.ts

@@ -0,0 +1,30 @@
+import type { Request, Response, NextFunction } from "express";
+
+/**
+ * Middleware to restrict access only to localhost or a whitelist of hosts.
+ */
+export function restrictToHosts(allowedHosts: string[] = []) {
+    return (req: Request, res: Response, next: NextFunction) => {
+        // `req.ip` gives the remote IP
+        const ip = req.ip!.replace("::ffff:", ""); // strip IPv6 prefix if present
+
+        // Express sets req.hostname from the Host header
+        const hostname = req.hostname;
+
+        const isLocal =
+            ip === "127.0.0.1" || ip === "::1" || hostname === "localhost";
+
+        const isAllowed =
+            isLocal ||
+            allowedHosts.includes(ip) ||
+            allowedHosts.includes(hostname);
+
+        if (!isAllowed) {
+            return res
+                .status(403)
+                .json({ error: "Access not allowed from this host" });
+        }
+
+        next();
+    };
+}