feat: render announcements on dashboard

server/package.json

@@ -16,6 +16,7 @@
   "license": "ISC",
   "packageManager": "pnpm@10.12.3",
   "dependencies": {
+    "@fastify/cors": "11.0.1",
     "@nhcarrigan/logger": "1.0.0",
     "@prisma/client": "6.11.1",
     "fastify": "5.4.0"

server/src/hooks/cors.ts

@@ -17,11 +17,13 @@ export const corsHook: onRequestHookHandler = async(request, response) => {
   if (!request.url.startsWith("/submit")) {
     return undefined;
   }
-  if (request.headers.origin !== "https://forms.nhcarrigan.com") {
+  if (request.headers.origin !== "http://localhost:4200"
+      && request.headers.origin !== "https://hikari.nhcarrigan.com") {
+    console.log(request);
     return await response.
       status(403).
       send({
-        error: "Forms can only be submitted through our website. Thanks.",
+        error: "This route is only accessible from our dashboard at https://hikari.nhcarrigan.com.",
       });
   }
   return undefined;

server/src/index.ts

@@ -4,6 +4,7 @@
  * @author Naomi Carrigan
  */
 
+import cors from "@fastify/cors";
 import fastify from "fastify";
 import { corsHook } from "./hooks/cors.js";
 import { ipHook } from "./hooks/ips.js";
@@ -15,6 +16,17 @@ const server = fastify({
   logger: false,
 });
 
+/**
+ * This needs to be first, to ensure all requests have CORS configured.
+ * Our CORS settings allow for any origin, because we have a custom hook
+ * that guards specific routes from CORS requests.
+ * This is to allow our uptime monitor to access the health check route, for example.
+ * @see routesWithoutCors.ts
+ */
+server.register(cors, {
+  origin: "*",
+});
+
 server.addHook("preHandler", corsHook);
 server.addHook("preHandler", ipHook);
 

server/src/routes/announcement.ts

@@ -28,7 +28,14 @@ export const announcementRoutes: FastifyPluginAsync = async(server) => {
       take: 10,
     });
     return await reply.status(200).type("application/json").
-      send(announcements);
+      send(announcements.map((announcement) => {
+        return {
+          content:   announcement.content,
+          createdAt: announcement.createdAt,
+          title:     announcement.title,
+          type:      announcement.type,
+        };
+      }));
   });
 
   // eslint-disable-next-line @typescript-eslint/naming-convention -- Fastify requires Body instead of body.