fix(security,architecture): harden Helmet CSP, CORS callback, cascade webhook...

fix(security,architecture): harden Helmet CSP, CORS callback, cascade webhook deactivation, and AuthService dependency injection

skills-lock.json

@@ -6,6 +6,12 @@
       "sourceType": "github",
       "skillPath": "skills/code-review-and-quality/SKILL.md",
       "computedHash": "6231479cc74c7ed70a5618b81b3f94034d9806c0319a1a23d15f9b94a368c581"
+    },
+    "security-audit": {
+      "source": "cloudflare/security-audit-skill",
+      "sourceType": "github",
+      "skillPath": "skills/security-audit/SKILL.md",
+      "computedHash": "02a15f2226610f8c9d23732b9f11fe64865f35b1c26cd0560db370f441e9a199"
     }
   }
 }

src/app.ts

@@ -19,7 +19,13 @@ const app = express();
 
 app.set("trust proxy", parseTrustProxy(envConfig.trustProxy));
 
-app.use(helmet());
+app.use((req, res, next) => {
+  if (req.path.startsWith("/api-docs")) {
+    return helmet({ contentSecurityPolicy: false })(req, res, next);
+  }
+  return helmet()(req, res, next);
+});
+
 app.use(
   cors({
     origin: (origin, callback) => {
@@ -27,7 +33,7 @@ app.use(
       if (envConfig.cors.allowedOrigins.includes(origin)) {
         return callback(null, true);
       }
-      return callback(new Error(`Origin ${origin} not allowed by CORS`));
+      return callback(null, false);
     },
     credentials: true,
     maxAge: 86400,
@@ -39,12 +45,7 @@ app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 
 app.use("/health", healthRoute);
-app.use(
-  "/api-docs",
-  helmet({ contentSecurityPolicy: false }),
-  swaggerUi.serve,
-  swaggerUi.setup(swaggerDocument),
-);
+app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerDocument));
 app.use("/api/v1", rateLimitMiddleware, routes);
 
 app.use(notFoundMiddleware);

src/modules/auth/auth.repository.ts

@@ -140,6 +140,11 @@ export class AuthRepository {
         where: { userId, isActive: true },
         data: { isActive: false },
       });
+
+      await tx.webhookConfig.updateMany({
+        where: { userId, isActive: true },
+        data: { isActive: false },
+      });
     });
   }
 }

src/modules/auth/auth.service.ts

@@ -43,6 +43,7 @@ export class AuthService {
   private readonly repository = new AuthRepository();
   private readonly mailService = new MailService();
   private readonly storageService = StorageFactory.getStorageService();
+  private readonly crawlJobRepository = new CrawlJobRepository();
 
   private async deliverVerificationEmail(
     user: { id: string; email: string },
@@ -467,7 +468,7 @@ export class AuthService {
       throw new AppError("User not found", 404, ERROR_CODE.NOT_FOUND);
     }
 
-    const crawlJobRepo = new CrawlJobRepository();
+    const crawlJobRepo = this.crawlJobRepository;
     const nowZoned = getZonedDateParts(new Date(), DEFAULT_TIMEZONE);
     const startOfDay = createUtcDateFromZonedParts(
       nowZoned.year,