fix: resolve P0/P1 audit findings for security, architecture, and race conditions (!5) · Merge Requests · ThinhNC / upgrade-data-crawler-be

fix: resolve P0/P1 audit findings for security, architecture, and race conditions

Summary

This PR executes a comprehensive remediation cycle based on the repository audit and backend architectural guidelines. All confirmed P0 (Critical) and P1 (High) findings—along with key P2/P3 consistency items—have been resolved, verified, and validated against the entire automated test suite.

Key Changes

P0 — Critical Fixes

Auth Token Leakage (BUG-01): AuthService.forgotPassword() now triggers MailService.sendPasswordResetEmail() internally and returns { success: true }. The sensitive resetToken and userId are no longer exposed across the service/controller boundary.
Architecture & Layer Isolation (BUG-02): Enforced the Strict 5-Layer Pattern and Prisma isolation:
- Created dedicated constants for crawl page statuses and webhook events.
- Centralized domain database type re-exports.
- Removed direct @prisma/client imports across all services, validations, helpers, and DTOs.
- Added an ESLint rule to prevent direct @prisma/client imports in non-repository layers.

P1 — High Priority Fixes

Schedule Pagination Bounds (BUG-03): Added explicit .min(1).max(100) bounds for page and limit query parameters in schedule validation to eliminate unbounded query DoS risks.
Atomic Job Status Update (BUG-04): Refactored CrawlJobRepository.updateStatus() to use atomic conditional updates (status: { not: 'CANCELED' }), preventing TOCTOU race conditions where concurrent worker updates could overwrite user-cancelled jobs.
Worker Redundant State Transition (BUG-06): Removed duplicate RUNNING status transitions in the crawl worker processor that were overwriting the initial startedAt timestamp.
Schedule IDOR Prevention (BUG-07): Added schedule ownership verification in CrawlJobService.create() to ensure jobs cannot be improperly associated with schedules belonging to other users.
Webhook Zero-Hardcode Validation (BUG-09): Replaced string literal arrays with enum constants in webhook validation schemas.

P2 / P3 — Quality & API Contract Improvements

Asset Query Validation & Meta (BUG-10, BUG-15): Added validated query schema for crawl assets, implemented repository-level asset counts, and standardized paginated response envelopes to { items, meta: { total, page, limit, totalPages } } across assets and logs.
Removed Zod Mutation Anti-Pattern (BUG-12): Removed direct object mutations inside schema refinement blocks.
User Quota Upper Bounds (BUG-16): Added safe upper bounds for user quota fields (maxPagesLimit, maxJobsPerDayLimit, maxConcurrentJobsLimit).
Zero-Hardcode Role (BUG-17): Replaced hardcoded "CRAWLER_USER" string literals with role constants.
Environment-Aware Logging (BUG-18): Configured Morgan logger dynamically (combined in production, dev in development).

## Summary

This PR executes a comprehensive remediation cycle based on the repository audit and backend architectural guidelines. All confirmed **P0 (Critical)** and **P1 (High)** findings—along with key **P2/P3** consistency items—have been resolved, verified, and validated against the entire automated test suite.

---

## Key Changes

### P0 — Critical Fixes
- **Auth Token Leakage (`BUG-01`)**: `AuthService.forgotPassword()` now triggers `MailService.sendPasswordResetEmail()` internally and returns `{ success: true }`. The sensitive `resetToken` and `userId` are no longer exposed across the service/controller boundary.
- **Architecture & Layer Isolation (`BUG-02`)**: Enforced the Strict 5-Layer Pattern and Prisma isolation:
  - Created dedicated constants for crawl page statuses and webhook events.
  - Centralized domain database type re-exports.
  - Removed direct `@prisma/client` imports across all services, validations, helpers, and DTOs.
  - Added an ESLint rule to prevent direct `@prisma/client` imports in non-repository layers.

### P1 — High Priority Fixes
- **Schedule Pagination Bounds (`BUG-03`)**: Added explicit `.min(1).max(100)` bounds for `page` and `limit` query parameters in schedule validation to eliminate unbounded query DoS risks.
- **Atomic Job Status Update (`BUG-04`)**: Refactored `CrawlJobRepository.updateStatus()` to use atomic conditional updates (`status: { not: 'CANCELED' }`), preventing TOCTOU race conditions where concurrent worker updates could overwrite user-cancelled jobs.
- **Worker Redundant State Transition (`BUG-06`)**: Removed duplicate `RUNNING` status transitions in the crawl worker processor that were overwriting the initial `startedAt` timestamp.
- **Schedule IDOR Prevention (`BUG-07`)**: Added schedule ownership verification in `CrawlJobService.create()` to ensure jobs cannot be improperly associated with schedules belonging to other users.
- **Webhook Zero-Hardcode Validation (`BUG-09`)**: Replaced string literal arrays with enum constants in webhook validation schemas.

### P2 / P3 — Quality & API Contract Improvements
- **Asset Query Validation & Meta (`BUG-10`, `BUG-15`)**: Added validated query schema for crawl assets, implemented repository-level asset counts, and standardized paginated response envelopes to `{ items, meta: { total, page, limit, totalPages } }` across assets and logs.
- **Removed Zod Mutation Anti-Pattern (`BUG-12`)**: Removed direct object mutations inside schema refinement blocks.
- **User Quota Upper Bounds (`BUG-16`)**: Added safe upper bounds for user quota fields (`maxPagesLimit`, `maxJobsPerDayLimit`, `maxConcurrentJobsLimit`).
- **Zero-Hardcode Role (`BUG-17`)**: Replaced hardcoded `"CRAWLER_USER"` string literals with role constants.
- **Environment-Aware Logging (`BUG-18`)**: Configured Morgan logger dynamically (`combined` in production, `dev` in development).