Andrei
2bb7a2d512
Security Features Implemented:
- Helmet.js with Content Security Policy (CSP)
- Allows GraphQL Playground ('unsafe-inline', 'unsafe-eval')
- Strict default-src, object-src 'none', frame-src 'none'
- HSTS with 1-year max-age and subdomain inclusion
- X-Frame-Options: DENY
- X-Content-Type-Options: nosniff
- Referrer-Policy: strict-origin-when-cross-origin
CORS Configuration:
- Strict origin whitelisting (localhost:19000, 3001, 3030)
- Origin validation callback with logging
- Allows no-origin requests (mobile apps)
- Blocks unauthorized origins with error
Input Validation Enhancements:
- Global ValidationPipe with whitelist mode
- Strips non-decorated properties (whitelist: true)
- Throws error for unknown properties (forbidNonWhitelisted: true)
- Hides validation errors in production
- Enhanced DTOs with Transform decorators and regex validation
Testing Verified:
✅ All security headers present in responses
✅ CORS blocks unauthorized origins
✅ CORS allows whitelisted origins
✅ Backend compiles with 0 errors
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
129 lines
3.8 KiB
JSON
129 lines
3.8 KiB
JSON
{
|
|
"name": "maternal-app-backend",
|
|
"version": "0.0.1",
|
|
"description": "",
|
|
"author": "",
|
|
"private": true,
|
|
"license": "UNLICENSED",
|
|
"scripts": {
|
|
"build": "nest build",
|
|
"format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
|
|
"start": "nest start",
|
|
"start:dev": "nest start --watch",
|
|
"start:debug": "nest start --debug --watch",
|
|
"start:prod": "node dist/main",
|
|
"lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
|
|
"test": "jest",
|
|
"test:watch": "jest --watch",
|
|
"test:cov": "jest --coverage",
|
|
"test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
|
|
"test:e2e": "jest --config ./test/jest-e2e.json",
|
|
"migration:run": "ts-node src/database/migrations/run-migrations.ts"
|
|
},
|
|
"dependencies": {
|
|
"@apollo/server": "^5.0.0",
|
|
"@as-integrations/express5": "^1.1.2",
|
|
"@aws-sdk/client-s3": "^3.899.0",
|
|
"@aws-sdk/lib-storage": "^3.900.0",
|
|
"@aws-sdk/s3-request-presigner": "^3.899.0",
|
|
"@langchain/core": "^0.3.78",
|
|
"@langchain/openai": "^0.6.14",
|
|
"@nestjs/apollo": "^13.2.1",
|
|
"@nestjs/common": "^11.1.6",
|
|
"@nestjs/config": "^4.0.2",
|
|
"@nestjs/core": "^11.1.6",
|
|
"@nestjs/graphql": "^13.2.0",
|
|
"@nestjs/jwt": "^11.0.0",
|
|
"@nestjs/mapped-types": "^2.1.0",
|
|
"@nestjs/passport": "^11.0.5",
|
|
"@nestjs/platform-express": "^11.1.6",
|
|
"@nestjs/platform-socket.io": "^11.1.6",
|
|
"@nestjs/schedule": "^6.0.1",
|
|
"@nestjs/typeorm": "^11.0.0",
|
|
"@nestjs/websockets": "^11.1.6",
|
|
"@sentry/node": "^10.17.0",
|
|
"@sentry/profiling-node": "^10.17.0",
|
|
"@simplewebauthn/server": "^13.2.1",
|
|
"@types/node-fetch": "^2.6.13",
|
|
"@types/pdfkit": "^0.17.3",
|
|
"@types/qrcode": "^1.5.5",
|
|
"axios": "^1.12.2",
|
|
"bcrypt": "^6.0.0",
|
|
"cache-manager": "^7.2.2",
|
|
"cache-manager-redis-yet": "^5.1.5",
|
|
"class-transformer": "^0.5.1",
|
|
"class-validator": "^0.14.2",
|
|
"dataloader": "^2.2.3",
|
|
"date-fns": "^4.1.0",
|
|
"dotenv": "^17.2.3",
|
|
"form-data": "^4.0.4",
|
|
"graphql": "^16.11.0",
|
|
"graphql-type-json": "^0.3.2",
|
|
"helmet": "^8.1.0",
|
|
"ioredis": "^5.8.0",
|
|
"langchain": "^0.3.35",
|
|
"mailgun.js": "^12.1.0",
|
|
"multer": "^2.0.2",
|
|
"node-fetch": "^2.7.0",
|
|
"openai": "^6.0.1",
|
|
"otplib": "^12.0.1",
|
|
"passport": "^0.7.0",
|
|
"passport-jwt": "^4.0.1",
|
|
"passport-local": "^1.0.0",
|
|
"pdfkit": "^0.17.2",
|
|
"pg": "^8.16.3",
|
|
"qrcode": "^1.5.4",
|
|
"redis": "^5.8.2",
|
|
"reflect-metadata": "^0.2.0",
|
|
"rxjs": "^7.8.1",
|
|
"sharp": "^0.34.4",
|
|
"socket.io": "^4.8.1",
|
|
"typeorm": "^0.3.27",
|
|
"uuid": "^13.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"@nestjs/cli": "^10.0.0",
|
|
"@nestjs/schematics": "^10.0.0",
|
|
"@nestjs/testing": "^11.1.6",
|
|
"@types/bcrypt": "^6.0.0",
|
|
"@types/express": "^5.0.0",
|
|
"@types/jest": "^29.5.2",
|
|
"@types/multer": "^2.0.0",
|
|
"@types/node": "^20.3.1",
|
|
"@types/passport-jwt": "^4.0.1",
|
|
"@types/supertest": "^6.0.0",
|
|
"@typescript-eslint/eslint-plugin": "^8.0.0",
|
|
"@typescript-eslint/parser": "^8.0.0",
|
|
"eslint": "^9.36.0",
|
|
"eslint-config-prettier": "^10.1.8",
|
|
"eslint-plugin-prettier": "^5.0.0",
|
|
"globals": "^16.4.0",
|
|
"jest": "^29.5.0",
|
|
"prettier": "^3.0.0",
|
|
"source-map-support": "^0.5.21",
|
|
"supertest": "^7.0.0",
|
|
"ts-jest": "^29.1.0",
|
|
"ts-loader": "^9.4.3",
|
|
"ts-node": "^10.9.2",
|
|
"tsconfig-paths": "^4.2.0",
|
|
"typescript": "^5.1.3"
|
|
},
|
|
"jest": {
|
|
"moduleFileExtensions": [
|
|
"js",
|
|
"json",
|
|
"ts"
|
|
],
|
|
"rootDir": "src",
|
|
"testRegex": ".*\\.spec\\.ts$",
|
|
"transform": {
|
|
"^.+\\.(t|j)s$": "ts-jest"
|
|
},
|
|
"collectCoverageFrom": [
|
|
"**/*.(t|j)s"
|
|
],
|
|
"coverageDirectory": "../coverage",
|
|
"testEnvironment": "node"
|
|
}
|
|
}
|