🛡️ Sentinel: [MEDIUM] Add Security Headers and strict CORS policy to Fastify backend

.jules/sentinel.md

@@ -0,0 +1,5 @@
+## 2024-06-07 - Add Security Headers
+
+**Vulnerability:** Fastify server lacked explicit security headers (Helmet) and a defined CORS policy.
+**Learning:** Security middleware (like `fastify-helmet` and `fastify-cors`) is crucial for defense-in-depth but must be version-matched to the core framework (Fastify v4 requires older plugin versions).
+**Prevention:** Always verify the framework version in `package.json` before installing security plugins to ensure compatibility.

apps/api/package.json

@@ -9,6 +9,8 @@
     "typecheck": "cd ../.. && tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
+    "@fastify/cors": "^8.5.0",
+    "@fastify/helmet": "^11.1.1",
     "@vooster/contracts": "workspace:*"
   }
 }

apps/api/src/http/server.ts

@@ -1,3 +1,5 @@
+import fastifyCors from "@fastify/cors";
+import fastifyHelmet from "@fastify/helmet";
 import Fastify, { type FastifyInstance } from "fastify";
 import { healthResponseSchema } from "@vooster/contracts";
 import { createMemoryApiKeyStore } from "../infrastructure/memory-api-key-store.js";
@@ -91,6 +93,10 @@ export async function createServer(options: ServerOptions): Promise<FastifyInsta
   if (serverOptions.authStub) {
     await seedStubZeroWorkspaceUser(userStore);
   }
+
+  await app.register(fastifyHelmet);
+  await app.register(fastifyCors, { origin: false });
+
   app.get("/healthz", () => healthResponseSchema.parse({ status: "ok" }));
   if (serverOptions.signupStore !== undefined) {
     app.addHook("onClose", async () => {