🚀 v0.3.0: Security Hardening, Production Readiness & Observability

[raouf-b-dev]

🚀 v0.3.0: Security Hardening, Production Readiness & Observability

This release focuses on hardening the API for production, implementing strict security measures, decoupling infrastructure configuration for containerized deployment, replacing the legacy authentication strategy with enterprise-grade RSA JWTs, and enhancing observability through correlation IDs.

🛠 What's New & Improved

🔐 Security & Authentication Overhaul

• RSA JWT Transition: Completely migrated from HMAC-based JWTs to RSA (RS256) signature verification.
• JWKS Endpoint Deployment: Added a production-ready /auth/jwks endpoint to decouple Identity from Access and enable remote public key distribution.
• Strict Headers & CORS: Configured Helmet to seamlessly enforce X-Frame-Options, HSTS, Content-Security-Policy, etc. Enforced an environment-based CORS whitelist without wildcards in production.
• Global XSS Protection & Pagination Restrictions: Implemented a global sanitize-html interceptor on all payload bodies and enforced @Max(100) decorators on API query endpoints to prevent payload and resource-exhaustion exploits.

🏭 Production Infrastructure Breakdown

• Multi-Stage Docker Modernization: Decoupled infrastructure configs from the application build. Standardized the multi-stage implementation (Dockerfile) to isolate base packages, build tools, and production runtimes.
• Environment Consistency Fixes: Stabilized cross-container routing via Docker Compose by standardizing service names (redis, postgres) preventing ECONNREFUSED loops.
• Automated Version Injection: Simplified CI pipeline by embedding ecommerce-api:<version> tags dynamically based on the current context format for future orchestrator readiness.

🩺 Health Diagnostics & Resilient Processing

• Terminus Health Module Integration: Bootstrapped /health via @nestjs/terminus to robustly monitor deep database and Redis component health.
• Docker-Native Traffic Gating: Configured robust container health checks verifying dependent modules are fully initialized before granting routing clearance.
• Lifecycle Overhaul (Graceful Shutdown): Completely rewrote the NestJS app teardown integration, eliminating the old app.close() Redis monkey-patch in favor of strict connection-draining and exit-code propagation preventing EADDRINUSE lockups.

🔭 Observability Correlation Traces

• End-to-End Tracing Core: Unified process visibility by embedding X-Request-Id headers transparently into background context scopes.
• BullMQ Automatic Hydration: Refactored BaseJobHandler ensuring isolated processes properly restore correlation spans, linking side-effect jobs entirely to the orchestrating trigger flow.

📝 Readability & Developer Tooling Restructure

• Condensed README: Removed over 300 lines of legacy verbiage from the root README.md, repositioning the open-source structure sequentially (Hook → Quick Start → Features → Deep Dive Docs).
• Feature Catalog Sub-documentation: Isolated deep-technical architectural concepts out of the root folder. Created dedicated docs/FEATURES.md and docs/TROUBLESHOOTING.md.

📊 By The Numbers

• 1 Critical Process Blocking Lock Fixed (EADDRINUSE)
• 1 Structural Security Strategy Updated (HMAC -> RSA (RS256))
• 2 New Diagnostic Endpoints (/health, /auth/jwks)
• 100% Strict CORS and XSS adherence enforced across API endpoints.

---

This discussion was created from the release 🚀 v0.3.0: Security Hardening, Production Readiness & Observability.