Security and quality fixes #28
Loading…
Reference in a new issue
No description provided.
Delete branch "feature/security-and-quality-fixes"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Critical and Important fixes from a multi-agent code review (2 of 3 repos).
Highlights
Verification
The previous catch branch reset `isRefreshing` and called `refreshTokenSubject.next(null)`. Queued requests filter out `null`, so they never emitted and hung forever. Now we surface the failure via `.error()` on the existing subject, replace it with a fresh one for the next cycle, and propagate via `throwError`. Also: - Detect refresh success via the envelope's `data` shape (a non-empty string token) rather than the legacy `statusCode` field, since the new unified envelope returns `ApiResponse<{message}>` on failure. - Add `withCredentials: true` globally via the authorization interceptor so the refresh-token cookie is sent on every request, and drop the per-call `withCredentials` flags in `AuthService`. - Add `AuthService.deleteToken()` so the interceptor can clear the local session cleanly. - `AuthService.logout()` now clears local state even when the network call fails before bubbling the error. - Inject `Title` plumbing prep moved to other commits. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>Lock down third-party origins with a strict Content Security Policy via helmet. The API origin is read from the `API_ORIGIN` env var at startup so prod/staging can override it. Inline styles are still allowed because some PrimeNG components emit them. Also removes the `res.cookie('server-cookie', randomUUID())` line that was leftover scaffolding (no flags, no expiry, no use). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>Enable client hydration with `withEventReplay()` so events captured during SSR-to-CSR handoff are replayed once the app boots, and `withHttpTransferCacheOptions({includePostRequests: false})` so the SSR transfer cache only deduplicates safe GET fetches — POSTs like refresh/login/logout must always go through the client. Also hoists `ConfirmationService` to the root injector so routes outside MainLayout (login, signup, verify-email) can use it. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>The app is signals-based throughout, so default change detection adds no value. Add `ChangeDetectionStrategy.OnPush` to every remaining `@Component({...})` decorator and import the symbol from `@angular/core` where missing. Applied via a small AST-aware script so the placement is uniform — no behavioural changes intended. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>The API now returns errors as ApiResponse<ErrorData> ({statusCode, data:{message, details}}) instead of the previous anonymous {statusCode, exceptionMessage}. Seventeen admin/tracker pages were still reading err.error.exceptionMessage and would silently render "undefined" in toasts after the API contract change. Switch every call site to err.error?.data?.message ?? err.error?.message so toasts work against both old and new shapes during the transition.