Nick Szaunig
f1298eff08
Security review findings (HIGH-1/2/3, MEDIUM): - Rate limiting via @nestjs/throttler: global 100 req/min default, stricter 10 req/min on login and refresh. Also closes the MEDIUM finding (public batch-lookup enumeration) since it now sits behind the global limit too. Trust the K8s ingress's single proxy hop so throttling keys off the real client IP, not the ingress pod's IP. - Auth events (login success/failure, logout, token refresh) are now audit-logged via new AuditAction values, closing the gap where the project's own audit-log principle never actually covered the Auth module. - Refresh-token cookie now defaults to Secure=true (opt out only via COOKIE_SECURE=false for local HTTP dev), instead of keying off NODE_ENV which was never set in the K8s deploy templates. Added a TLS block + cert-manager annotation to both the backend and frontend ingress templates, which previously had no HTTPS termination configured at all.
18 lines
637 B
TypeScript
18 lines
637 B
TypeScript
import { Test, TestingModule } from '@nestjs/testing';
|
|
import { INestApplication } from '@nestjs/common';
|
|
import { NestExpressApplication } from '@nestjs/platform-express';
|
|
import { App } from 'supertest/types';
|
|
import { AppModule } from '../../src/app.module';
|
|
import { configureApp } from '../../src/app.config';
|
|
|
|
export async function createTestApp(): Promise<INestApplication<App>> {
|
|
const moduleFixture: TestingModule = await Test.createTestingModule({
|
|
imports: [AppModule],
|
|
}).compile();
|
|
|
|
const app = moduleFixture.createNestApplication<NestExpressApplication>();
|
|
configureApp(app);
|
|
await app.init();
|
|
return app;
|
|
}
|