🛡️ Sentinel: [HIGH] Add security headers and strict CORS

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-06-19 - [Missing Security Headers & Strict CORS]
+**Vulnerability:** Fastify API server lacked security headers (Helmet) and a strict CORS policy, leaving it vulnerable to XSS, Clickjacking, and cross-origin attacks.
+**Learning:** Default Fastify setups are un-opinionated about security headers. `cors` must not be set to `origin: true`.
+**Prevention:** Always ensure new or existing Fastify applications explicitly configure `@fastify/helmet` globally and strictly define `@fastify/cors` using allowed origins from environment variables.

apps/api/package.json

@@ -9,6 +9,8 @@
     "typecheck": "cd ../.. && tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
+    "@fastify/cors": "~8.5.0",
+    "@fastify/helmet": "~11.1.1",
     "@vooster/contracts": "workspace:*"
   }
 }

apps/api/src/http/server.ts

@@ -1,4 +1,6 @@
 import Fastify, { type FastifyInstance } from "fastify";
+import cors from "@fastify/cors";
+import helmet from "@fastify/helmet";
 import { healthResponseSchema } from "@vooster/contracts";
 import { createMemoryApiKeyStore } from "../infrastructure/memory-api-key-store.js";
 import { createMemoryActorStore } from "../infrastructure/memory-actor-store.js";
@@ -63,6 +65,12 @@ import type { UserStore } from "../ports/user-store.js";
 export async function createServer(options: ServerOptions): Promise<FastifyInstance> {
   const serverOptions = withGithubOAuthFromEnv(options);
   const app = Fastify({ logger: false });
+  await app.register(helmet, { global: true });
+  const allowedOrigins = process.env.VSPEC_ALLOWED_ORIGINS?.split(",") ?? [];
+  await app.register(cors, {
+    origin: allowedOrigins.length > 0 ? allowedOrigins : false,
+    credentials: true
+  });
   const state = initialState();
   const apiKeyStore = serverOptions.signupStore ?? createMemoryApiKeyStore();
   const actorStore = serverOptions.signupStore ?? createMemoryActorStore();