valentinbvro 5a1206118a security: enforce TenantGuard and ThrottlerGuard globally, lock down CORS ... Both guards were fully implemented but never actually wired in -- Nest doesn't enforce a guard just because its module is imported, it needs an explicit APP_GUARD registration. Registered both globally so every new controller is deny-by-default and rate-limited unless it opts out. Added a @Public() decorator (checked via Reflector in TenantGuard) for routes that legitimately have no session, applied it to /health so the global guard doesn't break it. CORS was wide open (enableCors() with no origin restriction, effectively allow-any-origin). Now reads an explicit CORS_ORIGINS allowlist from env, defaulting to localhost:3000 for local dev.		2026-07-21 19:48:17 +02:00
..
health.controller.ts	security: enforce TenantGuard and ThrottlerGuard globally, lock down CORS	2026-07-21 19:48:17 +02:00