valentinbvro
5a1206118a
Both guards were fully implemented but never actually wired in -- Nest doesn't enforce a guard just because its module is imported, it needs an explicit APP_GUARD registration. Registered both globally so every new controller is deny-by-default and rate-limited unless it opts out. Added a @Public() decorator (checked via Reflector in TenantGuard) for routes that legitimately have no session, applied it to /health so the global guard doesn't break it. CORS was wide open (enableCors() with no origin restriction, effectively allow-any-origin). Now reads an explicit CORS_ORIGINS allowlist from env, defaulting to localhost:3000 for local dev.
11 lines
281 B
TypeScript
11 lines
281 B
TypeScript
import { Controller, Get } from '@nestjs/common';
|
|
import { Public } from '../auth/public.decorator';
|
|
|
|
@Controller('health')
|
|
export class HealthController {
|
|
@Public()
|
|
@Get()
|
|
check() {
|
|
return { status: 'ok', service: 'ceo-api', timestamp: new Date().toISOString() };
|
|
}
|
|
}
|