chore: initial deploy bundle

apps/api/src/app.ts

@@ -7,6 +7,7 @@ import { env } from './config/env';
 import { swaggerSpec } from './config/swagger';
 import { traceMiddleware } from './middleware/trace';
 import { authMiddleware } from './middleware/auth';
+import { csrfMiddleware } from './middleware/csrf';
 import { errorHandler } from './middleware/error-handler';
 import walletRoutes from './routes/wallet.routes';
 import relayProxyRoutes from './routes/relay-proxy.routes';
@@ -19,12 +20,12 @@ import bscSwapProxyRoutes from './routes/bsc-swap-proxy.routes';
 const app = express();
 
 app.use(helmet());
-app.use(cors({ origin: env.frontendUrl, credentials: true }));
+app.use(cors({ origin: env.cors.origins, credentials: env.cors.allowCredentials }));
 app.use(express.json());
 app.use(cookieParser());
 app.use(traceMiddleware);
 
-// ── PUBLIC endpoints (no auth) ────────────────────────────────────────────────
+// ── PUBLIC endpoints ─────────────────────────────────────────────────────────
 app.get('/api/health', (_req, res) => {
   res.json({ success: true, data: { status: 'ok' } });
 });
@@ -34,14 +35,16 @@ app.get('/api/docs/swagger.json', (_req, res) => {
   res.json(swaggerSpec);
 });
 
-// ── PROTECTED endpoints (JWT required) ────────────────────────────────────────
-app.use('/api/wallets', authMiddleware, walletRoutes);
-app.use('/api/relay', authMiddleware, relayProxyRoutes);
-app.use('/api/tron', authMiddleware, tronProxyRoutes);
-app.use('/api/sol/swap', authMiddleware, solSwapProxyRoutes);
-app.use('/api/tron/swap', authMiddleware, tronSwapProxyRoutes);
-app.use('/api/btc', authMiddleware, btcProxyRoutes);
-app.use('/api/bsc/swap', authMiddleware, bscSwapProxyRoutes);
+// ── PROTECTED endpoints (JWT + CSRF for mutating methods) ────────────────────
+const protect = [authMiddleware, csrfMiddleware];
+
+app.use('/api/wallets', ...protect, walletRoutes);
+app.use('/api/relay', ...protect, relayProxyRoutes);
+app.use('/api/tron', ...protect, tronProxyRoutes);
+app.use('/api/sol/swap', ...protect, solSwapProxyRoutes);
+app.use('/api/tron/swap', ...protect, tronSwapProxyRoutes);
+app.use('/api/btc', ...protect, btcProxyRoutes);
+app.use('/api/bsc/swap', ...protect, bscSwapProxyRoutes);
 
 app.use(errorHandler);