- Validate the environment at startup (src/config): required variables
must be present, HIBOUTIK_BASE_URL must be HTTPS.
- Global ValidationPipe (whitelist, forbidNonWhitelisted, transform).
- Helmet, CORS disabled unless CORS_ORIGINS is set, TRUST_PROXY support,
HTTP header/request timeouts, shutdown hooks.
- Rate limiting: 60 req/min/IP globally, 5 req/min on POST /sync.
- AllExceptionsFilter: unexpected errors are logged (message + stack,
never the raw error object) and answered with a generic 500.
- Postgres advisory lock (dedicated connection) so only one
synchronization runs at a time across all instances; released by
Postgres itself if the process dies.
- Fix the Jest moduleNameMapper (unescaped dot also matched .cjs files).
- Document the input validation and security rules in CLAUDE.md.
- Add class-validator, class-transformer, helmet and @nestjs/throttler;
npm audit fix refreshed package-lock.json.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Generate the Prisma client on postinstall. Jest now transpiles the ESM-only @nestjs/config and maps the .js imports of the generated Prisma client, in both the unit and e2e configurations.
