fix(security): rate limiting, CORS restriction, tableName allowlist, non-root Docker, migration entrypoint, aria-live

2026-04-15 13:25:18 -04:00
parent 5460a93217
commit 9b3c883bf0
11 changed files with 146 additions and 15 deletions
@@ -38,6 +38,11 @@ describe('GET /api/audit-logs', () => {
    );
  });

+  it('returns 422 for invalid tableName (not in allowlist)', async () => {
+    const res = await request(app).get('/api/audit-logs?tableName=users');
+    expect(res.status).toBe(422);
+  });
+
  it('returns 422 for invalid recordId', async () => {
    const res = await request(app).get('/api/audit-logs?recordId=not-a-uuid');
    expect(res.status).toBe(422);