fix: harden production auth and review flow

- Add environment-aware CORS and secure cookie support:
  * Add secureCookies config to env.ts based on SECURE_COOKIES env var or https detection
  * Integrate @elysiajs/cors with credentials and origin configuration
  * Update cookie helpers to use SameSite=None; Secure in production
- Wrap expert review update and insert in database transaction for atomicity:
  * Ensures diagnosis status update and review insert succeed together
  * Rolls back both operations if either fails
  * Preserves behavior: only update if status is needs_review, return badRequest if no row updated

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

This commit is contained in:

Asep Haryana Saputra

2026-05-22 17:32:57 +00:00

co-authored by

Claude Opus 4.7

parent 4478d51aae

commit c623de9959

6 changed files with 50 additions and 25 deletions

									
										apps/api/package.json
									
		+1
		
												View File
												
				@@ -11,6 +11,7 @@

				    "db:migrate": "drizzle-kit migrate"

				  },

				  "dependencies": {

				    "@elysiajs/cors": "1.4.2",

				    "@tensorflow/tfjs": "4.22.0",

				    "@zeavis/shared": "workspace:*",

				    "bcryptjs": "^2.4.3",