3 Commits

Author	SHA1	Message	Date
julien	61cdec00e7	feat(validation): introduce express-validator on CMS user and article endpoints ... Replaces the broken fieldValidation helper (called next() without return, so execution continued on invalid input) with express-validator chains applied at the route level. Validation covers: email format, username constraints, password min length, field lengths, URL and phone formats. products and tags controllers retain their local fieldValidation pending a separate ecommerce validation pass.	2026-04-26 22:06:28 +02:00
julien	ebc7c7751a	fix(security): add Helmet headers and rate limiting on auth endpoints ... Helmet adds HTTP security headers (HSTS, X-Frame-Options, X-Content-Type-Options, etc.). CSP is disabled pending deployment- specific tuning. Rate limiting (10 req / 15 min per IP) is applied to POST /login and POST / (registration) to mitigate brute force and credential stuffing attacks.	2026-04-26 20:45:46 +02:00
julien	4c765945b3	refactor(naming): harmonize controller and route file names ... - Delete product.controller.js, merge unique functions into products.controller.js - Rename user.controller.js → users.controller.js, user.routes.js → users.routes.js - Remove dead herowars/herowars.routes.js reference from herowars index - Update all import paths accordingly	2026-04-26 00:39:29 +02:00