2 Commits

Author	SHA1	Message	Date
Ho Ngoc Hai	25420720e7	fix(api,ci): remove type-only imports for DI and isolate CI ports from dev ... - Remove `type` keyword from NestJS injectable class imports across all modules to fix runtime DI resolution (330+ handler/listener files) - Offset CI docker-compose ports (5433/6380/8109/9002) to avoid conflicts with running dev containers - Update .env.test, playwright.config.ts, and e2e workflow to use isolated CI ports with configurable overrides - Fix prisma/seed.ts to use deterministic IDs for Prisma 7 upsert compatibility (phoneHash replaced phone as unique index) - Add dedicated Docker bridge network for CI service containers Co-Authored-By: Claude Opus 4 (1M context) <noreply@anthropic.com>	2026-04-13 01:40:14 +07:00
Ho Ngoc Hai	017d85247e	fix(security): harden security headers across API and Web apps ... - API: set X-Frame-Options to DENY via frameguard, add Permissions-Policy header, widen CSP connect-src for Swagger CDN - Web: add HSTS header (1yr, includeSubDomains, preload), add payment=(self) to Permissions-Policy, make localhost:3001 in CSP connect-src dev-only Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-10 20:10:22 +07:00