improve code.rtf

{\rtf1\ansi\deff0\nouicompat{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil Calibri;}{\f2\fnil\fcharset1 Cambria Math;}}
{\*\generator Riched20 10.0.19041}{\*\mmathPr\mmathFont2\mwrapIndent1440 }\viewkind4\uc1 
\pard\sa200\sl276\slmult1\f0\fs22\lang9 You are a Senior Software Architect, Senior Backend Engineer, Senior DevOps Engineer, and Senior Security Engineer.\par
\par
Analyze the entire existing codebase and implement all required improvements directly in the project without breaking any existing functionality.\par
\par
Project Goal:\par
Transform the current application into a Production-Ready SaaS foundation with strong security, scalability, maintainability, monitoring, and enterprise-grade architecture.\par
\par
========================\par
PHASE 1 \f1\emdash  SECURITY HARDENING\par
============================\par
\par
1. CORS Security\par
\par
* Remove any wildcard or fully open CORS configuration.\par
* Allow requests only from approved frontend domains.\par
* Support environment-based domain configuration.\par
* Separate Development and Production configurations.\par
\par
2. Helmet Security\par
\par
* Install and configure Helmet.\par
* Enable all recommended security headers.\par
* Configure Content Security Policy properly.\par
\par
3. Rate Limiting\par
\par
* Implement express-rate-limit.\par
* Create separate limits for:\par
\par
  * Login\par
  * Register\par
  * Password Reset\par
  * API Requests\par
* Return proper error responses.\par
\par
4. Authentication Security\par
\par
* Audit JWT implementation.\par
* Improve token validation.\par
* Validate expiration handling.\par
* Protect against token abuse.\par
* Ensure secure secret management.\par
\par
5. Cookie Security\par
\par
* Use:\par
\par
  * httpOnly\par
  * secure\par
  * sameSite=strict\par
* Environment-aware configuration.\par
\par
6. CSRF Protection\par
\par
* Implement CSRF protection for cookie-based authentication.\par
* Secure all sensitive endpoints.\par
\par
7. Input Validation\par
\par
* Ensure every endpoint uses Zod validation.\par
* Remove any unvalidated request body.\par
* Sanitize user input.\par
* Prevent injection attacks.\par
\par
8. File Upload Security\par
\par
* Validate MIME types.\par
* Validate file extensions.\par
* Validate file size.\par
* Block SVG uploads.\par
* Prevent malicious file execution.\par
* Implement upload scanning layer.\par
\par
9. Security Logging\par
\par
* Log:\par
\par
  * Login attempts\par
  * Failed authentication\par
  * Permission violations\par
  * Suspicious activity\par
\par
========================\par
PHASE 2 \emdash  ROLE BASED ACCESS CONTROL\par
===================================\par
\par
Implement Enterprise RBAC.\par
\par
Roles:\par
\par
* Super Admin\par
* Admin\par
* Manager\par
* Staff\par
* User\par
\par
Requirements:\par
\par
* Permission matrix.\par
* Middleware:\par
  authorize(...)\par
* Route protection.\par
* Page protection.\par
* API protection.\par
* Database-level role checks.\par
\par
Examples:\par
\par
* Only Super Admin can manage platform settings.\par
* Admin can manage organization resources.\par
* Staff can only access assigned resources.\par
* Users can only access their own data.\par
\par
========================\par
PHASE 3 \emdash  MULTI TENANT ARCHITECTURE\par
===================================\par
\par
Convert architecture to true SaaS multi-tenancy.\par
\par
Requirements:\par
\par
1. Tenant Entity\par
\par
* Create Tenant model.\par
\par
2. Tenant Isolation\par
\par
* Every record belongs to tenant.\par
* Prevent cross-tenant access.\par
\par
3. Tenant Middleware\par
\par
* Automatically resolve tenant.\par
* Attach tenant context.\par
\par
4. Database Protection\par
\par
* Every query must be tenant-aware.\par
\par
5. Super Admin Bypass\par
\par
* Platform administrators can access all tenants.\par
\par
========================\par
PHASE 4 \emdash  BACKEND ARCHITECTURE IMPROVEMENTS\par
===========================================\par
\par
Refactor into:\par
\par
Controller\par
\f2\u8595?\f0\par
Service\par
\f2\u8595?\f0\par
Repository\par
\f2\u8595?\f0\par
Prisma\par
\par
Requirements:\par
\par
* Controllers contain no business logic.\par
* Services contain business logic.\par
* Repositories handle database access.\par
* Shared abstractions.\par
* Dependency injection friendly structure.\par
\par
========================\par
PHASE 5 \f1\emdash  OBSERVABILITY\par
=======================\par
\par
1. Logging\par
\par
* Implement Winston or Pino.\par
* Structured JSON logs.\par
* Environment aware.\par
\par
2. Error Tracking\par
\par
* Integrate Sentry.\par
* Capture exceptions.\par
* Capture API failures.\par
\par
3. Request Tracing\par
\par
* Track request lifecycle.\par
* Add correlation IDs.\par
\par
4. Health Checks\par
   Create endpoints:\par
\par
/health\par
/health/database\par
/health/storage\par
\par
========================\par
PHASE 6 \emdash  DATABASE IMPROVEMENTS\par
===============================\par
\par
Review Prisma schema.\par
\par
Requirements:\par
\par
* Add indexes.\par
* Add composite indexes.\par
* Add foreign key constraints.\par
* Optimize slow queries.\par
* Remove redundant fields.\par
* Improve relationships.\par
* Add soft delete support.\par
* Add audit fields:\par
\par
createdAt\par
updatedAt\par
createdBy\par
updatedBy\par
\par
========================\par
PHASE 7 \emdash  TESTING\par
=================\par
\par
Implement:\par
\par
1. Unit Tests\par
\par
* Services\par
* Utilities\par
* Validation\par
\par
2. Integration Tests\par
\par
* API routes\par
* Database interactions\par
\par
3. Authentication Tests\par
\par
4. Authorization Tests\par
\par
Target:\par
Minimum 80% test coverage.\par
\par
========================\par
PHASE 8 \emdash  DEVOPS\par
================\par
\par
1. Docker\par
\par
* Production Dockerfile\par
* Development Dockerfile\par
\par
2. Docker Compose\par
\par
* API\par
* PostgreSQL\par
* Redis\par
\par
3. Environment Validation\par
\par
* Validate env variables at startup.\par
\par
4. CI/CD\par
\par
* GitHub Actions\par
* Lint\par
* Test\par
* Build\par
* Deploy\par
\par
========================\par
PHASE 9 \emdash  PERFORMANCE\par
=====================\par
\par
1. Redis Caching\par
2. Query Optimization\par
3. Pagination\par
4. Lazy Loading\par
5. Compression Middleware\par
6. API Response Optimization\par
\par
========================\par
PHASE 10 \emdash  SAAS READINESS\par
=========================\par
\par
Implement missing SaaS features:\par
\par
1. Team Management\par
2. Invitation System\par
3. User Management\par
4. Subscription Ready Architecture\par
5. Billing Ready Architecture\par
6. Audit Logs\par
7. Activity History\par
8. Notification Infrastructure\par
9. Email Infrastructure\par
10. Feature Flag System\par
\par
========================\par
FINAL DELIVERABLE\par
=================\par
\par
Provide:\par
\par
1. Full code implementation.\par
2. Updated folder structure.\par
3. Security report.\par
4. Scalability report.\par
5. Production readiness report.\par
6. Database optimization report.\par
7. List of all modified files.\par
8. List of all new files.\par
9. Migration instructions.\par
10. Deployment instructions.\par
\par
Important:\par
Do not generate pseudo-code.\par
Do not leave TODO comments.\par
Implement production-quality code directly inside the existing project architecture.\par
Preserve existing functionality while applying all improvements.\f0\lang9\par
}