fix(security): resolve critical and high technical debt from audit
CognxSafeTrack
a8e18d6
CRITICAL:
- Exclude passwordHash from enrollment list response (admin.ts)
- Add sanitizeOrg() to strip API keys/tokens from all org GET responses
- Fix CORS wildcard on SSE stream; use request origin instead
- Restrict super-admin routes to SUPER_ADMIN role only (was also allowing ADMIN)
- Replace all Zod .parse() with .safeParse() → proper 400s instead of 500s (ai.ts, admin.ts)
HIGH:
- Increase ExerciseHandler Redis dedup lock from 30s to 300s
- Add take:500 to unbounded trainingData.findMany (OOM risk)
- Add take limits to message/contact findMany queries
- Add Redis lock in EnrollHandler to prevent duplicate enrollments (TOCTOU)
- Wrap override-feedback in try/catch; return 404 on P2025
- Use atomic increment for wallet credits (was TOCTOU race condition)
- Scope messages/send to requesting org (was cross-org accessible)
MEDIUM:
- decryptSecrets returns new object instead of mutating argument in-place
- GeminiProvider.generateStructuredData now validates response with Zod schema
-…
