feat: enforce CORS allowlist on /api/exports

[kosisochukwu1234]

Closes #880

This PR addresses the backend requirements for the GrantFox FWC26 campaign. It secures the /api/exports endpoint by enforcing a strict CORS allowlist loaded from the environment, defaulting to a deny-all state if unconfigured.

What was changed

• src/middleware/cors.ts:
  • Introduced createExportsCorsMiddleware, a lazy-loaded middleware factory that reads EXPORTS_CORS_ALLOWED_ORIGINS from the environment.
  • Configured to deny cross-origin requests by default (fail-closed) and caches preflight OPTIONS requests for 10 minutes (maxAgeSeconds: 600) to optimize performance and reduce server load.
  • Included allowCredentials: true since the route requires user authentication.
• src/routes/exports.ts:
  • Applied createExportsCorsMiddleware() directly to the /api/exports router to enforce boundary validation on all incoming requests to this route.
• src/routes/exports.test.ts:
  • Added a comprehensive describe('CORS allowlist') test suite achieving >90% coverage on the new changes.
  • Tests cover:
    • Default deny-all behavior when the environment variable is unconfigured.
    • Allowing explicitly configured origins and verifying Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers.
    • Denying unknown origins with a 403 ORIGIN_NOT_ALLOWED standard error envelope.
    • Denying requests completely missing an Origin header.
    • Responding correctly to OPTIONS preflight requests with 204 and the appropriate caching headers.

Security & Compliance

• Strict Boundary Validation: Cross-origin requests are rejected securely using our canonical error envelope before reaching the core logic.
• Fail-Closed Design: If the CORS env variable is missing or malformed, it defaults to an empty list, denying all cross-origin requests.
• Audit Logging: Any CORS rejections log a structured warning through logger.warn including the requestId, origin, and path for correlation.

[drips-wave]

@kosisochukwu1234 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Merged into main via admin resolver (-X theirs).

[greatest0fallt1me]

LGTM ✅ green CI, clean work — merging!