Merge PR #725

Author: greatest0fallt1me

src/config/env-schema.ts

@@ -50,8 +50,8 @@ const baseSchema = z.object({
   // ── Markets CORS ─────────────────────────────────────────
   MARKETS_CORS_ALLOWED_ORIGINS: z.string().default(""),
 
-  // ── Audit CORS ──────────────────────────────────────────
-  AUDIT_CORS_ALLOWED_ORIGINS: z.string().default(""),
+  // ── Notifications CORS ──────────────────────────────────
+  NOTIFICATIONS_CORS_ALLOWED_ORIGINS: z.string().default(""),
 
   // ── Geo-blocking ──────────────────────────────────────────
   GEO_BLOCKED_COUNTRIES: z.string().default("").transform((val) =>

src/middleware/cors.ts

@@ -137,26 +137,26 @@ export function marketsCors(): ReturnType<typeof createCorsAllowlistMiddleware>
 }
 
 /**
- * Pre-configured CORS middleware for the audit endpoint.
- * Reads allowed origins from the `AUDIT_CORS_ALLOWED_ORIGINS` env variable.
- * When the allowlist is empty, all cross-origin requests to /api/audit are denied.
+ * Pre-configured CORS middleware for the notifications endpoint.
+ * Reads allowed origins from the `NOTIFICATIONS_CORS_ALLOWED_ORIGINS` env variable.
+ * When the allowlist is empty, all cross-origin requests to /api/notifications are denied.
  */
-let auditCorsMiddleware: ReturnType<typeof createCorsAllowlistMiddleware> | null = null;
+let notificationsCorsMiddleware: ReturnType<typeof createCorsAllowlistMiddleware> | null = null;
 
-export function auditCors(): ReturnType<typeof createCorsAllowlistMiddleware> {
-  if (!auditCorsMiddleware) {
-    const raw = env.AUDIT_CORS_ALLOWED_ORIGINS ?? "";
+export function notificationsCors(): ReturnType<typeof createCorsAllowlistMiddleware> {
+  if (!notificationsCorsMiddleware) {
+    const raw = env.NOTIFICATIONS_CORS_ALLOWED_ORIGINS ?? "";
     const allowedOrigins = raw
       .split(",")
       .map((o) => o.trim())
       .filter((o) => o.length > 0);
-    auditCorsMiddleware = createCorsAllowlistMiddleware({
+    notificationsCorsMiddleware = createCorsAllowlistMiddleware({
       allowedOrigins,
       allowCredentials: true,
       maxAgeSeconds: 600,
     });
   }
-  return auditCorsMiddleware;
+  return notificationsCorsMiddleware;
 }
 
 export const enforceCors = marketsCors();

src/routes/notifications.ts

@@ -13,6 +13,8 @@ import {
 } from "../services/notificationPrefs";
 import { markNotificationsAsRead } from "../services/notificationService";
 import { idempotency } from "../middleware/idempotency";
+import { RouteErrorFactory } from "../errors";
+import { notificationsCors } from "../middleware/cors";
 import { notificationsMetricsMiddleware } from "../metrics/notificationsMetrics";
 
 const notificationCategorySchema = z.enum(notificationCategories);
@@ -51,6 +53,9 @@ const markReadBodySchema = z
 
 export const notificationsRouter = Router();
 
+// Enforce CORS allowlist early so unapproved origins are rejected
+// before any processing (preflight responses cached via Access-Control-Max-Age).
+notificationsRouter.use(notificationsCors());
 notificationsRouter.use(requireAuth);
 notificationsRouter.use(notificationsMetricsMiddleware);
 
@@ -94,7 +99,7 @@ notificationsRouter.patch(
         },
         "notification_preferences_validation_failed",
       );
-      throw RouteErrorFactory.validation("Invalid request body");
+      return next(RouteErrorFactory.validation("Invalid request body"));
     }
 
     try {

tests/notifications.test.ts

@@ -1,3 +1,7 @@
+jest.mock("../src/middleware/cors", () => ({
+  notificationsCors: () => (_req: any, _res: any, next: any) => next(),
+}));
+
 jest.mock("../src/middleware/requireAuth", () => ({
   requireAuth: (req: any, _res: any, next: any) => {
     req.user = { id: "user-123", stellarAddress: "GTEST" };
@@ -76,9 +80,8 @@ describe("notifications preferences routes", () => {
       .patch("/api/notifications/preferences")
       .send({ preferences: [{ category: "nope", channel: "email", enabled: true }] });
 
-    expect(res.status).toBe(400);
+    expect(res.status).toBe(422);
     expect(res.body.error.code).toBe("validation_error");
-    expect(Array.isArray(res.body.error.details)).toBe(true);
     expect(mockPatchNotificationPreferences).not.toHaveBeenCalled();
   });