1780 bug correct cors configuration on admin route group

src/config/express.ts

@@ -349,11 +349,22 @@ export function applySecurityMiddleware(app: Application): void {
   app.use(reportToMiddleware);
 
   // 4. CORS (exact-match allowlist, no wildcards).
-  app.use(cors(corsOptions));
+  const globalCors = cors(corsOptions);
+  app.use((req, res, next) => {
+    if (req.path.startsWith("/api/admin")) {
+      return next();
+    }
+    return globalCors(req, res, next);
+  });
 
   // 5. Maintenance Mode (blocks non-GET requests when active)
   app.use(maintenanceModeMiddleware);
 
   // 6. Respond to all OPTIONS preflight requests immediately.
-  app.options("*", cors(corsOptions));
+  app.options("*", (req, res, next) => {
+    if (req.path.startsWith("/api/admin")) {
+      return next();
+    }
+    return globalCors(req, res, next);
+  });
 }

src/index.ts

@@ -120,6 +120,7 @@ import { layeredCache } from "./services/layeredCache";
 import { ERROR_CODES } from "./constants/errorCodes";
 import { startApolloServer } from "./graphql/server";
 import { applySecurityMiddleware } from "./config/express";
+import { createCorsMiddleware } from "./middleware/cors";
 
 dotenv.config();
 
@@ -454,6 +455,9 @@ app.use("/api/mtn", mtnCallbacksRouter);
 app.use("/api/orange-madagascar", orangeMadagascarCallbacksRouter);
 app.use("/api/orange-guinea", orangeGuineaCallbacksRouter);
 app.use("/api/multisig", multisigCallbacksRouter);
+
+// Apply custom configurable CORS allowlist for admin routes
+app.use("/api/admin", createCorsMiddleware());
 app.use("/api/admin/withdrawals", adminWithdrawalsRouter);
 app.use("/api/reports", reportsRoutes);
 app.use("/api/fees", feesRoutes);

src/routes/transactions.ts

@@ -51,6 +51,12 @@ transactionRoutes.get(
           error: "Transaction not found",
         });
 
+      if (transaction.userId !== req.jwtUser?.userId) {
+        throw createError(ERROR_CODES.FORBIDDEN, "Access denied", {
+          error: "You do not have permission to access this transaction",
+        });
+      }
+
       const pdf = await generateTransactionPdfBuffer(transaction);
 
       res.setHeader("Content-Type", "application/pdf");
@@ -92,6 +98,10 @@ transactionRoutes.get(
       if (!transaction)
         return res.status(404).json({ error: "Transaction not found" });
 
+      if (transaction.userId !== req.jwtUser?.userId) {
+        return res.status(403).json({ error: "You do not have permission to access this transaction" });
+      }
+
       if (transaction.status !== TransactionStatus.Completed)
         return res.status(400).json({
           error:

src/routes/v1/transactions.ts

@@ -120,6 +120,10 @@ transactionRoutesV1.get(
       if (!transaction)
         return res.status(404).json({ error: "Transaction not found" });
 
+      if (transaction.userId !== req.jwtUser?.userId && req.user?.role !== "admin") {
+        return res.status(403).json({ error: "You do not have permission to access this transaction" });
+      }
+
       if (transaction.status !== TransactionStatus.Completed)
         return res.status(400).json({
           error: