🛡️ Sentinel: [HIGH] Enable Rate Limiting and Fix Error Handling

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2025-05-18 - Global Error Handler Swallowing 4xx Status Codes
+**Vulnerability:** The backend global error handler (`errorHandler`) defaulted to status code 500 for any caught exception that didn't have a strictly defined `statusCode` property. This caused the `@fastify/rate-limit` plugin's 429 errors (which use the `code` property or throw a specific error shape) to be returned as 500 Internal Server Error, potentially masking rate limiting actions and confusing clients.
+**Learning:** Fastify plugins and the core framework may emit errors with varying structures (e.g., `code` as a number vs string). A rigid error handler that assumes a specific shape for `statusCode` can inadvertently downgrade semantic client errors into generic server errors.
+**Prevention:** Defensive coding in global error handlers is critical. The handler should check multiple properties (`statusCode`, `code`, `status`) and handle type coercion (string vs number) before falling back to 500. Specifically, handling `code === 429` ensures rate limit events are correctly propagated.

backend/jest.config.js

@@ -0,0 +1,14 @@
+/** @type {import('ts-jest').JestConfigWithTsJest} */
+module.exports = {
+  preset: 'ts-jest',
+  testEnvironment: 'node',
+  transform: {
+    '^.+\\.tsx?$': ['ts-jest', {
+      tsconfig: 'tsconfig.json'
+    }],
+  },
+  setupFiles: ['<rootDir>/jest.setup.js'],
+  moduleNameMapper: {
+    '^@/(.*)$': '<rootDir>/src/$1',
+  },
+};

backend/jest.setup.js

@@ -0,0 +1,37 @@
+// Mock environment variables
+process.env.NODE_ENV = 'test';
+process.env.JWT_SECRET = 'test-secret-key-must-be-long-enough-for-security';
+process.env.DATABASE_URL = 'postgresql://test:test@localhost:5432/test_db';
+process.env.RATE_LIMIT_MAX_REQUESTS = '5'; // Low limit for testing
+process.env.RATE_LIMIT_WINDOW_MS = '60000'; // 1 minute
+
+// Mock Redis to prevent connection errors
+jest.mock('ioredis', () => {
+  return jest.fn().mockImplementation(() => ({
+    on: jest.fn(),
+    connect: jest.fn().mockResolvedValue(undefined),
+    disconnect: jest.fn().mockResolvedValue(undefined),
+    get: jest.fn(),
+    set: jest.fn(),
+    del: jest.fn(),
+    publish: jest.fn(),
+    subscribe: jest.fn(),
+  }));
+});
+
+// Mock logger to avoid noise
+jest.mock('./src/shared/logger', () => ({
+  logger: {
+    info: jest.fn(),
+    error: jest.fn(),
+    warn: jest.fn(),
+    debug: jest.fn(),
+    auth: jest.fn(),
+  },
+  Logger: {
+    info: jest.fn(),
+    error: jest.fn(),
+    warn: jest.fn(),
+    auth: jest.fn(),
+  }
+}));

backend/package.json

@@ -38,7 +38,7 @@
   "dependencies": {
     "@fastify/cors": "^8.4.0",
     "@fastify/helmet": "^11.1.1",
-    "@fastify/jwt": "^10.0.0",
+    "@fastify/jwt": "^8.0.0",
     "@fastify/multipart": "^8.0.0",
     "@fastify/rate-limit": "^9.0.1",
     "@fastify/swagger": "^8.12.0",