feat: enhance security with token blacklisting and input sanitization; add helmet for security headers

backend/src/routes/setup.ts

@@ -3,6 +3,7 @@ import bcrypt from 'bcrypt'
 import { validateBody } from '../middleware/validate.js'
 import { asyncHandler } from '../utils/asyncHandler.js'
 import { AppError } from '../middleware/error.js'
+import { getDb } from '../db/database.js'
 import * as userRepo from '../repositories/userRepo.js'
 import * as settingsRepo from '../repositories/settingsRepo.js'
 import { setupSchema } from '../validators/setupSchemas.js'
@@ -33,54 +34,65 @@ router.post(
   '/',
   validateBody(setupSchema),
   asyncHandler(async (req, res) => {
-    if (getSiteTitle()) {
-      throw new AppError(400, 'Setup already completed')
-    }
+    const db = getDb()
 
-    if (userRepo.countUsers() > 0) {
-      throw new AppError(400, 'Users already exist')
-    }
+    // Atomic transaction prevents race conditions between concurrent setup requests
+    const tx = db.transaction(() => {
+      const title = settingsRepo.getSetting('site_title')
+      if (title) {
+        throw new AppError(400, 'Setup already completed')
+      }
 
-    const {
-      email,
-      password,
-      displayName,
-      siteTitle,
-      language,
-      smtpHost,
-      smtpPort,
-      smtpUser,
-      smtpPass,
-      smtpFrom,
-      smtpSecure,
-      appUrl,
-    } = req.body
+      const userCount = userRepo.countUsers()
+      if (userCount > 0) {
+        throw new AppError(400, 'Users already exist')
+      }
 
-    const passwordHash = await bcrypt.hash(password, SALT_ROUNDS)
+      const {
+        email,
+        password,
+        displayName,
+        siteTitle,
+        language,
+        smtpHost,
+        smtpPort,
+        smtpUser,
+        smtpPass,
+        smtpFrom,
+        smtpSecure,
+        appUrl,
+      } = req.body
 
-    const { id } = userRepo.createUser({
-      email,
-      passwordHash,
-      displayName,
-      role: 'admin',
-      emailVerified: 1,
+      const passwordHash = bcrypt.hashSync(password, SALT_ROUNDS)
+
+      const { id } = userRepo.createUser({
+        email,
+        passwordHash,
+        displayName,
+        role: 'admin',
+        emailVerified: 1,
+      })
+
+      const settings: Array<[string, string]> = [
+        ['site_title', siteTitle?.trim() || 'BrainWave'],
+        ['site_language', language || 'en'],
+        ['maintenance_mode', 'false'],
+      ]
+
+      if (smtpHost !== undefined) settings.push(['smtp_host', smtpHost])
+      if (smtpPort !== undefined) settings.push(['smtp_port', smtpPort])
+      if (smtpUser !== undefined) settings.push(['smtp_user', smtpUser])
+      if (smtpPass !== undefined) settings.push(['smtp_pass', smtpPass])
+      if (smtpFrom !== undefined) settings.push(['smtp_from', smtpFrom])
+      if (smtpSecure !== undefined) settings.push(['smtp_secure', smtpSecure])
+      if (appUrl !== undefined) settings.push(['app_url', appUrl])
+
+      settingsRepo.setSettingsBatch(settings)
+
+      return { id, email, displayName }
     })
 
-    const settings: Array<[string, string]> = [
-      ['site_title', siteTitle?.trim() || 'BrainWave'],
-      ['site_language', language || 'en'],
-      ['maintenance_mode', 'false'],
-    ]
-
-    if (smtpHost !== undefined) settings.push(['smtp_host', smtpHost])
-    if (smtpPort !== undefined) settings.push(['smtp_port', smtpPort])
-    if (smtpUser !== undefined) settings.push(['smtp_user', smtpUser])
-    if (smtpPass !== undefined) settings.push(['smtp_pass', smtpPass])
-    if (smtpFrom !== undefined) settings.push(['smtp_from', smtpFrom])
-    if (smtpSecure !== undefined) settings.push(['smtp_secure', smtpSecure])
-    if (appUrl !== undefined) settings.push(['app_url', appUrl])
-
-    settingsRepo.setSettingsBatch(settings)
+    const { id, email, displayName } = tx()
 
     const token = signToken({
       userId: id,