[Dantama022]

Summary of Changes

This PR implements and verifies all four coordinated fixes across the backend and contract layers:

1. #1674 — Disable Swagger UI and OpenAPI JSON in production by default

• Updated backend/src/swagger.ts to disable both /docs (Swagger UI) and /docs/openapi.json by default when NODE_ENV=production.
• In production, Swagger is only enabled when SWAGGER_ENABLED=true.
• Added support for DISABLE_SWAGGER=true to unconditionally disable Swagger endpoints across all environments.
• Preserved default-enabled behavior in development/test.
• Added comprehensive unit and integration tests in backend/src/__tests__/openapi.test.ts.

2. #1677 — Fail fast at startup when CORS_ALLOWED_ORIGINS is unset in production

• Added validateCorsConfig() in backend/src/middleware/cors.ts which runs synchronously at startup in backend/src/index.ts before app.listen().
• Throws an actionable configuration error if NODE_ENV=production and CORS_ALLOWED_ORIGINS is missing, empty, or whitespace-only.
• Added test coverage in backend/src/__tests__/cors.test.ts.

3. #1678 — Configure Express trust proxy explicitly for real client IP rate limiting

• Implemented parseTrustProxyConfig() in backend/src/rateLimiter.ts to safely parse non-negative integer hop counts from TRUST_PROXY (defaulting to 0).
• Strictly rejects true, "true", negative numbers, decimals, or non-numeric strings to prevent IP spoofing vulnerabilities.
• Set app.set('trust proxy', parseTrustProxyConfig()) on the Express instance in backend/src/index.ts.
• Added unit tests in backend/src/__tests__/rateLimit.test.ts verifying hop counting and spoofing resistance.

4. #1679 — Align rounding documentation & tests with shares-in vault withdraw

• Updated contracts/share-price-math/src/rounding.rs table and doc comments to explicitly distinguish the vault's actual withdraw(user, shares) entrypoint (shares-in, assets-out, round-down) from conceptual ERC-4626 withdraw(assets) (assets-in, shares-out, round-up).
• Added test_rounding_up_calculation_branch_and_boundaries testing Rounding::Up with non-exact conversion ratios, exact divisibility boundaries, and zero denominator rejection.

5. Documentation & Hygiene

• Documented SWAGGER_ENABLED, DISABLE_SWAGGER, CORS_ALLOWED_ORIGINS (production), and TRUST_PROXY in backend/.env.example, backend/.env.production.example, and docs/ENV_VARIABLE_MATRIX.md.
• Regenerated backend/openapi.json to remain in full synchronization with the router stack.
• Added node_modules/ to .gitignore to prevent tracking dependency files.

---

Verification Results

• Backend Tests: 44/44 passed (openapi.test.ts, cors.test.ts, rateLimit.test.ts).
• OpenAPI Schema Check: pnpm run check:openapi passed with 0 drift.
• Contract Tests: 14/14 passed (cargo test -p share-price-math).
• Line Endings: pnpm validate:line-endings passed cleanly.

---

Closes #1674
Closes #1677
Closes #1678
Closes #1679

[drips-wave]

@Dantama022 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits