fix(backend,contracts): secure swagger, fail-fast CORS, configure trust proxy, and align withdraw rounding docs (#1674, #1677, #1678, #1679)

.gitignore

@@ -3,6 +3,7 @@
 /contracts/vault/target
 
 # Node
+node_modules/
 /frontend/node_modules
 /backend/node_modules
 /backend/prisma/*.db

backend/.env.example

@@ -12,6 +12,22 @@
 PORT=3000
 NODE_ENV=development
 
+# Trust Proxy Configuration (#1678)
+# Non-negative integer hop count of trusted reverse proxies between clients and Express.
+# Defaults to 0 (direct connection / untrusted X-Forwarded-For).
+# Guidelines:
+# - Direct access / local development: 0 (or omit)
+# - Behind a single reverse proxy/load balancer (e.g., AWS ALB, Nginx): 1
+# - Behind two hops (e.g., Cloudflare CDN in front of an AWS ALB): 2
+TRUST_PROXY=0
+
+# Swagger / OpenAPI Documentation (#1674)
+# In production (NODE_ENV=production), Swagger UI and /docs/openapi.json are disabled by default.
+# - Set SWAGGER_ENABLED=true to explicitly enable Swagger in production.
+# - Set DISABLE_SWAGGER=true to force-disable Swagger across all environments.
+SWAGGER_ENABLED=false
+DISABLE_SWAGGER=false
+
 # Rate Limiting Configuration
 # Global rate limiter: 100 requests per 15 minutes (900000 ms)
 RATE_LIMIT_WINDOW_MS=900000
@@ -145,8 +161,10 @@ CACHE_MAX_ENTRIES=500
 # Per-command timeout for Redis cache operations (ms)
 # REDIS_CACHE_COMMAND_TIMEOUT_MS=500
 
-# CORS Configuration
+# CORS Configuration (#1677)
 # Comma-separated list of allowed origins. Supports strings or regex like /https?:\/\/.*\.yieldvault\.finance/
+# In production (NODE_ENV=production), CORS_ALLOWED_ORIGINS is strictly REQUIRED.
+# The server fails fast at startup if it is unset, empty, or whitespace-only.
 CORS_ALLOWED_ORIGINS=http://localhost:3000,https://app.yieldvault.finance
 
 # Email Notification Configuration

backend/.env.production.example

@@ -6,6 +6,20 @@
 PORT=3000
 NODE_ENV=production
 
+# Trust Proxy Configuration (#1678)
+# Non-negative integer hop count of trusted reverse proxies between clients and Express.
+# Default: 0 (direct connection).
+# Set to 1 if deployed behind an AWS ALB, GCP HTTPS Load Balancer, or Nginx.
+# Set to 2 if deployed behind Cloudflare CDN + AWS ALB.
+# CRITICAL: Do NOT set to true (unrestricted trust is rejected).
+TRUST_PROXY=1
+
+# Swagger UI and OpenAPI JSON Specification (#1674)
+# Disabled by default in production for security.
+# Set to true only if you explicitly intend to expose documentation in production.
+SWAGGER_ENABLED=false
+DISABLE_SWAGGER=false
+
 # Rate Limiting Configuration (strict for production)
 RATE_LIMIT_WINDOW_MS=900000
 RATE_LIMIT_MAX_REQUESTS=100
@@ -41,8 +55,10 @@ PRISMA_QUERY_TIMEOUT_MS=5000
 PRISMA_TX_MAX_WAIT_MS=5000
 PRISMA_TX_TIMEOUT_MS=10000
 
-# CORS Configuration - PRODUCTION
-# IMPORTANT: Restrict to your production domains only
+# CORS Configuration - PRODUCTION (REQUIRED - Issue #1677)
+# CRITICAL: CORS_ALLOWED_ORIGINS is strictly required in production.
+# The server will FAIL STARTUP before listening if this variable is unset, empty, or whitespace-only.
+# Restrict to your exact production domains only (never use wildcard `*`).
 CORS_ALLOWED_ORIGINS=https://app.yieldvault.finance,https://www.yieldvault.finance
 
 # Email Notification Configuration - PRODUCTION