fix: #739 #740 #741 #742

[oluebubejoy]

Fixes #739
Fixes #740
Fixes #741
Fixes #742

What changed

• [bug] Oracle worker does not handle partial batch failures #739: Oracle worker processKeysWithConcurrency now wraps each key's processKey in its own try/catch — a failure in one key does not abort the batch or cause the entire batch to be retried. Each key's success/failure is tracked independently.
• [perf] PolicyController does not use streaming for large CSV exports #740: Added GET /api/v1/policies/export/csv streaming endpoint — uses database cursor pagination to write CSV rows incrementally, preventing OOM on large exports. Sets Content-Type: text/csv and Content-Disposition: attachment headers.
• [security] Helmet does not configure referrer-policy header #741: Configured Helmet with referrerPolicy: { policy: 'strict-origin-when-cross-origin' } to prevent URL information leakage to third parties.
• [bug] Auth middleware does not handle network partition during token verification #742: Auth middleware now distinguishes infrastructure errors (ECONNREFUSED, ETIMEDOUT, ECONNRESET, etc.) from auth failures — returns 503 Service Unavailable for infrastructure errors so clients know to retry, instead of 401 which misleads.

Why

• [bug] Oracle worker does not handle partial batch failures #739: A single failed reading caused the entire batch to be retried, creating duplicate successful inserts.
• [perf] PolicyController does not use streaming for large CSV exports #740: Building the entire CSV in memory caused OOM on large exports.
• [security] Helmet does not configure referrer-policy header #741: Missing Referrer-Policy header leaked URLs to third parties.
• [bug] Auth middleware does not handle network partition during token verification #742: Network partition during token verification threw unhandled errors (500) instead of failing gracefully (503).

How to test

• [bug] Oracle worker does not handle partial batch failures #739: Simulate a partial batch failure — successful readings are not re-inserted
• [perf] PolicyController does not use streaming for large CSV exports #740: curl -H "Authorization: Bearer ..." /api/v1/policies/export/csv streams CSV rows
• [security] Helmet does not configure referrer-policy header #741: curl -I /api/v1/health shows Referrer-Policy: strict-origin-when-cross-origin
• [bug] Auth middleware does not handle network partition during token verification #742: During a simulated Redis/DB outage, auth middleware returns 503 instead of 500

[drips-wave]

@oluebubejoy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits