Fix CORS handling, SSE users, and admin route cleanup

Author: Anthony-19

backend/.env.example

@@ -45,7 +45,3 @@ ADMIN_PUBLIC_KEY=
 # Leave empty to run in single-instance mode (no Redis required).
 REDIS_URL=
 
-# ─── Admin ───────────────────────────────────────────────────────────────────
-# Bearer token required for GET /v1/admin/metrics.
-# Leave empty to disable the admin endpoint entirely.
-ADMIN_SECRET=

backend/package.json

@@ -5,6 +5,7 @@
   "type": "module",
   "main": "index.js",
   "scripts": {
+    "prebuild": "prisma generate",
     "test": "vitest run",
     "dev": "nodemon",
     "build": "tsc",

backend/src/app.ts

@@ -65,8 +65,8 @@ app.use(cors({
 }));
 
 // Convert CORS errors into 403 responses so callers get a clear status code
-app.use((err: any, req: Request, res: Response, next: NextFunction) => {
-    if (err && err.message === 'CORS origin not allowed') {
+app.use((err: unknown, req: Request, res: Response, next: NextFunction) => {
+    if (err instanceof Error && err.message === 'CORS origin not allowed') {
         res.status(403).json({ error: 'CORS origin not allowed' });
         return;
     }

backend/src/controllers/sse.controller.ts

@@ -7,6 +7,7 @@ import { z } from 'zod';
 
 const subscribeSchema = z.object({
   streams: z.array(z.string()).optional().default([]),
+  users: z.array(z.string()).optional().default([]),
   all: z.boolean().optional().default(false),
 });
 
@@ -41,7 +42,7 @@ export const subscribe = async (req: Request, res: Response) => {
     }
 
     const { publicKey } = (req as AuthenticatedRequest).user;
-    const { streams, all } = subscribeSchema.parse(req.query);
+    const { streams, users, all } = subscribeSchema.parse(req.query);
 
     // Scope: only streams where the authenticated user is sender or recipient
     const ownedStreams = await prisma.stream.findMany({
@@ -61,6 +62,8 @@ export const subscribe = async (req: Request, res: Response) => {
       subscriptions = [...ownedIds] as string[];
     }
 
+    subscriptions.push(...users.map((userKey) => `user:${userKey}`));
+
     // Always add user-scoped subscription key
     subscriptions.push(`user:${publicKey}`);
 
@@ -77,11 +80,11 @@ export const subscribe = async (req: Request, res: Response) => {
     res.write(`data: ${JSON.stringify({ type: 'connected', clientId, requestId })}\n\n`);
 
     sseService.addClient(clientId, res, subscriptions, sourceIp);
-  } catch (error: any) {
-    if (error.name === 'ZodError') {
+  } catch (error: unknown) {
+    if (error instanceof z.ZodError) {
       return res.status(400).json({
         message: 'Invalid subscription parameters',
-        errors: error.errors,
+        errors: error.issues,
       });
     }
     return res.status(500).json({ message: 'Internal server error' });

backend/src/routes/adminRoutes.ts

@@ -4,7 +4,6 @@ import eventsRoutes from './events.routes.js';
 import userRoutes from './user.routes.js';
 import authRoutes from './auth.routes.js';
 import adminRoutes from './admin.routes.js';
-import adminMetricsRoutes from '../adminRoutes.js';
 
 const router = Router();
 
@@ -16,6 +15,5 @@ router.use('/auth', authRoutes);
 
 // Admin routes
 router.use('/admin', adminRoutes);
-router.use('/admin/metrics', adminMetricsRoutes);
 
 export default router;

backend/src/routes/v1/index.ts

@@ -71,6 +71,23 @@ describe('SSE Controller', () => {
     expect(sseService.addClient).toHaveBeenCalled();
   });
 
+  it('should include user subscriptions when users query params are provided', async () => {
+    (sseService.isShuttingDown as any).mockReturnValue(false);
+    (sseService.checkCapacity as any).mockReturnValue({ allowed: true });
+    (req as any).user = { publicKey: 'GUSER1' };
+    (prisma.stream.findMany as any).mockResolvedValue([{ streamId: 'stream-1' }]);
+    req.query = { users: ['GUSER2', 'GUSER3'] };
+
+    await subscribe(req as Request, res as Response);
+
+    expect(sseService.addClient).toHaveBeenCalledWith(
+      expect.any(String),
+      expect.any(Object),
+      expect.arrayContaining(['stream-1', 'user:GUSER2', 'user:GUSER3', 'user:GUSER1']),
+      expect.any(String),
+    );
+  });
+
   it('should handle zod validation error for query params', async () => {
     (sseService.isShuttingDown as any).mockReturnValue(false);
     (sseService.checkCapacity as any).mockReturnValue({ allowed: true });