feat(security): P0 + partial P1 hardening, CI pipeline, multer v2

[parth0025]

Summary

Closes the critical security and dependency gaps surfaced in the recent codebase audit. All 20 unit tests pass; no behavior change for normal request paths.

Backend security (P0)

• NoSQL regex injection fix — sanitized user-supplied regex inputs across 7 controllers (AI, AdvancedGlobalFilter, Comments, MediaFiles, Project filter, notification-count, trackerDownload) via new utils/escapeRegex.js. Blocks ReDoS and cross-tenant name enumeration.
• Security headers + rate limiting — helmet + global express-rate-limit wired in index.js. CSP disabled to preserve the Vue inline-script setup. trust proxy: 'loopback' to silence ERR_ERL_UNEXPECTED_X_FORWARDED_FOR behind a same-host proxy.
• Multer hardening — all 4 upload call sites now use a shared utils/uploadConfig.js with size/file-count limits, an extension blocklist, and path-traversal protection.
• JWT audience enforcement — new requireCompanyAud middleware checks the JWT aud against any companyId in body/params/query/header for the ~50 verifyJWTTokenV2-only routes. Non-ObjectId values (e.g. USER_PROFILES) pass through.

Dependencies (P0)

• Removed aws-sdk v2 (EOL Sept 2025) — only @aws-sdk/* v3 was actually imported.
• Bumped multer 1.4.5-lts.1 -> 2.1.1 (1.x CVE clearance).

Schema strictness (P1-SEC-11)

• Flipped 7 core schemas to strict: true (tasks, comments, timesheet, history, adminDetail, subscriptionPlan, globalCustomFields).
• Kept 7 intentionally-dynamic schemas (notification counters, Chargebee mirrors, custom-field defs, plan-feature maps) with explanatory comments so they aren't re-flagged.

CI / DevOps (P0)

• .github/workflows/main.yml now runs a validate job (test, audit advisory, frontend build) before the deploy step. Previously deploys ran with zero validation.

Diagnostics

• modules/storage/wasabi/controller.js: 6 generic upload-error rejects replaced with formatS3UploadError(error, context) — logs AWS error Code, status, bucket, key, requestId.

Deferred / documented

• P1-SEC-09 (httpOnly cookies): the frontend reads both cookies via js-cookie (5 files). Flipping httpOnly requires a frontend refactor first. TODO(P1-SEC-09) comments left at both res.cookie sites.

Pre-existing fix pulled in

• tests/utils/imageGuard.test.js: env-var names corrected. Suite goes 19/20 -> 20/20.

Test plan

• npm test — 20/20 passing
• Syntax check every modified file
• escapeRegex round-trip test against ReDoS payload (a+)+
• safeRelativePath smoke test against traversal payloads
• Verified flipped schemas report strict=true at runtime
• Post-merge: log in -> create task -> comment -> upload attachment, verify RateLimit-* headers

Risks to watch

• Strict schemas silently drop unknown fields. If tasks/comments/history features regress, check whether a field was added without declaring it in utils/mongo-handler/schema.js.
• Rate-limit defaults: 600 req/min/IP global. Tunable via GLOBAL_RATE_LIMIT_PER_MIN and TRUST_PROXY.
• Multer v2: mostly compatible API; worth a smoke upload test.

🤖 Generated with Claude Code