backend setup

[OumB2021]

Summary by CodeRabbit

• New Features
  • Added additional API route wiring for posts, likes, uploads, users, and webhooks.
• Bug Fixes
  • Improved CORS origin parsing and set the default CORS origin to http://localhost:3000.
  • Standardized API error responses, including validation (400) and server errors (500) with clearer structured payloads.
• Chores
  • Updated middleware ordering guidance and adjusted server route/middleware registration.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds five Express router modules, mounts them in the API entrypoint, updates the CORS origin default to http://localhost:3000, and changes error responses to include success: false.

Changes

API routing and response/config updates

Layer / File(s)	Summary
CORS origin default apps/api/src/config/env.ts	The CORS_ORIGIN transform is updated and the schema default becomes http://localhost:3000.
Router module stubs apps/api/src/routes/posts.ts, apps/api/src/routes/likes.ts, apps/api/src/routes/uploads.ts, apps/api/src/routes/users.ts, apps/api/src/routes/webhooks.ts	Each file imports Express Router and exports an initialized router instance with no handlers.
Entrypoint router wiring apps/api/src/index.ts	The API entrypoint imports the new routers, updates the Clerk middleware comment, removes the unused requireAuth import, and mounts the routers beside /health.
Error response shape apps/api/src/middleware/errorHandler.ts	The handler logs before the ZodError check and adds success: false to both validation and fallback JSON responses.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is generic and does not clearly describe the specific backend routing, middleware, and env changes in the PR.	Rename it to a concise, specific summary such as adding backend route setup and API middleware changes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch backend_setup

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/api/src/config/env.ts`:
- Around line 5-6: Restore URL validation in the env schema so malformed
connection strings fail at boot instead of later; update the Zod definitions in
env.ts for DATABASE_URL and REDIS_URL to use the URL-specific validator again,
keeping the REDIS_URL default while still enforcing valid URL format. Locate the
change in the env schema constants where DATABASE_URL and REDIS_URL are
declared.
- Line 9: The `CORS_ORIGIN` env default in `env.ts` is too permissive because it
allows any origin by default. Update the `env` schema to require an explicit
allow-listed origin value (or a validated list) instead of `"*"`, and make
`apps/api/src/index.ts`’s `cors({ origin: env.CORS_ORIGIN })` use that
restricted setting so only approved app origins are accepted.

In `@apps/api/src/index.ts`:
- Around line 17-18: The CORS setup in app.use(cors({ origin: env.CORS_ORIGIN
})) is too permissive because env.CORS_ORIGIN can default to "*", so replace it
with explicit allow-list validation for app origins only. Update the CORS
configuration in the app bootstrap to parse a comma-separated allow-list and use
a cors() callback that checks the request origin against that list, rather than
passing the env string directly. Use the existing cors middleware setup in
index.ts and the CORS_ORIGIN config from env.ts as the main points to adjust.

In `@apps/api/src/middleware/errorHandler.ts`:
- Around line 10-16: Unconditional raw error logging in errorHandler can leak
user-submitted data, especially for ZodError validation failures. Update the
errorHandler middleware to avoid calling console.error(err) for expected 4xx
validation cases; instead, only log unexpected server errors or use a
structured/redacting logger that does not dump the full error object. Keep the
existing ZodError branch behavior intact while ensuring the logging path is
gated by the error type/status.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0f42be48-de0d-4b4a-8a70-9c15aa3ff1d2

📥 Commits

Reviewing files that changed from the base of the PR and between 869750f and a6baebd.

📒 Files selected for processing (8)

• apps/api/src/config/env.ts
• apps/api/src/index.ts
• apps/api/src/middleware/errorHandler.ts
• apps/api/src/routes/likes.ts
• apps/api/src/routes/posts.ts
• apps/api/src/routes/uploads.ts
• apps/api/src/routes/users.ts
• apps/api/src/routes/webhooks.ts

[coderabbitai]

🧹 Nitpick comments (1)

apps/api/src/config/env.ts (1)

9-17: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consider validating each origin as a well-formed URL.

The transform splits/trims values but doesn't validate that each resulting entry is a valid URL, so a malformed CORS_ORIGIN env value (e.g., missing scheme) would pass parsing and only fail silently at request time rather than failing fast at boot, consistent with the "fail-fast env validation on boot" guideline applied elsewhere in this file (e.g. DATABASE_URL/REDIS_URL now use .url()).

🔧 Proposed fix

   CORS_ORIGIN: z
     .string()
     .transform((val) =>
       val
         .split(",")
         .map((origin) => origin.trim())
-        .filter(Boolean),
+        .filter(Boolean)
+        .map((origin) => {
+          z.string().url().parse(origin);
+          return origin;
+        }),
     )
     .default("http://localhost:3000"),

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/api/src/config/env.ts` around lines 9 - 17, The CORS_ORIGIN env parsing
in env.ts only splits and trims values, so malformed origins can slip through
and fail later at runtime. Update the CORS_ORIGIN schema to validate each parsed
entry as a proper URL before returning it, similar to the fail-fast handling
used for DATABASE_URL and REDIS_URL. Keep the transform logic in the CORS_ORIGIN
field, but add per-item URL validation so boot-time config parsing rejects
invalid origins immediately.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@apps/api/src/config/env.ts`:
- Around line 9-17: The CORS_ORIGIN env parsing in env.ts only splits and trims
values, so malformed origins can slip through and fail later at runtime. Update
the CORS_ORIGIN schema to validate each parsed entry as a proper URL before
returning it, similar to the fail-fast handling used for DATABASE_URL and
REDIS_URL. Keep the transform logic in the CORS_ORIGIN field, but add per-item
URL validation so boot-time config parsing rejects invalid origins immediately.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c559f2dd-ba02-46ef-bc91-a71a847bd898

📥 Commits

Reviewing files that changed from the base of the PR and between a6baebd and fa5624e.

📒 Files selected for processing (1)

• apps/api/src/config/env.ts