Some changes to improve quality

[IyanRobles]

I have excluded some files that shouldn't count towards the coverage from the sonarcloud analysis, reviewed and fixed some security hotspots and implemented some more tests for the gateway. There is still a security hotspot with docker and the reliability rating still needs to be checked but I think with this we will already pass the coverage part.

[sonarqubecloud]

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[didierrc]

All these quality improvements seems good, I appreciate the exclusion coverage of our test.ts files since I believe they are not the aim of SonarCloud to look into it (although, we must write good tests!). About, CORS being more restrictive, could you please explain what are you doing there?

[IyanRobles]

All these quality improvements seems good, I appreciate the exclusion coverage of our test.ts files since I believe they are not the aim of SonarCloud to look into it (although, we must write good tests!). About, CORS being more restrictive, could you please explain what are you doing there?

Previously we were allowing resources from any origin and, according to sonarcloud, this can lead to different vulnerabilities such as CVE-2018-0269 and CVE-2017-14460.
What I did was adding a whitelist for trusted sites and include just our domains (both the webapp and the gateway), this way it shouldn't be a security concern since it is no longer possible from the client to access resources from external servers, they can just send requests to the webapp and gateway. If it's too restrictive we can still expand this list but I think it's working properly for the moment.
Also, for the whitelist I first check if there is any API_URI set and if it is then i use that instead of localhost so I think this should work fine when deploying.

[didierrc]

Thank you for explaining that! Everything is OK