feat(api): add security plugins

Signed-off-by: iverly <[email protected]>

apps/api/src/main.ts

@@ -18,6 +18,8 @@ import {
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { ResponseFormatterInterceptor } from '@nx-next-nest-prisma-ory-template/utils';
 import { Logger } from 'nestjs-pino';
+import helmet from '@fastify/helmet';
+import csrf from '@fastify/csrf-protection';
 
 async function bootstrap() {
   if (otelEnabled) {
@@ -38,6 +40,11 @@ async function bootstrap() {
 
   const httpAdapter = app.getHttpAdapter();
 
+  // Security plugins
+  app.enableCors();
+  await app.register(helmet);
+  await app.register(csrf);
+
   // Validation pipe
   app.useGlobalPipes(
     new ValidationPipe({

package.json

@@ -20,6 +20,9 @@
     "postinstall": "pnpm prisma:generate"
   },
   "dependencies": {
+    "@fastify/cors": "^8.4.1",
+    "@fastify/csrf-protection": "^6.4.1",
+    "@fastify/helmet": "^11.1.1",
     "@fastify/static": "^6.12.0",
     "@nestjs/common": "^10.2.10",
     "@nestjs/config": "^3.1.1",