Critical Securities (5) fixes

src/servers/hono.ts

@@ -25,7 +25,7 @@ import { integrationsRouter, googleCallbackHandler } from './api/integrations/in
 import { queueRouter } from './api/queue/queue';
 import { emailRouter } from './api/email/email';
 import { CustomError } from './custom-errors';
-import { userMiddleware, bodyParser } from './_middlewares';
+import { userMiddleware, bodyParser, isOriginAllowed, superAdminMiddleware } from './_middlewares';
 
 export { Hono };
 export { createRouter };
@@ -35,7 +35,10 @@ export const honoServer = new Hono<{ Variables: HonoVariables }>();
 
 honoServer.use(
   cors({
-    origin: '*',
+    origin: (origin, c) => {
+      const host = c.req.header('host');
+      return isOriginAllowed(origin, host) ? origin : '';
+    },
     allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
     allowHeaders: ['Content-Type', 'Authorization'],
   }),
@@ -43,16 +46,22 @@ honoServer.use(
 
 honoServer.get('/api', (ctx) => ctx.json({ officerAPI: 'ok' }));
 honoServer.route('/api/auth', authRouter);
-honoServer.route('/api/server-settings', serverSettingsRouter);
 honoServer.route('/api/landing-page-data', landingPageDataRouter);
 honoServer.route('/api/waitlist', waitlistRouter);
 honoServer.route('/api/dev-server-proxy', devServerProxyRouter);
 honoServer.get('/api/integrations/google/callback', googleCallbackHandler);
+honoServer.get('/api/server-settings/onboarding-complete', async (ctx) => {
+  const { readSettings } = await import('./api/server-settings/server-settings');
+  const settings = await readSettings();
+  return ctx.json({ onboardingComplete: !!settings.onboardingComplete });
+});
 
 const protectedRouter = createRouter();
 protectedRouter.use(bodyParser());
 protectedRouter.use(userMiddleware);
 
+serverSettingsRouter.use(superAdminMiddleware);
+protectedRouter.route('/server-settings', serverSettingsRouter);
 protectedRouter.route('/users', usersRouter);
 protectedRouter.route('/plans', plansRouter);
 protectedRouter.route('/skills', skillsRouter);