security: harden production configuration and routes

apps/backend/server.js

@@ -26,6 +26,9 @@ import multer from 'multer';
 import { searchMedicines, getMedicineDetails, searchOTC } from './cima-service.js';
 import { runFarmaciaWebhookImport, DEFAULT_FARMACIAS_WEBHOOK, importPharmaciesFromRows } from './farmacias-webhook-import.js';
 import { fetchPharmaciesExternal } from '../API/index.js';
+import { validateProductionEnv } from './src/config/required-env.js';
+
+validateProductionEnv();
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -81,11 +84,11 @@ if (PG_URL) {
 }
 
 const sessionConfig = {
-  secret: process.env.SESSION_SECRET || 'farma-clic-secret-key-change-in-production',
+  secret: process.env.SESSION_SECRET || (process.env.NODE_ENV === 'test' ? 'test-only-session-secret' : undefined),
   resave: false,
   saveUninitialized: false,
   cookie: {
-    secure: process.env.COOKIE_SECURE === 'true',
+    secure: process.env.NODE_ENV === 'production' || process.env.COOKIE_SECURE === 'true',
     sameSite: 'lax',
     httpOnly: true,
     maxAge: 24 * 60 * 60 * 1000 // 24 hours
@@ -2648,4 +2651,3 @@ if (process.env.NODE_ENV !== 'test') {
     });
   });
 }
-