security: harden production configuration and routes

apps/parapharmacy-api/src/server.js

@@ -53,7 +53,7 @@ const swaggerSpec = swaggerJsdoc(swaggerOptions);
 
 // Middleware
 app.use(cors(config.cors));
-app.use(express.json({ limit: '10mb' }));
+app.use(express.json({ limit: '1mb' }));
 app.use(morgan('combined'));
 
 // Rate limiting
@@ -66,11 +66,13 @@ const limiter = rateLimit({
 app.use(limiter);
 
 // Swagger UI
-app.use('/api/docs', swaggerUi.serve, swaggerUi.setup(swaggerSpec, {
-  explorer: true,
-  customCss: '.swagger-ui .topbar { display: none }',
-  customSiteTitle: 'FarmaFinder Parapharmacy API',
-}));
+if (!['production', 'test'].includes(process.env.NODE_ENV)) {
+  app.use('/api/docs', swaggerUi.serve, swaggerUi.setup(swaggerSpec, {
+    explorer: true,
+    customCss: '.swagger-ui .topbar { display: none }',
+    customSiteTitle: 'FarmaFinder Parapharmacy API',
+  }));
+}
 
 // Routes
 app.use('/api/products', productsRouter);
@@ -131,6 +133,6 @@ process.on('SIGINT', async () => {
   process.exit(0);
 });
 
-start();
+if (process.env.NODE_ENV !== 'test') start();
 
 export default app;