Añadidos settings de cookies y privacidad

apps/parapharmacy-api/src/routes/products.js

@@ -343,9 +343,21 @@ router.post('/bulk', requireServiceKey('INGEST_API_KEY'), async (req, res) => {
  */
 router.put('/:id', requireServiceKey('ADMIN_API_KEY'), async (req, res) => {
   try {
+    // Allowlist: only these fields can be modified via PUT
+    const ALLOWED_FIELDS = [
+      'name', 'brand', 'category', 'subcategory', 'description',
+      'image_url', 'source_url', 'price', 'original_price', 'source',
+      'source_product_id', 'available', 'rating', 'review_count',
+    ];
+    const update = {};
+    for (const field of ALLOWED_FIELDS) {
+      if (field in req.body) update[field] = req.body[field];
+    }
+    update.updated_at = new Date();
+
     const product = await Product.findByIdAndUpdate(
       req.params.id,
-      { ...req.body, updated_at: new Date() },
+      update,
       { new: true }
     );