Noxa_Jewellery

1. Copy-Paste Format for Redmine Ticket / Comments

Date: Today
Total Hours Logged: 8.0 hrs
Activity: Development & Bug Fixing

Work Done:
1. Staging Authentication Issue Investigation (2.5h):
- Investigated `400 Bad Request` during login OTP delivery on `test.shop.noxajewels.com`.
- Discovered that the origin header sent by browsers was being rejected by the backend's strict CORS validator, which threw an unhandled Error that the global filter converted to an HTTP 400.

2. CORS Security & Infrastructure Fix (2.0h):
- Refactored `main.ts` CORS logic to dynamically support all `noxajewels.com` domains and subdomains (`shop`, `test.shop`, `admin`, `test.admin`).
- Replaced `callback(new Error(...))` with compliant `callback(null, false)` to prevent unhandled server exceptions.
- Updated environment origin definitions in `.env`.

3. Production Security Hardening (1.5h):
- Enforced mandatory `https://` protocol for production domains to mitigate MitM vulnerabilities.
- Restricted `localhost` and `127.0.0.1` origin access strictly to local/dev mode (`NODE_ENV !== 'production'`).
- Verified body-parser limits (10MB) and raw payload handling for Stripe webhooks.

4. Testing, Build & Validation (2.0h):
- Executed automated API test scripts with various Origin header combinations to confirm 200 OK responses.
- Ran full NestJS production build (`npm run build`) with zero errors.
- Prepared deployment instructions for staging release.