fix(security): input validation, remove JWT secret fallbacks, restrict WS CORS, add WS auth guard (#505, #794, #795, #796)

[phertyameen]

Closes #505,
Closes #794,
Closes #795,
Closes #796
#505 - Comprehensive input validation

src/common/pipes/validation.pipe.ts exports createValidationPipe(): a centralized ValidationPipe with whitelist, forbidNonWhitelisted, transform, and a custom exceptionFactory that returns a standardized { statusCode, error, message, details[] } body on every 400. match.decorator.ts adds a @match(field) cross-field decorator for password confirmation. validation-error.serializer.ts normalises any BadRequestException into the same shape for exception filters. auth.dto.ts applies full class-validator decorators to RegisterDto, LoginDto, RefreshTokenDto, ForgotPasswordDto, and ResetPasswordDto. Unit tests cover valid input, invalid email, short password, missing uppercase, and mismatched confirmation.
#794 - Remove JWT secret fallbacks

All || 'default-jwt-secret' and || 'default-refresh-secret' strings removed from auth.service.ts. ConfigService.getOrThrow is used in their place so NestJS throws immediately if either key is absent. AuthModule.onModuleInit validates both JWT_SECRET and JWT_REFRESH_SECRET at startup - throwing a descriptive Error if either is missing or shorter than 32 characters. Existing auth.service.spec.ts updated to inject secrets via a mock ConfigService (no env vars needed in tests).
#795 - WebSocket CORS allowlist

collaboration.gateway.ts replaces origin: "*" with a per-connection origin callback that reads WS_ALLOWED_ORIGINS (comma-separated) from ConfigService via afterInit. Connections from unlisted origins are rejected. WS_ALLOWED_ORIGINS documented in .env.example.
#796 - WebSocket authentication guard

WsAuthGuard (src/auth/guards/ws-auth.guard.ts) extracts socket.handshake.auth.token, verifies it with JwtService, attaches the decoded payload to socket.data.user, and calls client.disconnect(true) on any failure. @UseGuards(WsAuthGuard) applied at the gateway class level and on individual message handlers. handleJoin now reads userId from client.data.user.sub instead of the untrusted dto.userId. Tests cover valid token, missing token, expired token, and wrong-secret scenarios.

[drips-wave]

@phertyameen Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits