feat: enhance CORS configuration and implement throttling for API endpoints; add admin role checks in controllers

backend/src/auth/jwt-auth.guard.ts

@@ -10,23 +10,11 @@ export class JwtAuthGuard extends AuthGuard('jwt') {
   }
 
   canActivate(context: ExecutionContext) {
-    const request = context.switchToHttp().getRequest();
-    const authHeader = request.headers.authorization;
-    const path = request.path;
-    const method = request.method;
-    console.log(`[JwtAuthGuard.canActivate] ${method} ${path}`);
-    console.log(`[JwtAuthGuard.canActivate] Authorization header:`, authHeader ? 'YES' : 'NO');
-    
     const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
       context.getHandler(),
       context.getClass(),
     ]);
-    console.log(`[JwtAuthGuard.canActivate] isPublic:`, isPublic);
-    
     if (isPublic) return true;
-    
-    const result = super.canActivate(context);
-    console.log(`[JwtAuthGuard.canActivate] super.canActivate result:`, result);
-    return result;
+    return super.canActivate(context);
   }
 }

backend/src/auth/jwt.strategy.ts

@@ -15,9 +15,6 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
   }
 
   async validate(payload: { sub: number; username: string; role: string; isPremium: boolean }) {
-    console.log('[JwtStrategy.validate] Payload received:', payload);
-    const result = { userId: payload.sub, username: payload.username, role: payload.role ?? 'user', isPremium: payload.isPremium ?? false };
-    console.log('[JwtStrategy.validate] Returning user:', result);
-    return result;
+    return { userId: payload.sub, username: payload.username, role: payload.role ?? 'user', isPremium: payload.isPremium ?? false };
   }
 }