Datenbank bereinigt / Gitea-Integration gefixt

backend/server.js

@@ -4,6 +4,9 @@
  * Node.js/Express Backend mit Socket.io für Echtzeit-Sync
  */
 
+// Umgebungsvariablen laden (muss ganz oben stehen!)
+require('dotenv').config();
+
 const express = require('express');
 const http = require('http');
 const { Server } = require('socket.io');
@@ -42,6 +45,7 @@ const gitRoutes = require('./routes/git');
 const applicationsRoutes = require('./routes/applications');
 const giteaRoutes = require('./routes/gitea');
 const knowledgeRoutes = require('./routes/knowledge');
+const codingRoutes = require('./routes/coding');
 
 // Express App erstellen
 const app = express();
@@ -59,17 +63,18 @@ const io = new Server(server, {
 // MIDDLEWARE
 // =============================================================================
 
-// Sicherheits-Header
+// Erweiterte Sicherheits-Header (CSP temporär deaktiviert für Login-Fix)
 app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
-      fontSrc: ["'self'", "https://fonts.gstatic.com"],
-      imgSrc: ["'self'", "data:", "blob:"],
-      scriptSrc: ["'self'"],
-      connectSrc: ["'self'", "ws:", "wss:"]
-    }
+  contentSecurityPolicy: false, // Temporär deaktiviert
+  hsts: {
+    maxAge: 31536000, // 1 Jahr
+    includeSubDomains: true,
+    preload: true
+  },
+  noSniff: true,
+  xssFilter: true,
+  referrerPolicy: {
+    policy: "strict-origin-when-cross-origin"
   }
 }));
 
@@ -86,6 +91,10 @@ app.use(express.urlencoded({ extended: true, limit: '1mb' }));
 // Cookie Parser
 app.use(cookieParser());
 
+// Input Sanitization (vor allen anderen Middlewares)
+const { sanitizeMiddleware } = require('./middleware/validation');
+app.use(sanitizeMiddleware);
+
 // Request Logging
 app.use((req, res, next) => {
   const start = Date.now();
@@ -148,6 +157,9 @@ app.use('/api/gitea', authenticateToken, csrfProtection, giteaRoutes);
 // Knowledge-Routes (Wissensmanagement)
 app.use('/api/knowledge', authenticateToken, csrfProtection, knowledgeRoutes);
 
+// Coding-Routes (Entwicklungsverzeichnisse mit Claude/Codex)
+app.use('/api/coding', authenticateToken, csrfProtection, codingRoutes);
+
 // =============================================================================
 // SOCKET.IO
 // =============================================================================