Project quality audit (#2758)

* Harden security, health checks, and dependency hygiene

Co-authored-by: Amruth Pillai <im.amruth@gmail.com>

* Finalize health and storage hardening adjustments

Co-authored-by: Amruth Pillai <im.amruth@gmail.com>

* remove use of [REDACTED]

* update dependencies

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

src/routes/api/health.ts

@@ -3,30 +3,80 @@ import { sql } from "drizzle-orm";
 import { db } from "@/integrations/drizzle/client";
 import { printerService } from "@/integrations/orpc/services/printer";
 import { getStorageService } from "@/integrations/orpc/services/storage";
+import { logger } from "@/utils/logger";
 
-function isUnhealthy(check: unknown): boolean {
-	return (
-		!!check &&
-		typeof check === "object" &&
-		"status" in check &&
-		typeof check.status === "string" &&
-		check.status === "unhealthy"
-	);
+const HEALTHCHECK_TIMEOUT_MS = 1_500;
+
+type CheckResult = {
+	status: "healthy" | "unhealthy";
+	latencyMs: number;
+	error?: string;
+	[key: string]: unknown;
+};
+
+function getErrorMessage(error: unknown): string {
+	if (error instanceof Error) return error.message;
+	return "Unknown error";
 }
 
-async function handler() {
+async function withTimeout<T>(promise: Promise<T>, timeoutMs: number): Promise<T> {
+	let timeoutId: NodeJS.Timeout | undefined;
+
+	const timeout = new Promise<never>((_, reject) => {
+		timeoutId = setTimeout(() => reject(new Error(`Timed out after ${timeoutMs}ms`)), timeoutMs);
+	});
+
+	try {
+		return await Promise.race([promise, timeout]);
+	} finally {
+		if (timeoutId) clearTimeout(timeoutId);
+	}
+}
+
+async function runCheck(check: () => Promise<object>): Promise<CheckResult> {
+	const startedAt = performance.now();
+
+	try {
+		const data = await withTimeout(check(), HEALTHCHECK_TIMEOUT_MS);
+		const latencyMs = Math.round(performance.now() - startedAt);
+		const result = data as { status?: string };
+		if (result.status === "unhealthy") return { ...(data as object), status: "unhealthy", latencyMs };
+		return { ...(data as object), status: "healthy", latencyMs };
+	} catch (error) {
+		return {
+			status: "unhealthy",
+			error: getErrorMessage(error),
+			latencyMs: Math.round(performance.now() - startedAt),
+		};
+	}
+}
+
+async function healthHandler() {
+	const [database, printer, storage] = await Promise.all([
+		runCheck(checkDatabase),
+		runCheck(checkPrinter),
+		runCheck(checkStorage),
+	]);
+	const status = [database, printer, storage].some((check) => check.status === "unhealthy") ? "unhealthy" : "healthy";
+
 	const checks = {
+		service: "reactive-resume",
 		version: process.env.npm_package_version,
-		status: "healthy",
+		status,
 		timestamp: new Date().toISOString(),
 		uptime: `${process.uptime().toFixed(2)}s`,
-		database: await checkDatabase(),
-		printer: await checkPrinter(),
-		storage: await checkStorage(),
+		database,
+		printer,
+		storage,
 	};
 
-	if (checks.status === "unhealthy" || Object.values(checks).some(isUnhealthy)) {
-		checks.status = "unhealthy";
+	if (status === "unhealthy") {
+		logger.warn("Healthcheck failed", {
+			route: "/api/health",
+			database,
+			printer,
+			storage,
+		});
 	}
 
 	const headers = new Headers();
@@ -36,7 +86,7 @@ async function handler() {
 
 	return new Response(body, {
 		headers,
-		status: checks.status === "unhealthy" ? 500 : 200,
+		status: checks.status === "unhealthy" ? 503 : 200,
 	});
 }
 
@@ -80,7 +130,7 @@ async function checkStorage() {
 export const Route = createFileRoute("/api/health")({
 	server: {
 		handlers: {
-			GET: handler,
+			GET: healthHandler,
 		},
 	},
 });

src/routes/api/openapi.$.ts

@@ -9,6 +9,7 @@ import router from "@/integrations/orpc/router";
 import { resumeDataSchema } from "@/schema/resume/data";
 import { env } from "@/utils/env";
 import { getLocale } from "@/utils/locale";
+import { logger } from "@/utils/logger";
 
 const openAPIHandler = new OpenAPIHandler(router, {
 	plugins: [
@@ -21,7 +22,10 @@ const openAPIHandler = new OpenAPIHandler(router, {
 	],
 	interceptors: [
 		onError((error) => {
-			console.error(`ERROR [OpenAPI]: ${error}`);
+			logger.error("OpenAPI handler error", {
+				route: "/api/openapi",
+				error,
+			});
 		}),
 	],
 });

src/routes/api/rpc.$.ts

@@ -4,12 +4,16 @@ import { BatchHandlerPlugin, RequestHeadersPlugin, StrictGetMethodPlugin } from
 import { createFileRoute } from "@tanstack/react-router";
 import router from "@/integrations/orpc/router";
 import { getLocale } from "@/utils/locale";
+import { logger } from "@/utils/logger";
 
 const rpcHandler = new RPCHandler(router, {
 	plugins: [new BatchHandlerPlugin(), new RequestHeadersPlugin(), new StrictGetMethodPlugin()],
 	interceptors: [
 		onError((error) => {
-			console.error(`ERROR [oRPC]: ${error}`);
+			logger.error("oRPC server error", {
+				route: "/api/rpc",
+				error,
+			});
 		}),
 	],
 });

src/routes/mcp/index.ts

@@ -1,6 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { createFileRoute } from "@tanstack/react-router";
+import { logger } from "@/utils/logger";
 import { registerPrompts } from "./-helpers/prompts";
 import { registerResources } from "./-helpers/resources";
 import { registerTools } from "./-helpers/tools";
@@ -51,7 +52,10 @@ export const Route = createFileRoute("/mcp/")({
 
 					return await transport.handleRequest(request);
 				} catch (error) {
-					console.error(`Error handling request: ${error instanceof Error ? error.message : String(error)}`);
+					logger.error("MCP request failed", {
+						route: "/mcp",
+						error,
+					});
 
 					return Response.json({
 						id: null,