From 0e8c6e0345e6b401ecad1d80e6977e77baf2c6fd Mon Sep 17 00:00:00 2001
From: mulish77 <betmul@gmail.com>
Date: Tue, 28 Jul 2026 16:18:07 +0300
Subject: [PATCH] Update main.ts

---
 apps/edr-freight-api/src/main.ts | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/apps/edr-freight-api/src/main.ts b/apps/edr-freight-api/src/main.ts
index 5b027448c..cf4c37b2d 100644
--- a/apps/edr-freight-api/src/main.ts
+++ b/apps/edr-freight-api/src/main.ts
@@ -2,6 +2,7 @@ import "reflect-metadata";
 import * as dotenv from "dotenv";
 dotenv.config();
 import { NestFactory } from "@nestjs/core";
+import type { NestExpressApplication } from "@nestjs/platform-express";
 import { DocumentBuilder, SwaggerModule } from "@nestjs/swagger";
 import {
   HttpExceptionFilter,
@@ -11,8 +12,25 @@ import {
 
 import { AppModule } from "./app.module";
 
+/**
+ * JSON body ceiling. Signing posts the signature AND the company stamp as
+ * base64 in one JSON body, and base64 inflates bytes by ~4/3 — a 10MB stamp is
+ * ~13.4MB on the wire. Express defaults to 100kb, which rejected any real stamp
+ * image with a 413 "request entity too large".
+ */
+const JSON_BODY_LIMIT = '20mb';
+
 async function bootstrap() {
-  const app = await NestFactory.create(AppModule);
+  const app = await NestFactory.create<NestExpressApplication>(AppModule);
+
+  // Nest's own body-parser API, NOT `app.use(json(...))` from express: express
+  // is not a declared dependency of this app (it arrives under
+  // @nestjs/platform-express), so importing it directly resolved only through
+  // pnpm's hoisted dev store and died as MODULE_NOT_FOUND in the production
+  // image, where `pnpm deploy --prod` installs declared dependencies only.
+  // This also RECONFIGURES the default parsers rather than racing them.
+  app.useBodyParser('json', { limit: JSON_BODY_LIMIT });
+  app.useBodyParser('urlencoded', { limit: JSON_BODY_LIMIT, extended: true });
 
   // Dev CORS: reflect any localhost origin and allow credentials so the
   // freight portal (5173), passenger portal (5174), backoffices (5183/5184)
@@ -28,6 +46,9 @@ async function bootstrap() {
       "Accept",
       "Authorization",
       "X-Requested-With",
+      // Which freight frontend is calling — /auth/login uses this to reject
+      // cross-audience credentials (EDRFREIGHT-415).
+      "X-Client-App",
       // IAM context headers required by @tria-plc/api-common's JwtGuard
       "organization-unit-id",
       "delegator-position-id",
@@ -40,6 +61,13 @@ async function bootstrap() {
       "x-delegator-position-id",
       "x-current-project-id",
       "x-current-position-id",
+      // Headers sent by the freight-backoffice OKR/objective-service client
+      // (withHeaders.tsx, signatureAndTeeterService.ts, useIncomingReport.ts)
+      // under yet another naming convention — unprefixed "tenant-key"/"unit-id",
+      // and "x-delegated-position-id" (delegated, not delegator).
+      "tenant-key",
+      "unit-id",
+      "x-delegated-position-id",
     ],
     exposedHeaders: ["Content-Disposition"],
     maxAge: 86400, // cache preflight for 24h to cut chatter in dev