From fdd082e1239393636637010545e3c34710928d04 Mon Sep 17 00:00:00 2001
From: Baskarayelu <baskarayelu@gmail.com>
Date: Thu, 30 Jul 2026 12:17:07 +0530
Subject: [PATCH] fix: add security headers to audit route

---
 src/routes/audit.test.ts | 10 ++++++++++
 src/routes/audit.ts      |  3 +++
 2 files changed, 13 insertions(+)

diff --git a/src/routes/audit.test.ts b/src/routes/audit.test.ts
index 2845e39e..da6c4bf7 100644
--- a/src/routes/audit.test.ts
+++ b/src/routes/audit.test.ts
@@ -46,6 +46,16 @@ describe('/api/audit mutations', () => {
     expect(res.body.data).toBeInstanceOf(Array);
   });
 
+  it('sets the required security headers on audit responses', async () => {
+    const res = await request(app).get('/api/audit');
+
+    expect(res.headers['content-security-policy']).toBe(
+      "default-src 'self'; frame-ancestors 'none'; object-src 'none'",
+    );
+    expect(res.headers['x-content-type-options']).toBe('nosniff');
+    expect(res.headers['referrer-policy']).toBe('strict-origin-when-cross-origin');
+  });
+
   it('POST /api/audit creates a new config and logs AUDIT_CONFIG_CREATE', async () => {
     const res = await request(app).post('/api/audit').send({
       targetEndpoint: '/users',
diff --git a/src/routes/audit.ts b/src/routes/audit.ts
index d2f412e3..0b6d4ccb 100644
--- a/src/routes/audit.ts
+++ b/src/routes/audit.ts
@@ -3,6 +3,7 @@ import { defaultAuditService, type AuditService } from '../services/auditService
 import { logger } from '../logger.js';
 import { NotFoundError, BadRequestError } from '../errors/index.js';
 import { requireAuth } from '../middleware/requireAuth.js';
+import { securityHeadersMiddleware } from '../middleware/securityHeaders.js';
 
 export interface AuditConfigRecord {
   id: string;
@@ -23,6 +24,8 @@ export function createAuditRouter(deps: AuditRouterDeps = {}): Router {
   const router = Router();
   const auditService = deps.auditService ?? defaultAuditService;
 
+  router.use(securityHeadersMiddleware);
+
   async function recordAudit(
     req: Request,
     event: string,