package.json (2)

27-28: Consider dropping body-parser in favor of built-in Express parsers.

Express 4.16+ (and 5) expose express.json() and express.urlencoded(); removing body-parser trims one dependency.

I can scan usages and propose a patch if wanted.

---

15-17: Add an explicit dev runner for TS (nodemon exec).

Start script is plain “nodemon”; if there’s no nodemon.json, it won’t run TS. Suggest:

-    "start": "nodemon",
+    "start": "nodemon --exec ts-node src/main.ts",

Or switch to tsx:

+    "dev": "tsx watch src/main.ts",

.eslintrc.js (1)

1-30: ESLint baseline looks solid; consider a faster, isolated project config.

Using parserOptions.project against the full tsconfig can slow linting. Consider a tsconfig.eslint.json (noEmit, includes tests) to speed up and widen coverage. Also, you’re warning on any while using it in middleware—tighten types where feasible.

jest.config.js (1)

23-24: Include cts/mts extensions if you keep Jest 30.

Jest 30 adds support for .cts/.mts by default; since you override moduleFileExtensions, include them.

-  moduleFileExtensions: ['ts', 'js', 'json'],
+  moduleFileExtensions: ['ts', 'cts', 'mts', 'js', 'json'],

(jestjs.io)

src/models/User.ts (2)

45-46: Drop SQL-only enum metadata for Mongo.

type: 'enum' isn’t meaningful for Mongo. Keep enum default in TS, but remove type.

-  @Column({ type: 'enum', enum: Role, default: Role.User })
+  @Column({ enum: Role, default: Role.User })
   public role!: Role;

---

48-54: Redundant @column with date columns.

@CreateDateColumn()/@UpdateDateColumn() don’t need an extra @Column().

-  @Column()
   @CreateDateColumn()
   public createdAt!: Date;

-  @Column()
   @UpdateDateColumn()
   public updatedAt!: Date;

src/config/index.ts (3)

6-9: Throwing when .env is missing can break prod.

Prefer: warn if missing but continue when env vars are provided; or only throw in local dev.

-const envFound = dotenv.config();
-if (envFound.error) {
-  // Throw generic error
-  throw new Error("Couldn't find .env file");
-}
+const envFound = dotenv.config();
+if (envFound.error && process.env.NODE_ENV === 'development') {
+  throw new Error("Couldn't find .env file");
+}

---

15-15: Use explicit radix for parseInt.

Avoid implicit base.

-  port: parseInt(process.env.PORT || '3000'),
+  port: Number.parseInt(process.env.PORT || '3000', 10),

---

54-58: Normalize numeric envs.

pooltime and concurrency likely need numbers; consider parsing like the other ports.

src/api/middlewares/isAuth.ts (1)

22-26: Consider validating issuer/audience if applicable.

If your tokens include iss/aud, enforce them here to harden verification.

src/api/routes/auth/index.ts (2)

15-15: Avoid any for the router argument. Type it as Router.

You already import Router; this improves type safety.

Apply this diff:

-export default (app: any) => {
+export default (app: Router) => {

---

33-33: Use console.error for errors or your app logger.

Improves signal in logs and integrates with error monitoring.

Apply this diff:

-        console.log(' error ', e);
+        console.error('error', e);

Also applies to: 54-54, 68-68

src/loaders/index.ts (2)

1-1: Prefer importing the Application type explicitly.

Avoids relying on the namespace off the default import.

Apply this diff:

-import express from 'express';
+import express, { type Application } from 'express';
 
-export default async (app: express.Application) => {
+export default async (app: Application) => {

---

7-12: Startup logs: consider using a centralized logger.

Consistency with the rest of the app and structured logging helps during upgrades.

src/main.ts (1)

9-18: Graceful shutdown: close the server before process.exit(0).

Prevents dropping in-flight requests on SIGTERM.

Example replacement:

const server = app.listen(config.port, () => {
  console.log(`Server is listening on port ${config.port}`);
});

process.on('SIGTERM', () => {
  console.log('SIGTERM signal received.');
  server.close(() => {
    console.log('HTTP server closed.');
    process.exit(0);
  });
});

src/services/users.ts (1)

10-12: Drop unnecessary await in simple returns.

Removes microtask overhead and aligns with common style.

Apply this diff:

-  public async findAll(): Promise<User[]> {
-    return await this.userRepository.find();
-  }
+  public async findAll(): Promise<User[]> {
+    return this.userRepository.find();
+  }

-  public async findOne(options: FindOneOptions<User>): Promise<User | null> {
-    return await this.userRepository.findOne(options);
-  }
+  public async findOne(options: FindOneOptions<User>): Promise<User | null> {
+    return this.userRepository.findOne(options);
+  }

Also applies to: 14-16

src/services/auth.ts (2)

22-27: Avoid manual salt handling; let argon2 embed salt and stop persisting it.

Argon2 returns an encoded hash with the salt. Storing a separate salt is redundant and increases surface area.

Apply:

-import { randomBytes } from 'crypto';
@@
-      const salt = randomBytes(32);
@@
-      const hashedPassword = await argon2.hash(inputUser.password, { salt });
+      const hashedPassword = await argon2.hash(inputUser.password);
@@
-        salt: salt.toString('hex'),
         password: hashedPassword,

Optionally remove later Reflect.deleteProperty(user, 'salt') since salt won’t exist anymore.

---

85-93: Consider setting JWT options explicitly (algorithm/issuer/audience).

Improves interoperability and validation downstream; keep as-is if not needed.

Example:

-    return jwt.sign(
+    return jwt.sign(
       {
         id: user.id,
         role: user.role,
         name: user.name,
         exp: exp.getTime() / 1000,
       },
-      config.jwtSecret,
+      config.jwtSecret,
+      { algorithm: 'HS256', issuer: config.jwtIssuer, audience: config.jwtAudience }
     );

.env (1)

16-16: Add trailing newline.

Keeps linters and POSIX tools happy.

-AGENDA_CONCURRENCY=10⏎?  # ensure file ends with a newline
+AGENDA_CONCURRENCY=10
+

src/loaders/server.ts (4)

1-1: Prefer built-in express.json() over body-parser.

Removes an extra dependency and aligns with modern Express.

Apply:

-import bodyParser from 'body-parser';
@@
-  app.use(bodyParser.json());
+  app.use(express.json());

Then remove body-parser from dependencies.

Also applies to: 12-12

---

19-21: Type the 404 handler and avoid any mutation.

Use Express types and a narrow error shape.

Apply:

-  app.use((req, res, next) => {
-    const error: any = new Error('Not Found');
-    error.status = 404;
+  app.use((req: express.Request, res: express.Response, next: express.NextFunction) => {
+    const error = new Error('Not Found') as { status?: number };
+    error.status = 404;
     next(error);
   });

---

25-40: Tighten error-handler types and early-returns.

Use unknown and narrow when needed; improves strict-mode signal without changing behavior.

Apply:

-  app.use((err: any, req: any, res: any, next: any) => {
+  app.use((err: unknown, req: express.Request, res: express.Response, next: express.NextFunction) => {
     if ((err as any).name === 'UnauthorizedError') {
-      return res.status(err.status).send({ message: err.message }).end();
+      const e = err as any;
+      return res.status(e.status || 401).json({ message: e.message });
     }
     // celebrate handled above; fall through
     return next(err);
   });

---

42-49: Final error handler: avoid any and normalize response shape.

Small type cleanup; no behavior change.

Apply:

-  app.use((err: any, req: any, res: any, _next: any) => {
-    res.status(err.status || 500);
-    res.json({
+  app.use((err: unknown, req: express.Request, res: express.Response, _next: express.NextFunction) => {
+    const e = err as { status?: number; message?: string };
+    res.status(e?.status ?? 500).json({
       errors: {
-        message: err.message,
+        message: e?.message ?? 'Internal Server Error',
       },
     });
   });

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.