Add code resolver, sync conflict handling, and user isolation

Introduce a CodeResolverService to classify user login codes, complete with detailed resolution logic and usability checks. Extend the sync system to handle conflicts via last-write-wins arbitration, with detailed conflict tracking for review. Update file permissions and runtime isolation in Docker to enhance security.

src/main.ts

@@ -3,11 +3,59 @@ import { ValidationPipe } from '@nestjs/common';
 import { WsAdapter } from '@nestjs/platform-ws';
 import { AppModule } from './app.module';
 
+function parseAllowedOrigins(): string[] {
+  const envOrigins = process.env.ALLOWED_ORIGINS || process.env.CORS_ORIGIN;
+  if (envOrigins) {
+    return envOrigins
+      .split(',')
+      .map((o) => o.trim())
+      .filter(Boolean);
+  }
+
+  const defaultOrigins: string[] = [
+    'http://localhost:3000',
+    'http://localhost:3010',
+    'http://localhost:8080',
+    'http://127.0.0.1:3000',
+    'http://127.0.0.1:3010',
+    'http://127.0.0.1:8080',
+  ];
+
+  if (process.env.APP_BASE_URL) {
+    try {
+      const parsed = new URL(process.env.APP_BASE_URL);
+      if (!defaultOrigins.includes(parsed.origin)) {
+        defaultOrigins.push(parsed.origin);
+      }
+    } catch {
+      const trimmed = process.env.APP_BASE_URL.trim();
+      if (!defaultOrigins.includes(trimmed)) {
+        defaultOrigins.push(trimmed);
+      }
+    }
+  }
+
+  return defaultOrigins;
+}
+
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
   app.setGlobalPrefix('api');
   app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));
-  app.enableCors();
+
+  const allowedOrigins = parseAllowedOrigins();
+  app.enableCors({
+    origin: (origin, callback) => {
+      // Allow requests with no origin (e.g. mobile apps, curl, same-origin)
+      if (!origin || allowedOrigins.includes(origin)) {
+        callback(null, true);
+      } else {
+        callback(new Error('Not allowed by CORS'));
+      }
+    },
+    credentials: true,
+  });
+
   app.useWebSocketAdapter(new WsAdapter(app));
   await app.listen(process.env.PORT ?? 3000);
 }