fix: harden production auth and review flow

- Add environment-aware CORS and secure cookie support:
  * Add secureCookies config to env.ts based on SECURE_COOKIES env var or https detection
  * Integrate @elysiajs/cors with credentials and origin configuration
  * Update cookie helpers to use SameSite=None; Secure in production
- Wrap expert review update and insert in database transaction for atomicity:
  * Ensures diagnosis status update and review insert succeed together
  * Rolls back both operations if either fails
  * Preserves behavior: only update if status is needs_review, return badRequest if no row updated

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/api/src/routes/expert.ts

@@ -65,34 +65,44 @@ export const expertRoutes = new Elysia({ prefix: '/api/v1/expert' })
       const diagnosis = existing[0];
       if (!diagnosis) return notFound('Diagnosis not found');
 
-      const correctedSlug = req.verdict === 'corrected' ? req.correctedDiseaseSlug : null;
+      const verdict = req.verdict as 'verified' | 'corrected';
+      const correctedSlug = verdict === 'corrected' ? req.correctedDiseaseSlug : null;
 
-      // Perform conditional update first to determine if this review should proceed
-      const updated = await db
-        .update(diagnoses)
-        .set({
-          status: req.verdict === 'corrected' ? 'expert_corrected' : 'expert_verified',
-          predictedDiseaseSlug: req.verdict === 'corrected' ? correctedSlug : diagnosis.predictedDiseaseSlug,
-          updatedAt: new Date(),
-        })
-        .where(and(eq(diagnoses.id, diagnosis.id), eq(diagnoses.status, 'needs_review')))
-        .returning();
+      // Wrap update and insert in a transaction for atomicity
+      const result = await db.transaction(async (tx) => {
+        // Perform conditional update first to determine if this review should proceed
+        const updated = await tx
+          .update(diagnoses)
+          .set({
+            status: verdict === 'corrected' ? 'expert_corrected' : 'expert_verified',
+            predictedDiseaseSlug: verdict === 'corrected' ? correctedSlug : diagnosis.predictedDiseaseSlug,
+            updatedAt: new Date(),
+          })
+          .where(and(eq(diagnoses.id, diagnosis.id), eq(diagnoses.status, 'needs_review')))
+          .returning();
 
-      if (updated.length === 0) {
-        return badRequest('Diagnosis is not pending review');
-      }
+        if (updated.length === 0) {
+          throw new Error('DIAGNOSIS_NOT_PENDING_REVIEW');
+        }
 
-      // Only insert expert review after successful update
-      await db.insert(expertReviews).values({
-        diagnosisId: diagnosis.id,
-        expertId: user.id,
-        verdict: req.verdict,
-        correctedDiseaseSlug: correctedSlug,
-        notes,
+        // Only insert expert review after successful update
+        const reviewValues = {
+          diagnosisId: diagnosis.id,
+          expertId: user.id,
+          verdict,
+          correctedDiseaseSlug: correctedSlug,
+          notes,
+        };
+        await tx.insert(expertReviews).values(reviewValues);
+
+        return updated[0];
       });
 
       return await loadDiagnosisRecord(diagnosis.id, null, true);
     } catch (error) {
+      if (error instanceof Error && error.message === 'DIAGNOSIS_NOT_PENDING_REVIEW') {
+        return badRequest('Diagnosis is not pending review');
+      }
       return serviceUnavailable('Database unavailable');
     }
   });