npm install helmet cors express-rate-limit hpp xss-clean

// src/app.tsimport helmet from 'helmet'; // Headers de seguridadapp.use(helmet()); // CSP personalizadoapp.use(helmet.contentSecurityPolicy({  directives: {    defaultSrc: ["'self'"],    styleSrc: ["'self'", "'unsafe-inline'"],    imgSrc: ["'self'", 'data:', 'https:'],  },}));

import cors from 'cors'; const corsOptions = {  origin: (origin: string | undefined, callback: Function) => {    const allowedOrigins = [      'https://ecommerce.com',      'https://www.ecommerce.com',    ];     // Permitir requests sin origin (mobile, Postman)    if (!origin || allowedOrigins.includes(origin)) {      callback(null, true);    } else {      callback(new Error('No permitido por CORS'));    }  },  credentials: true,  methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],  allowedHeaders: ['Content-Type', 'Authorization'],}; app.use(cors(corsOptions));

import rateLimit from 'express-rate-limit'; // Límite globalconst globalLimiter = rateLimit({  windowMs: 15 * 60 * 1000, // 15 minutos  max: 100,  message: { error: 'Demasiadas solicitudes' },  standardHeaders: true,  legacyHeaders: false,}); // Límite para authconst authLimiter = rateLimit({  windowMs: 60 * 60 * 1000, // 1 hora  max: 5,  message: { error: 'Demasiados intentos. Intente más tarde.' },}); app.use('/api', globalLimiter);app.use('/api/auth/login', authLimiter);

import hpp from 'hpp';import xssClean from 'xss-clean'; // Prevenir HTTP Parameter Pollutionapp.use(hpp()); // Sanitizar inputs (XSS)app.use(xssClean()); // Limitar tamaño de bodyapp.use(express.json({ limit: '10kb' }));

// src/config/env.tsimport { z } from 'zod'; const envSchema = z.object({  NODE_ENV: z.enum(['development', 'production', 'test']),  PORT: z.string().transform(Number),  DATABASE_URL: z.string().url(),  JWT_SECRET: z.string().min(32),  REDIS_URL: z.string().url(),}); export const env = envSchema.parse(process.env);

// Ocultar errores en producciónapp.use((err: Error, req: Request, res: Response, next: NextFunction) => {  const statusCode = err instanceof AppError ? err.statusCode : 500;   res.status(statusCode).json({    error: process.env.NODE_ENV === 'production'      ? 'Error interno'      : err.message,    ...(process.env.NODE_ENV !== 'production' && { stack: err.stack }),  });});