Add Feedback domain module: public submission flow, admin CRUD, reporting (#7)

Co-authored-by: Patrick Müller <mail@pmueller.me>
Reviewed-on: #7
Co-authored-by: Patrick Mueller <patrick@mueller-patrick.tech>
Co-committed-by: Patrick Mueller <patrick@mueller-patrick.tech>

app.ts

@@ -7,6 +7,7 @@ import logger from './src/middleware/logger';
 
 // Router imports
 import {calendarRouter} from './src/models/calendar/Calendar.router';
+import {feedbackRouter} from './src/models/feedback/Feedback.router';
 
 
 let cors = require('cors');
@@ -23,19 +24,39 @@ const port: number = parseInt(process.env.PORT, 10);
 const app: express.Application = express();
 const server: http.Server = http.createServer(app);
 
+// Behind Plesk's nginx, req.ip is the proxy unless we trust the forwarded header.
+// Verify the resolved client IP is correct in staging before relying on it
+// (used by the feedback rate limiter).
+app.set('trust proxy', 1);
+
 // here we are adding middleware to parse all incoming requests as JSON
 app.use(express.json());
 
 // Configure CORS
 let allowedHosts = [
 	'https://www.nachklang.art',
-	'https://calendar.nachklang.art'
+	'https://calendar.nachklang.art',
+	'https://feedback.nachklang.art'
 ];
+const isDev = process.env.NODE_ENV !== 'production';
+const localhostRegex = /^http:\/\/localhost:\d+$/;
+// Matches http://<private-LAN-IPv4>:<port> - needed so the feedback form can
+// be reached from a real phone over WiFi during dev (the phone's Origin is
+// the dev machine's LAN IP, never "localhost"). Dev-only, same as above.
+const lanIpRegex = /^http:\/\/(192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}):\d+$/;
 app.use(cors({
+	allowedHeaders: ['Content-Type', 'X-Session-Id', 'X-Session-Key'],
 	origin: function (origin: any, callback: any) {
 		// Allow requests with no origin
 		if (!origin) return callback(null, true);
 
+		// Any localhost port, or a private-LAN IP, is fine outside production -
+		// dev servers pick whatever port is free (Next.js falls back from 3000
+		// if it's taken), and real-device testing hits the dev machine by IP.
+		if (isDev && (localhostRegex.test(origin) || lanIpRegex.test(origin))) {
+			return callback(null, true);
+		}
+
 		// Block requests with wrong origin
 		if (allowedHosts.indexOf(origin) === -1) {
 			return callback(new Error('The CORS policy doesn\'t allow access for your origin.'), false);
@@ -82,6 +103,7 @@ app.use(
 
 // Add routers
 app.use('/calendar', calendarRouter);
+app.use('/feedback', feedbackRouter);
 
 // this is a simple route to make sure everything is working properly
 app.get('/', (req: express.Request, res: express.Response) => {