simplified ui with minimum features

backend/package.json

@@ -65,10 +65,15 @@
     "@types/passport": "^1.0.16",
     "@types/passport-apple": "^2.0.0",
     "@types/passport-google-oauth20": "^2.0.12",
+    "@types/pg": "^8.16.0",
     "@types/uuid": "^9.0.7",
     "@typescript-eslint/eslint-plugin": "^6.17.0",
     "@typescript-eslint/parser": "^6.17.0",
     "eslint": "^8.56.0",
     "prettier": "^3.1.1"
+  },
+  "overrides": {
+    "tar": "^7.5.3",
+    "diff": "^8.0.3"
   }
 }

backend/src/database/connection.ts

@@ -42,7 +42,7 @@
       }
     });
 
-    pool.on('connect', (_client) => {
+    pool.on('connect', (_client: any) => {
       logger.debug('Database connection established', {
         totalCount: pool?.totalCount,
         idleCount: pool?.idleCount,
@@ -89,9 +89,9 @@
   }
 };
 
 export const queryWithRetry = async <T = any>(
   queryText: string,
   params?: any[],
   maxRetries: number = 3
 ): Promise<T[]> => {
   const pool = getDatabasePool();
@@ -101,7 +101,7 @@
     try {
       const result = await pool.query(queryText, params);
       return result.rows;
     } catch (error: any) {
       lastError = error;
 
       const isConnectionError = 

backend/src/index.ts

@@ -17,8 +17,22 @@
 app.use(helmet());
 app.use(securityMiddleware);
 
+const getAllowedOrigins = (): string[] | boolean => {
+  const corsOrigin = process.env.CORS_ORIGIN;
+
+  if (!corsOrigin || corsOrigin === '*') {
+    if (process.env.NODE_ENV === 'production') {
+      logger.warn('CORS_ORIGIN is not set or set to * in production. This is insecure.');
+      return false;
+    }
+    return true;
+  }
+
+  return corsOrigin.split(',').map(origin => origin.trim()).filter(Boolean);
+};
+
 const corsOptions = {
-  origin: process.env.CORS_ORIGIN === '*' ? true : (process.env.CORS_ORIGIN || '*'),
+  origin: getAllowedOrigins(),
   credentials: true,
   methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
   allowedHeaders: ['Content-Type', 'Authorization', 'X-Device-ID', 'X-Signature-Ed25519', 'X-Signature-Timestamp']
@@ -35,7 +49,7 @@
   verify: (req: express.Request, _res: express.Response, buf: Buffer) => {
     const url = req.url || req.originalUrl || req.path;
     if (url.includes('webhooks') || url.includes('interactions')) {
       (req as any).rawBody = buf;
     }
   }
 }));

backend/src/routes/music.ts

@@ -31,7 +31,7 @@
       const queryParams: any[] = [];
       let paramCount = 1;
 
       if (filter === 'forYou') {
 
       }
 
@@ -48,7 +48,7 @@
 
       const result = await pool.query(query, queryParams);
 
-      const items = await Promise.all(result.rows.map(async (row) => {
+      const items = await Promise.all(result.rows.map(async (row: any) => {
         let trendingChange: number | null = null;
         if (parseInt(row.recent_ratings) > 10) {
           const previousPeriodResult = await pool.query(
@@ -175,7 +175,7 @@
         [`%${query}%`]
       );
 
-      const items = result.rows.map(row => ({
+      const items = result.rows.map((row: any) => ({
         id: row.id,
         type: row.type,
         title: row.title,

backend/src/routes/notifications.ts

@@ -27,7 +27,7 @@ router.get(
         [req.userId, limit, offset]
       );
 
-      const notifications = result.rows.map(row => ({
+      const notifications = result.rows.map((row: any) => ({
         id: row.id,
         userId: row.user_id,
         type: row.type,