fix: apply signature-verification middleware to POST /api/tokens [AIS-297]

[ryunsong-contentful]

AIS-297 / AIS-299

What's happening here

The Contentful request-signature-verification middleware is meant to be mounted on /api/messages, /api/spaces/*, /api/events, and /api/tokens:

app.use(
  ['/api/messages', '/api/spaces/*', '/api/events', 'api/tokens'],  // <- missing leading slash
  createContentfulRequestVerificationMiddleware(config.signingSecret)
);

The last entry is 'api/tokens' — missing the leading /. Express path-matching requires an exact match against the route path ('/api/tokens'), so this entry silently never matched anything. POST /api/tokens (wired up a few lines below via app.post('/api/tokens', authToken.post)) has been running with no signature verification at all — any caller could hit it without a valid Contentful app signature.

This closes AIS-297/AIS-299 (duplicate tickets for the same finding, from the Cypress SAST sweep).

Fix

One-character fix: 'api/tokens' → '/api/tokens'. No other route in the array had this typo (checked /api/messages, /api/spaces/*, /api/events — all correctly prefixed already).

Test plan

• No existing test covers app.ts's route-to-middleware wiring (the app's tests are unit tests against individual controllers/middleware in isolation — there's no supertest-style HTTP integration test harness here), so I'm not introducing one for a one-line fix; flagging that as a gap rather than pretending coverage exists
• Manually verify: POST /api/tokens without a valid Contentful signature now returns the same rejection the other protected routes already return
• Manually verify: POST /api/tokens with a valid signature still succeeds (no regression to the legitimate OAuth token flow)

Generated with Claude Code

[wiz-inc-38d59fb8d7]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	10
Software Management Findings	-
Total	10

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.