ready to test

Testing

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

README.md

@@ -163,7 +163,9 @@ npm start
 
 | Variable | Description | Example |
 |---|---|---|
+| `APP_NAME` | Application name | `starr` |
 | `NODE_ENV` | `development` or `production` | `development` |
+| `ORIGIN_GUARD_DISABLED` | Set `true` to bypass originGuard (dev/Postman only; ignored in production) | `false` |
 | `PORT` | HTTP port | `3000` |
 | `APP_URL` | Frontend/app URL (used for CORS) | `http://localhost:3000` |
 | `DB_HOST` | PostgreSQL host | `localhost` |
@@ -264,7 +266,30 @@ CSRF is provided via **csurf** (Double Submit Cookie pattern).
 - Current password required before change
 - All sessions invalidated after password change
 
-### 6.5 RBAC Hierarchy
+### 6.5 Origin Guard
+
+All API routes (except `/api/health`) are protected by `originGuard.middleware.js`, a two-layer non-browser request filter:
+
+| Layer | Header checked | Applies to | Blocks |
+|---|---|---|---|
+| 1 | `Sec-Fetch-Site` (must be present) | All methods | curl, Postman, Nikto, sqlmap, scanners |
+| 2 | `Origin` (must be in `ALLOWED_ORIGINS`) | POST · PUT · PATCH · DELETE | Cross-origin mutation from unlisted domains |
+
+**Development bypass** — set `ORIGIN_GUARD_DISABLED=true` in `.env` to allow Postman and other tools through without restarting with a different config. The bypass is **hard-locked off** when `NODE_ENV=production`, even if the flag is set.
+
+```
+# .env — enable for Postman testing
+ORIGIN_GUARD_DISABLED=true
+
+# .env — re-enable when done
+ORIGIN_GUARD_DISABLED=false
+```
+
+> Note: BurpSuite running as a MITM proxy through a real browser is not blocked — the browser supplies all correct headers. Rate limiting and valid credentials are the only defences there.
+
+---
+
+### 6.6 RBAC Hierarchy
 
 ```
 admin  ──► can do everything
@@ -745,6 +770,7 @@ app.use(session({ store: new RedisStore({ client: redisClient }), ... }));
 ### Production Checklist
 
 - [ ] Set `NODE_ENV=production`
+- [ ] Set `ORIGIN_GUARD_DISABLED=false` (or remove the key entirely)
 - [ ] Use strong `JWT_SECRET` (≥ 64 random characters)
 - [ ] Enable HTTPS / TLS (set `cookie.secure: true`)
 - [ ] Point `APP_URL` to your actual domain for CORS