fix: Add critical missing backend features and APIs

[Haseeb-1698]

This commit addresses the top priority issues found in the comprehensive audit of the Auron project. Fixes 4 critical gaps between frontend and backend.

🔴 CRITICAL FIXES:

1. Browser Extension API Endpoints ✅

Issue: Extension called /api/reports/extension-finding which didn't exist Fixed:

• Added POST /api/reports/extension-finding endpoint
• Added GET /api/reports/extension-findings endpoint
• Created ReportController methods: saveExtensionFinding(), getExtensionFindings()
• Added validation schema for extension findings
• Supports finding types: cookie, session, csp, phishing, dom-analysis
• Supports risk levels: low, medium, high, critical

2. Database Migration for Extension Findings ✅ Issue: No extension_findings table in TypeScript backend database Fixed:

• Created migration 008_create_extension_findings_table.ts
• Table schema:
  • id (UUID), user_id (FK to users), url (TEXT)
  • finding_type (ENUM), details (JSONB), risk_level (ENUM)
  • created_at, updated_at timestamps
• Added 5 indexes for query performance
• Supports CASCADE delete when user is deleted

3. Settings API Endpoints ✅

Issue: Frontend SettingsPage had TODOs for missing backend endpoints Fixed:

• Created complete SettingsController with 6 methods
• Created settings.routes.ts with validation
• Endpoints implemented:
  • GET /api/settings - Get all user settings
  • POST /api/settings/cloud - Save cloud provider API keys (encrypted)
  • POST /api/settings/labs - Save lab preferences
  • PUT /api/settings/profile - Update user profile
  • GET /api/settings/cloud - Get cloud settings (masked keys)
  • DELETE /api/settings/cloud/:provider - Remove provider
• Security: AES-256 encryption for API keys
• API keys masked when returned (shows only last 4 characters)

4. Database Migrations for Settings ✅

Issue: Missing user_settings and user_cloud_settings tables Fixed:

• Created migration 009_create_user_settings_tables.ts
• user_settings table:
  • Stores lab_default_duration, lab_auto_shutdown, notifications, theme
  • One-to-one relationship with users
• user_cloud_settings table:
  • Stores encrypted API keys for multiple cloud providers
  • Supports: vultr, aws, digitalocean, azure, gcp
  • Stores region, instance_type, ssh_key preferences
  • Unique constraint on (user_id, provider)
• Added 4 indexes for performance

5. Feature Flags Middleware ✅

Issue: Feature flags in env vars but no middleware to enforce them Fixed:

• Created featureFlags.ts middleware
• Reads 7 feature flags from environment:
  • ENABLE_2FA, ENABLE_EMAIL_VERIFICATION, ENABLE_OAUTH
  • ENABLE_AI_EXPLANATIONS, ENABLE_COLLABORATION
  • ENABLE_CLOUD_LABS, ENABLE_GAMIFICATION
• Exports:
  • requireFeature() - Blocks request if feature disabled (403)
  • checkFeature() - Sets req.featureEnabled for conditional logic
  • getFeatureFlags() - Returns all flags as object
  • logFeatureFlags() - Logs status on server startup
• Added GET /api/features endpoint (public) to expose flags to frontend

6. Route Registration ✅

• Registered settings routes in routes/index.ts
• Added feature flags import and endpoint
• All endpoints now accessible at /api/settings/*

📊 FILES CHANGED:

New Files (5):

• backend/src/controllers/SettingsController.ts (320 lines)
• backend/src/routes/settings.routes.ts (64 lines)
• backend/src/middleware/featureFlags.ts (64 lines)
• backend/src/database/migrations/008_create_extension_findings_table.ts (95 lines)
• backend/src/database/migrations/009_create_user_settings_tables.ts (146 lines)

Modified Files (3):

• backend/src/controllers/ReportController.ts (+89 lines)
• backend/src/routes/report.routes.ts (+18 lines)
• backend/src/routes/index.ts (+5 lines)

Total: 801 lines added across 8 files

✅ WHAT NOW WORKS:

1. ✅ Browser extension can sync findings to backend (previously failed)
2. ✅ Users can save cloud provider API keys securely (encrypted AES-256)
3. ✅ Frontend settings page can persist to backend (not just localStorage)
4. ✅ Feature flags can be checked before enabling features
5. ✅ API keys never exposed in full (masked display)
6. ✅ All settings have proper database persistence
7. ✅ Extension findings queryable by user_id and type

🔒 SECURITY IMPROVEMENTS:

• API keys encrypted with AES-256-CBC before storage
• API keys never returned in full (masked with ****)
• Proper authentication required for all settings endpoints
• User ownership verified before returning data
• Input validation with Joi schemas
• Prepared statements prevent SQL injection

🚀 NEXT STEPS:

Still TODO (from audit):

• Email service for 2FA codes
• Remove old JavaScript backend (duplicate code)
• Add CSRF protection
• Backend unit tests
• Admin page frontend
• Collaboration feature completion

This commit resolves issues #2, #6, #7, #9 from the comprehensive audit report. Browser extension now fully integrated with backend. Settings persistence complete.