refactor backend route and fulfillment modules

apps/backend/src/middleware/access-log.ts

@@ -0,0 +1,43 @@
+import { createRequestId, logInfo } from "../utils/logger.js";
+
+export function accessLogMiddleware(req, res, next) {
+  const startedAt = Date.now();
+  const requestId = resolveRequestId(req);
+
+  req.requestId = requestId;
+  res.setHeader("X-Request-Id", requestId);
+
+  res.on("finish", () => {
+    if (shouldSkipAccessLog(req.originalUrl, res.statusCode)) {
+      return;
+    }
+
+    logInfo("[http/access]", "request completed", {
+      requestId,
+      method: req.method,
+      originalUrl: req.originalUrl,
+      statusCode: res.statusCode,
+      durationMs: Date.now() - startedAt,
+      ip: req.ip,
+      forwardedFor: String(req.headers["x-forwarded-for"] || ""),
+      userAgent: String(req.headers["user-agent"] || ""),
+      referer: String(req.headers.referer || ""),
+      contentLength: Number(res.getHeader("content-length") || 0),
+      actorUserId: req.adminSession?.userId || "",
+      actorUsername: req.adminSession?.username || "",
+      actorRole: req.adminSession?.role || "",
+    });
+  });
+
+  next();
+}
+
+function resolveRequestId(req) {
+  const fromHeader = String(req.headers["x-request-id"] || "").trim();
+  return fromHeader || createRequestId("req");
+}
+
+function shouldSkipAccessLog(originalUrl, statusCode) {
+  const pathname = String(originalUrl || "").split("?")[0];
+  return ["/health", "/health/live", "/health/ready"].includes(pathname) && Number(statusCode) < 400;
+}

apps/backend/src/middleware/cors.ts

@@ -0,0 +1,12 @@
+export function corsMiddleware(req, res, next) {
+  res.setHeader("Access-Control-Allow-Origin", "*");
+  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
+
+  if (req.method === "OPTIONS") {
+    res.sendStatus(204);
+    return;
+  }
+
+  next();
+}