Enable strictNullChecks and remediate null-safety issues in backend

[rendall]

Motivation

• Progress Phase 4.2 by enabling strictNullChecks for functions compilation to catch nullability issues early.
• Record the Phase 4.3 gate decision to evaluate broader strict escalation after completing null-safe remediations.

Description

• Enable strictNullChecks in tsconfig.netlify.functions.json while keeping noImplicitAny enabled.
• Mark Phase 4.2 checklist items complete in docs/plans/phase-4_2-checklist.md and add a Phase 4.3 gate note to docs/plans/phase-04-type-safety-and-env-handling.md describing the next evaluation step.
• Fix nullability in request handling by using toDefinedHeaders(event.headers) result in src/functions/auth.ts when extracting credentials.
• Harden password flow in src/lib/MongodbService.ts by checking for missing user.hash before calling comparePassword.
• Make JWT secret usage explicitly typed in src/lib/crypt.ts by casting process.env.JWT_SECRET to jwt.Secret in getAuthToken.
• Tighten success typing for no-content responses in src/lib/messages.ts by declaring success204NoContent: Success<undefined>.

Testing

• Ran yarn run typecheck and it completed green after the null-safety fixes.
• Ran yarn test:backend and it passed.
• Ran yarn test:frontend and it passed.

---

Codex Task

[Copilot]

Pull request overview

This PR advances Phase 4.2 of the backend type-safety plan by enabling strictNullChecks in the Netlify Functions TypeScript config and remediating the nullability issues that surfaced from the compiler after that flag was turned on.

Changes:

• Enable strictNullChecks in tsconfig.netlify.functions.json (keeping noImplicitAny, leaving full strict off).
• Harden null-safety in runtime code: use toDefinedHeaders-narrowed headers in auth.ts, guard user.hash before calling comparePassword in MongodbService.ts, cast JWT_SECRET to jwt.Secret in crypt.ts, and tighten the success204NoContent type to Success<undefined> in messages.ts.
• Mark Phase 4.2 checklist complete and append the Phase 4.3 gate note in the planning docs.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tsconfig.netlify.functions.json	Enables strictNullChecks for the functions compilation path
src/functions/auth.ts	Passes the already-narrowed eventHeaders (from toDefinedHeaders) to getUserIdPassword instead of the raw event.headers
src/lib/MongodbService.ts	Adds an early-exit guard rejecting with 401 when user.hash is missing before calling comparePassword
src/lib/crypt.ts	Casts process.env.JWT_SECRET to jwt.Secret to satisfy the compiler in getAuthToken
src/lib/messages.ts	Narrows success204NoContent to Success<undefined> to accurately reflect a 204 No Content body
docs/plans/phase-4_2-checklist.md	Marks all Phase 4.2 checklist items as complete
docs/plans/phase-04-type-safety-and-env-handling.md	Adds the Phase 4.3 gate note recording the decision to proceed to broader strict evaluation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The fix for the strictNullChecks error uses process.env.JWT_SECRET as jwt.Secret to silence the compiler, but this is a type-cast workaround that doesn't add actual null safety. Unlike backend-utilities.ts (lines 39–41) and MongodbService.ts (lines 92–94), which both guard the env var at module load time with if (process.env.JWT_SECRET === undefined) throw "...", crypt.ts has no such guard. If JWT_SECRET is undefined at runtime, the cast will silently pass undefined to jwt.sign, which will then throw a JsonWebTokenError at the call site rather than failing fast at startup. The correct fix is to add a module-level guard — read the secret once, narrow the type to string (or jwt.Secret), and use that constant inside getAuthToken, consistent with the rest of the codebase.

[rendall]

Addressed by 7373e37

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.