fix(backend): enable forbidNonWhitelisted, batch team split inserts, remove dead split math, and harden DTO/pipe/OAuth scopes (#170, #150, #127, #112, #111, #104, #98)

[ghzhost]

Summary of Changes

Closes #170, #150, #127, #112, #111, #104, #98.

1. Global Validation Pipe hardening (Global ValidationPipe uses forbidNonWhitelisted: false, silently stripping unexpected request body fields instead of rejecting them #170):

   • Configured forbidNonWhitelisted: true in main.ts so unknown body properties are rejected with a clear 400 rather than silently stripped.

2. Batch Team Member Splits insertion (TeamsService.create issues one separate INSERT per team member split instead of a single batched insert #150):

   • Updated TeamsService.create to batch split creation via this.splitRepo.save(splitEntities) instead of N concurrent individual inserts.
   • Updated unit tests to verify single batched call.

3. Drop Unused OAuth Scope (GithubStrategy requests the read:org OAuth scope but nothing in the codebase reads org membership data #127):

   • Removed read:org from GithubStrategy scopes to adhere to least-privilege principles, leaving only user:email.

4. DTO Min/Max bounds on team splits (TeamMemberSplitDto.percentage has @IsNumber() but no @Min/@Max bound, unlike escrow's SplitRecipientDto #112):

   • Added @Min(0.01) and @Max(100) decorators to TeamMemberSplitDto.percentage.

5. Remove Dead Split Math (computeSplitShares() in team-split.util.ts is unused dead code #111):

   • Removed unused computeSplitShares from src/teams/team-split.util.ts and its spec file.

6. ParseEnumPipe for Bounties status query filter (BountiesController.list's status query param has no @IsEnum validation #104):

   • Added new ParseEnumPipe(BountyStatus, { optional: true }) to GET /bounties status query param to reject invalid status values early with 400.

7. Fix JwtModule expiresIn typing (JwtModule's expiresIn is cast via as unknown as number, masking a string/number type mismatch #98):

   • Replaced misleading as unknown as number cast with precise as StringValue | number using ms type definitions.

Verification

• npm run build succeeds cleanly.
• npx jest --testPathIgnorePatterns="integration" passes all 20 test suites (161 tests).

[vercel]

Someone is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.