Fix QA validation issues and add M7.1 security fixes (#318)

Co-authored-by: Jason Woltje <jason@diversecanvas.com>
Co-committed-by: Jason Woltje <jason@diversecanvas.com>

apps/api/src/federation/http-timeout.spec.ts

@@ -0,0 +1,69 @@
+/**
+ * HTTP Timeout Tests
+ *
+ * Verifies that HTTP requests have proper timeout configuration to prevent DoS attacks.
+ * Issue #282: Add HTTP request timeouts (DoS risk)
+ */
+
+import { describe, it, expect, beforeEach } from "vitest";
+import { Test, TestingModule } from "@nestjs/testing";
+import { HttpService, HttpModule } from "@nestjs/axios";
+import { ConfigModule } from "@nestjs/config";
+import { of, delay } from "rxjs";
+
+describe("HTTP Timeout Configuration", () => {
+  let httpService: HttpService;
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      imports: [
+        ConfigModule,
+        HttpModule.register({
+          timeout: 10000, // 10 seconds
+          maxRedirects: 5,
+        }),
+      ],
+    }).compile();
+
+    httpService = module.get<HttpService>(HttpService);
+  });
+
+  it("should have HttpService configured", () => {
+    expect(httpService).toBeDefined();
+  });
+
+  it("should have axios instance with timeout configured", () => {
+    const axiosInstance = httpService.axiosRef;
+    expect(axiosInstance.defaults.timeout).toBe(10000);
+  });
+
+  it("should have max redirects configured", () => {
+    const axiosInstance = httpService.axiosRef;
+    expect(axiosInstance.defaults.maxRedirects).toBe(5);
+  });
+});
+
+describe("HTTP Timeout Behavior", () => {
+  let httpService: HttpService;
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      imports: [
+        ConfigModule,
+        HttpModule.register({
+          timeout: 100, // 100ms for fast testing
+          maxRedirects: 5,
+        }),
+      ],
+    }).compile();
+
+    httpService = module.get<HttpService>(HttpService);
+  });
+
+  it("should timeout requests that exceed the configured timeout", async () => {
+    // This test verifies the timeout mechanism exists
+    // In a real scenario, a slow server would trigger this
+    const axiosInstance = httpService.axiosRef;
+    expect(axiosInstance.defaults.timeout).toBe(100);
+  });
+});