[Copilot]

CodeQL flagged a high-severity js/disabling-certificate-validation alert (CWE-295/CWE-297): the Cosmos DB emulator setup fell back to rejectUnauthorized: false when the emulator CA cert file was missing, fully disabling TLS validation and opening the door to MITM attacks.

Change

api/src/shared/cosmosdb.ts

• Removed the insecure fallback https.Agent({ rejectUnauthorized: false }) — including its prod-environment guard, which was insufficient mitigation
• When the emulator CA cert is not found, a descriptive error is now thrown and caught by the surrounding try/catch, which logs a clear actionable warning

// Before
} else {
  if (process.env.ENVIRONMENT === 'prod') {
    throw new Error('Cannot disable TLS verification in production environment')
  }
  clientOptions.agent = new https.Agent({ rejectUnauthorized: false }) // ← flagged
}

// After
} else {
  throw new Error(
    `Cosmos DB Emulator CA certificate not found at "${emulatorCertPath}". ` +
    `Run the emulator setup script or set COSMOS_EMULATOR_CERT_PATH to a valid cert file.`
  )
}

TLS validation is now always enforced; developers get an explicit error instead of a silent insecure connection.

[github-actions]

❌ Lighthouse Accessibility Score

Category	Score	Threshold
♿ Accessibility	N/A%	≥ 90%

⚠️ Score is below the 90% threshold — please fix the violations.

🔗 View full Lighthouse report (expires in 7 days)

[Copilot]

🟡 Changes recommended

The security-sensitive missing-emulator-certificate fallback lacks a regression test verifying the actionable warning and absence of a TLS-validation-disabled agent.

1 open issue

• Add regression test for missing emulator certificate fallback · New

What changed in this PR

This PR addresses the CodeQL certificate-validation alert by removing the Cosmos DB emulator’s insecure TLS fallback.

Changes:

• Removes the agent that disabled certificate validation when the emulator CA certificate was missing.
• Adds a descriptive missing-certificate error, logged by the existing catch block with setup guidance.

File	Description
api/​src/​shared/​cosmosdb.ts	Removes the insecure emulator TLS fallback and adds an actionable certificate warning.

_{Review effort: Balanced}