minor fixes

src/index.ts

@@ -45,6 +45,7 @@ app.use(helmet(defaultHeaderConfig));
 app.use('/api-doc', helmet.contentSecurityPolicy({
   ...defaultHeaderConfig,
   directives: {
+    defaultSrc: [`'none'`],
     scriptSrc: [`'self'`],
     connectSrc: [`'self'`],
     styleSrc: [`'self'`, `'unsafe-inline'`],

src/routes/user.ts

@@ -65,6 +65,7 @@ router.put('/user:username([/](?!key|new).?*|/?)', async (req, res, next) => {
   });
 });
 
+// TODO: only possible if no data is linked to user, otherwise change status, etc.
 router.delete('/user:username([/](?!key|new).?*|/?)', (req, res, next) => {  // this path matches /user, /user/ and /user/xxx, but not /user/key or user/new. See https://forbeslindesay.github.io/express-route-tester/ for the generated regex
   if (!req.auth(res, ['read', 'write', 'maintain', 'dev', 'admin'], 'basic')) return;