[Sensei-Victor]

Closes #357

Summary of Changes

• Read the OpenAPI document version dynamically from package.json at startup instead of hardcoding 1.0.0.
• Added OpenAPI security schemes for the three admin headers under components.securitySchemes:
  • adminAddress (x-admin-address)
  • adminSignature (x-admin-signature)
  • adminTimestamp (x-admin-timestamp)
• Declared the admin security requirement ([{ adminAddress: [], adminSignature: [], adminTimestamp: [] }]) on all admin endpoints (/ngo-applications/stats, /ngo-applications, /ngo-applications/:id, /ngo-applications/:id/approve, /ngo-applications/:id/reject, /ngos/all, and /admin/ngos/:id).
• Added an onRoute hook check to ensure any route using requireAdminSignature automatically inherits the security scheme in OpenAPI documentation.
• Ensured all routes across the API have explicit OpenAPI tags (Health, NGOs, Donors, Streams, Impact, NGO Applications, Indexer, Metrics).
• Added comprehensive OpenAPI test suite in test/openapi.test.ts asserting spec version, security schemes, endpoint protections, and tags.

Testing Performed

• npm run lint / npx eslint . — code conforms cleanly to project ESLint standards without warnings.
• npm run typecheck — TypeScript check passed with 0 errors.
• npm test — all test suites including unit, integration, and OpenAPI assertions passed cleanly.

[drips-wave]

@Sensei-Victor Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits