remove debug endpoints that are unsafe in final version

src/index.ts

@@ -26,7 +26,9 @@ app.get("/health", (_req, res) => {
 });
 
 app.use("/notifications", notificationsRouter);
-app.use("/debug", debugRouter);
+
+// Only include on test environments
+// app.use("/debug", debugRouter);
 
 startScheduler();
 startAlertSearchScheduler();

src/routes/debug.ts

@@ -11,7 +11,6 @@ import {
 import { formatElapsedMs } from "../util/formatElapsed.js";
 import { maskToken } from "../util/maskToken.js";
 
-// TODO: Protect this endpoint before production deployment
 export const debugRouter: express.Router = Router();
 
 function deviceDebugPayload(row: {
@@ -47,7 +46,6 @@ function sendWakeupFailureReason(
   return "FCM send failed";
 }
 
-// TODO: Protect this endpoint before production deployment
 debugRouter.get("/device/:token", requireAuth, async (req, res) => {
   const started = Date.now();
   const userId = req.did;
@@ -84,7 +82,6 @@ debugRouter.get("/device/:token", requireAuth, async (req, res) => {
   );
 });
 
-// TODO: Protect this endpoint before production deployment
 debugRouter.post("/send-wakeup", requireAuthOrNotificationLocalTest, async (req, res) => {
   const started = Date.now();
   const userId = req.did;