バックエンド側 node.js CSRF/長時間処理/メール送信

・・・
import cors from 'cors';
・・・
// cors
const allowedOrigins = process.env.ALLOWED_ORIGIN?.split(',') || ['http://localhost:3001'];
const options: cors.CorsOptions = {
  origin: allowedOrigins
};
app.use(cors(options));
・・・

・・・
router.get("/list",
  // セッション認証用 authenticate,
  // トークン認証用 passport.authenticate("jwt", { session: false }),
  userController.list
);
・・・
router.post("/insertAsync", 
  userController.insertAsync, 
);
・・・

・・・
    insertAsync: async(req: Request, res: Response) => {
        const { name, email, address, zipcode } = req.body;
        res.json(userModel.insertAsync(name, email, address, zipcode));
    },
・・・

・・・
    insertAsync: async (_name: string, _email: string, _address: string, _zipcode: string) => {
        const insertFunc = async () => {
            const user = prisma.user.create({
                data: {
                    name: _name,
                    email: new Date().toISOString()+_email,
                    password: "",
                    address: _address,
                    zipcode: _zipcode,
                },
            });
            return user;
        }
        const insertedUser: User = await dbaccess.execute(insertFunc);

        await new Promise(resolve => setTimeout(resolve, 10000));// 長時間処理(10秒)
        
        const updateFunc = async (insertedUser: User): Promise<any> => {
            const user = prisma.user.update({
                where: {
                    id: insertedUser.id,
                },
                data: {
                    zipcode: "*****",
                    latitude: 100,
                    longitude: 120,
                },
            });
            return user;
        }
        return dbaccess.execute(updateFunc, insertedUser);
    },
・・・

・・・
-    execute: async (func: Function) => {
+    execute: async (func: Function, arg: any = null) => {
・・・

・・・
MAIL_HOST=127.0.0.1
MAIL_PORT=1025
MAIL_USER=
MAIL_PASS=
MAIL_SECURE=

import { getLogger } from "log4js";
import { createTransport } from "nodemailer";

export default {
    send: (data: object) => {
        const transporter = createTransport({
            host: process.env.MAIL_HOST,
            port: Number(process.env.MAIL_PORT),
            secure: (process.env.MAIL_SECURE=="true"),
            auth: {
                user: process.env.MAIL_USER,
                pass: process.env.MAIL_PASS
            }
        });
        transporter.sendMail(data, (error: any, info: any) => {
            if (error) {
                getLogger("app").error(error);
            } else {
                getLogger("app").info(info);
            }
        });

    },
}

・・・
    insertAsync: async (_name: string, _email: string, _address: string, _zipcode: string) => {
        ・・・
        const insertedUser: User = await dbaccess.execute(insertFunc);

        // データ投入時メール送信
        const insertMail = {
            from: insertedUser.email,
            to: insertedUser.email,
            text: "投入完了",
            subject: '投入完了',
        };
        mail.send(insertMail);

        await new Promise(resolve => setTimeout(resolve, 10000));// 長時間処理(10秒)
        ・・・
        const updatedUser = dbaccess.execute(updateFunc, insertedUser);

        // データ更新時メール送信
        const updateMail = {
          from: insertedUser.email,
          to: insertedUser.email,
          text: "更新完了",
          subject: '更新完了',
        };
        mail.send(updateMail);
        
        return updatedUser;
    },
・・・