docs/README.md

# RE:Quest — system documentation

| Document | Contents |
|---|---|
| [architecture.md](./architecture.md) | Components, runtime topology, auth model, roles, configuration contract, DB change process |
| [data-model.md](./data-model.md) | ER diagram + every entity, field and enum (generated from `prisma/schema.prisma`) |
| [flows.md](./flows.md) | Sequence diagrams: registration, login & 2FA, Google sign-in, connection requests, real-time messaging, subscription/payment & Stripe webhooks, agent verification, file upload; email trigger events; data-flow diagram |
| [2fa-key-rotation.md](./2fa-key-rotation.md) | How to rotate `JWT_SECRET` without locking out every 2FA user |

Diagrams are Mermaid embedded in Markdown: source-controllable, diffable, and
rendered natively by GitHub/GitLab.

`data-model.md` is generated from the Prisma schema — regenerate it after any
schema change rather than editing it by hand.
fix(security): resolve audit findings — secrets, env contract, migrations Removes hardcoded fallback secrets and makes a misconfigured deploy fail loudly instead of silently falling back to development defaults. - Remove insecure JWT fallback secrets (messages.module, configuration) - Remove the 'default-secret' fallback for the 2FA TOTP encryption key and allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no longer locks out every 2FA user (see docs/2fa-key-rotation.md) - Require EMAIL_API_URL; drop the hardcoded vendor email endpoint - Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*' - Load .env before any Nest module is imported (src/load-env.ts). Decorator arguments evaluate at import time, so the gateway previously froze its CORS config to the localhost fallback even when CORS_ORIGINS was set - Add boot-time env validation: missing required vars, weak JWT_SECRET, and inverted access/refresh token lifetimes now abort startup - Enable Redis TLS certificate verification - Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published default super-admin credentials and stop printing them - Add the initial Prisma migration and stop gitignoring prisma/migrations - Make .env.example an accurate configuration contract (admin bootstrap, REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block) - Add handover documentation: architecture, ER model, sequence and data-flow diagrams, 2FA key rotation runbook Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> 2026-08-04 11:30:36 +05:30			`# RE:Quest — system documentation`

			`\| Document \| Contents \|`
			`\|---\|---\|`
			`\| [architecture.md](./architecture.md) \| Components, runtime topology, auth model, roles, configuration contract, DB change process \|`
			\| [data-model.md](./data-model.md) \| ER diagram + every entity, field and enum (generated from `prisma/schema.prisma`) \|
			`\| [flows.md](./flows.md) \| Sequence diagrams: registration, login & 2FA, Google sign-in, connection requests, real-time messaging, subscription/payment & Stripe webhooks, agent verification, file upload; email trigger events; data-flow diagram \|`
			\| [2fa-key-rotation.md](./2fa-key-rotation.md) \| How to rotate `JWT_SECRET` without locking out every 2FA user \|

			`Diagrams are Mermaid embedded in Markdown: source-controllable, diffable, and`
			`rendered natively by GitHub/GitLab.`

			`data-model.md` is generated from the Prisma schema — regenerate it after any
			`schema change rather than editing it by hand.`