c9b38dc6ab
fix(security): resolve audit findings — secrets, env contract, migrations
...
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-08-04 16:03:08 +05:30
4df4d8c9b5
object storage related updates
2026-08-04 03:34:52 -05:00
pradeepkumar
60c5ca23b2
feat: role-aware welcome email (USER vs Professional/AGENT variants)
2026-05-05 22:52:03 +05:30
pradeepkumar
b082d5d3a2
feat: enable Swagger for beta environments and add /docs route alias
2026-04-29 18:24:56 +05:30
pradeepkumar
38052a190f
refactor: update auth error messages to use Professional terminology instead of Agent
2026-04-28 13:59:22 +05:30
pradeepkumar
80c6fd1d71
feat: implement audit logging system with service, controller, and interceptor to track user actions across core services
2026-04-28 11:12:25 +05:30
pradeepkumar
4eda556059
feat: update registration conflict exception to specify existing user role in error message
2026-04-27 15:48:49 +05:30
pradeepkumar
fdbc727139
feat: prioritize favorited conversations in query results for both agents and users
2026-04-24 22:04:30 +05:30
pradeepkumar
9ae2f6516b
refactor: centralize profile field retrieval and filtering logic in buildFieldValuesResponse helper
2026-04-24 12:55:55 +05:30
pradeepkumar
360746c868
feat: remove subscription status as a visibility gate for agent profiles and include status in user service response
2026-04-20 23:38:21 +05:30
pradeepkumar
1541dba6e9
feat: implement secure email change workflow with verification token and event handling
2026-04-20 14:07:41 +05:30
pradeepkumar
37df1f49d4
fix: update default logo URL in base email template
2026-04-20 12:40:59 +05:30
pradeepkumar
0d063b2b6b
feat: add admin endpoints to list all subscription plans and sync plan details from Stripe
2026-04-17 18:58:29 +05:30
pradeepkumar
f79bf5f521
refactor: update field exclusion logic to use stable slugs and hide expertise areas from search filters
2026-04-17 12:40:48 +05:30
pradeepkumar
b6b95ea643
feat: exclude specific profile fields from search filter UI
2026-04-17 12:31:48 +05:30
pradeepkumar
4b36591812
feat: add optional agentTypeId query parameter to filter fields by agent type scope
2026-04-16 16:45:57 +05:30
pradeepkumar
d7a8da539a
feat: exempt presigned download URL endpoint from rate limiting to support avatar rendering
2026-04-16 10:03:00 +05:30
pradeepkumar
9245ab91ef
feat: implement radio field value expansion for ordinal filter matching in agent search
2026-04-16 07:29:36 +05:30
pradeepkumar
623fb9283f
feat: add sort order to agent profile field value queries by section and field position
2026-04-15 23:54:37 +05:30
pradeepkumar
678630fa8e
feat: add support for RADIO field type in filtering logic by including textValue in agent field matching
2026-04-15 23:45:12 +05:30
pradeepkumar
ef52858990
feat: include agentProfileId in connection response notifications to enable direct navigation to agent profiles
2026-04-15 19:37:59 +05:30
pradeepkumar
416257a881
refactor: disable automatic slug regeneration on field and section name updates to ensure stable references
2026-04-15 16:33:08 +05:30
pradeepkumar
29447de5b2
feat: implement sanitization for enumerated field values to remove stale options and add a cleanup script for existing data.
2026-04-15 15:46:33 +05:30
pradeepkumar
9c293a106f
fix
2026-04-15 12:43:15 +05:30
pradeepkumar
f053691d4a
fix
2026-04-15 12:43:05 +05:30
pradeepkumar
66be448fa2
feat: include field options and resolve display labels for structured field values in agent service
2026-04-14 08:47:14 +05:30
pradeepkumar
d84e55cb61
feat: mark related message notifications as read when updating conversation unread count
2026-04-13 22:48:05 +05:30
pradeepkumar
02a1f15324
feat: implement role-based login validation to restrict user/agent portal access
2026-04-13 20:26:14 +05:30
pradeepkumar
7be1b03383
refactor: disable agent match scoring and sorting when no search filters are active and strip privacy preferences from user objects
2026-04-13 16:51:47 +05:30
pradeepkumar
91336e5ead
feat: add optional slug field to UpdateSectionDto and update service to support manual slug overrides
2026-04-11 23:05:56 +05:30
pradeepkumar
09003bd409
refactor: update deleteConversation to perform soft-delete without notifying other participants
2026-04-10 17:44:38 +05:30
pradeepkumar
78133497b3
feat: implement per-user soft delete for conversations with automatic restoration on new messages
2026-04-10 16:48:12 +05:30
pradeepkumar
d80f75a39e
refactor: update email templates to use dynamic logo URLs and standardize branding to RE-Quest
2026-04-09 21:34:04 +05:30
pradeepkumar
92a29b664c
feat: migrate getRevenueStats to fetch directly from Stripe API with database fallback
2026-04-09 16:03:01 +05:30
pradeepkumar
eb6a78ead9
feat: notify other participant via gateway when a conversation is deleted
2026-04-09 16:02:24 +05:30
pradeepkumar
1843db79f3
fix: reduce socket ping intervals and remove unreliable auto-delivery status updates in messages gateway
2026-04-08 18:39:19 +05:30
pradeepkumar
f468d403e2
fix: disable forcePathStyle for DigitalOcean Spaces to ensure correct CORS behavior
2026-04-08 14:03:29 +05:30
pradeepkumar
99ff978247
fix: disable default AWS SDK v3 checksum calculation to support S3-compatible storage providers
2026-04-08 12:33:02 +05:30
pradeepkumar
b108eb35a2
feat: add public endpoint to resend user verification email by email address
2026-04-08 10:32:35 +05:30
pradeepkumar
9b4d64cf6a
feat: update user search to support multi-word name matching across profiles
2026-04-08 10:26:19 +05:30
pradeepkumar
3489fd913d
fix
2026-04-08 09:36:08 +05:30
pradeepkumar
50ef4d9a08
fix
2026-04-08 04:15:39 +05:30
pradeepkumar
6beaeea425
fix
2026-04-08 04:12:44 +05:30
pradeepkumar
87b0c17b44
feat: include agent ratings in user profile and resolve field option labels in agent service transformations
2026-04-08 04:11:33 +05:30
pradeepkumar
0dc13cb43a
fix
2026-04-07 19:55:12 +05:30
pradeepkumar
e7898536ec
feat: add message_received socket handler to notify senders of delivery status
2026-04-07 19:52:46 +05:30
pradeepkumar
590b4efe9d
feat: restrict agent profile access and search results to active, trialing, or past-due subscriptions
2026-04-07 15:53:48 +05:30
pradeepkumar
35b85c1cc0
fix: configure redis client options and optimize subscriber initialization using duplicate connection
2026-04-07 13:17:18 +05:30
pradeepkumar
44de2aeaa9
fix
2026-04-07 11:48:27 +05:30
pradeepkumar
c949b2d217
feat: add notification title, body, and icon to webpush payload in notifications service
2026-04-03 08:57:20 +05:30
