Re-Quest/backend
5
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
184 Commits 2 Branches 0 Tags
fix/security-audit
Commit Graph
155 Commits
Author SHA1 Message Date
sathishandClaude Opus 5 c9b38dc6ab fix(security): resolve audit findings — secrets, env contract, migrations 
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.

- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
  allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
  longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
  arguments evaluate at import time, so the gateway previously froze its CORS
  config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
  inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
  default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
  REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
  diagrams, 2FA key rotation runbook

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-04 16:03:08 +05:30
anand 4df4d8c9b5 object storage related updates 2026-08-04 03:34:52 -05:00
pradeepkumar 60c5ca23b2 feat: role-aware welcome email (USER vs Professional/AGENT variants) 2026-05-05 22:52:03 +05:30
pradeepkumar b082d5d3a2 feat: enable Swagger for beta environments and add /docs route alias 2026-04-29 18:24:56 +05:30
pradeepkumar 38052a190f refactor: update auth error messages to use Professional terminology instead of Agent 2026-04-28 13:59:22 +05:30
pradeepkumar 80c6fd1d71 feat: implement audit logging system with service, controller, and interceptor to track user actions across core services 2026-04-28 11:12:25 +05:30
pradeepkumar 4eda556059 feat: update registration conflict exception to specify existing user role in error message 2026-04-27 15:48:49 +05:30
pradeepkumar fdbc727139 feat: prioritize favorited conversations in query results for both agents and users 2026-04-24 22:04:30 +05:30
pradeepkumar 9ae2f6516b refactor: centralize profile field retrieval and filtering logic in buildFieldValuesResponse helper 2026-04-24 12:55:55 +05:30
pradeepkumar 360746c868 feat: remove subscription status as a visibility gate for agent profiles and include status in user service response 2026-04-20 23:38:21 +05:30
pradeepkumar 1541dba6e9 feat: implement secure email change workflow with verification token and event handling 2026-04-20 14:07:41 +05:30
pradeepkumar 37df1f49d4 fix: update default logo URL in base email template 2026-04-20 12:40:59 +05:30
pradeepkumar 0d063b2b6b feat: add admin endpoints to list all subscription plans and sync plan details from Stripe 2026-04-17 18:58:29 +05:30
pradeepkumar f79bf5f521 refactor: update field exclusion logic to use stable slugs and hide expertise areas from search filters 2026-04-17 12:40:48 +05:30
pradeepkumar b6b95ea643 feat: exclude specific profile fields from search filter UI 2026-04-17 12:31:48 +05:30
pradeepkumar 4b36591812 feat: add optional agentTypeId query parameter to filter fields by agent type scope 2026-04-16 16:45:57 +05:30
pradeepkumar d7a8da539a feat: exempt presigned download URL endpoint from rate limiting to support avatar rendering 2026-04-16 10:03:00 +05:30
pradeepkumar 9245ab91ef feat: implement radio field value expansion for ordinal filter matching in agent search 2026-04-16 07:29:36 +05:30
pradeepkumar 623fb9283f feat: add sort order to agent profile field value queries by section and field position 2026-04-15 23:54:37 +05:30
pradeepkumar 678630fa8e feat: add support for RADIO field type in filtering logic by including textValue in agent field matching 2026-04-15 23:45:12 +05:30
pradeepkumar ef52858990 feat: include agentProfileId in connection response notifications to enable direct navigation to agent profiles 2026-04-15 19:37:59 +05:30
pradeepkumar 416257a881 refactor: disable automatic slug regeneration on field and section name updates to ensure stable references 2026-04-15 16:33:08 +05:30
pradeepkumar 29447de5b2 feat: implement sanitization for enumerated field values to remove stale options and add a cleanup script for existing data. 2026-04-15 15:46:33 +05:30
pradeepkumar 9c293a106f fix 2026-04-15 12:43:15 +05:30
pradeepkumar f053691d4a fix 2026-04-15 12:43:05 +05:30
pradeepkumar 66be448fa2 feat: include field options and resolve display labels for structured field values in agent service 2026-04-14 08:47:14 +05:30
pradeepkumar d84e55cb61 feat: mark related message notifications as read when updating conversation unread count 2026-04-13 22:48:05 +05:30
pradeepkumar 02a1f15324 feat: implement role-based login validation to restrict user/agent portal access 2026-04-13 20:26:14 +05:30
pradeepkumar 7be1b03383 refactor: disable agent match scoring and sorting when no search filters are active and strip privacy preferences from user objects 2026-04-13 16:51:47 +05:30
pradeepkumar 91336e5ead feat: add optional slug field to UpdateSectionDto and update service to support manual slug overrides 2026-04-11 23:05:56 +05:30
pradeepkumar 09003bd409 refactor: update deleteConversation to perform soft-delete without notifying other participants 2026-04-10 17:44:38 +05:30
pradeepkumar 78133497b3 feat: implement per-user soft delete for conversations with automatic restoration on new messages 2026-04-10 16:48:12 +05:30
pradeepkumar d80f75a39e refactor: update email templates to use dynamic logo URLs and standardize branding to RE-Quest 2026-04-09 21:34:04 +05:30
pradeepkumar 92a29b664c feat: migrate getRevenueStats to fetch directly from Stripe API with database fallback 2026-04-09 16:03:01 +05:30
pradeepkumar eb6a78ead9 feat: notify other participant via gateway when a conversation is deleted 2026-04-09 16:02:24 +05:30
pradeepkumar 1843db79f3 fix: reduce socket ping intervals and remove unreliable auto-delivery status updates in messages gateway 2026-04-08 18:39:19 +05:30
pradeepkumar f468d403e2 fix: disable forcePathStyle for DigitalOcean Spaces to ensure correct CORS behavior 2026-04-08 14:03:29 +05:30
pradeepkumar 99ff978247 fix: disable default AWS SDK v3 checksum calculation to support S3-compatible storage providers 2026-04-08 12:33:02 +05:30
pradeepkumar b108eb35a2 feat: add public endpoint to resend user verification email by email address 2026-04-08 10:32:35 +05:30
pradeepkumar 9b4d64cf6a feat: update user search to support multi-word name matching across profiles 2026-04-08 10:26:19 +05:30
pradeepkumar 3489fd913d fix 2026-04-08 09:36:08 +05:30
pradeepkumar 50ef4d9a08 fix 2026-04-08 04:15:39 +05:30
pradeepkumar 6beaeea425 fix 2026-04-08 04:12:44 +05:30
pradeepkumar 87b0c17b44 feat: include agent ratings in user profile and resolve field option labels in agent service transformations 2026-04-08 04:11:33 +05:30
pradeepkumar 0dc13cb43a fix 2026-04-07 19:55:12 +05:30
pradeepkumar e7898536ec feat: add message_received socket handler to notify senders of delivery status 2026-04-07 19:52:46 +05:30
pradeepkumar 590b4efe9d feat: restrict agent profile access and search results to active, trialing, or past-due subscriptions 2026-04-07 15:53:48 +05:30
pradeepkumar 35b85c1cc0 fix: configure redis client options and optimize subscriber initialization using duplicate connection 2026-04-07 13:17:18 +05:30
pradeepkumar 44de2aeaa9 fix 2026-04-07 11:48:27 +05:30
pradeepkumar c949b2d217 feat: add notification title, body, and icon to webpush payload in notifications service 2026-04-03 08:57:20 +05:30