Re-Quest/backend
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
185 Commits 2 Branches 0 Tags
main
Commit Graph

185 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Sathish
8b677251cc Merge pull request 'fix(security): resolve client audit findings' (#1) from fix/security-audit into main 
Reviewed-on: #1
 2026-08-04 13:18:41 +00:00
Sathish
567487a87c docs(env): document S3_PUBLIC_ENDPOINT and the /s3 path-prefix behaviour 
Follow-up to 4df4d8c, which added the variable. Keeps .env.example an
accurate configuration contract.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-04 16:12:43 +05:30
Sathish
c9b38dc6ab fix(security): resolve audit findings — secrets, env contract, migrations 
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.

- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
  allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
  longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
  arguments evaluate at import time, so the gateway previously froze its CORS
  config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
  inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
  default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
  REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
  diagrams, 2FA key rotation runbook

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-04 16:03:08 +05:30
anand
4df4d8c9b5 object storage related updates 2026-08-04 03:34:52 -05:00
pradeepkumar
60c5ca23b2 feat: role-aware welcome email (USER vs Professional/AGENT variants) 2026-05-05 22:52:03 +05:30
pradeepkumar
b082d5d3a2 feat: enable Swagger for beta environments and add /docs route alias 2026-04-29 18:24:56 +05:30
pradeepkumar
38052a190f refactor: update auth error messages to use Professional terminology instead of Agent 2026-04-28 13:59:22 +05:30
pradeepkumar
80c6fd1d71 feat: implement audit logging system with service, controller, and interceptor to track user actions across core services 2026-04-28 11:12:25 +05:30
pradeepkumar
4eda556059 feat: update registration conflict exception to specify existing user role in error message 2026-04-27 15:48:49 +05:30
pradeepkumar
fdbc727139 feat: prioritize favorited conversations in query results for both agents and users 2026-04-24 22:04:30 +05:30
pradeepkumar
9ae2f6516b refactor: centralize profile field retrieval and filtering logic in buildFieldValuesResponse helper 2026-04-24 12:55:55 +05:30
pradeepkumar
360746c868 feat: remove subscription status as a visibility gate for agent profiles and include status in user service response 2026-04-20 23:38:21 +05:30
pradeepkumar
1541dba6e9 feat: implement secure email change workflow with verification token and event handling 2026-04-20 14:07:41 +05:30
pradeepkumar
37df1f49d4 fix: update default logo URL in base email template 2026-04-20 12:40:59 +05:30
pradeepkumar
0d063b2b6b feat: add admin endpoints to list all subscription plans and sync plan details from Stripe 2026-04-17 18:58:29 +05:30
pradeepkumar
f79bf5f521 refactor: update field exclusion logic to use stable slugs and hide expertise areas from search filters 2026-04-17 12:40:48 +05:30
pradeepkumar
b6b95ea643 feat: exclude specific profile fields from search filter UI 2026-04-17 12:31:48 +05:30
pradeepkumar
4b36591812 feat: add optional agentTypeId query parameter to filter fields by agent type scope 2026-04-16 16:45:57 +05:30
pradeepkumar
d7a8da539a feat: exempt presigned download URL endpoint from rate limiting to support avatar rendering 2026-04-16 10:03:00 +05:30
pradeepkumar
9245ab91ef feat: implement radio field value expansion for ordinal filter matching in agent search 2026-04-16 07:29:36 +05:30
pradeepkumar
623fb9283f feat: add sort order to agent profile field value queries by section and field position 2026-04-15 23:54:37 +05:30
pradeepkumar
678630fa8e feat: add support for RADIO field type in filtering logic by including textValue in agent field matching 2026-04-15 23:45:12 +05:30
pradeepkumar
ef52858990 feat: include agentProfileId in connection response notifications to enable direct navigation to agent profiles 2026-04-15 19:37:59 +05:30
pradeepkumar
416257a881 refactor: disable automatic slug regeneration on field and section name updates to ensure stable references 2026-04-15 16:33:08 +05:30
pradeepkumar
29447de5b2 feat: implement sanitization for enumerated field values to remove stale options and add a cleanup script for existing data. 2026-04-15 15:46:33 +05:30
pradeepkumar
625d1d669a refactor: comment out agentTypeSections in seed script to prevent unintended application during bootstrap 2026-04-15 14:00:27 +05:30
pradeepkumar
d97657b475 refactor: remove auto-seeding logic for agent-type-specific sections to preserve admin customizations 2026-04-15 13:41:29 +05:30
pradeepkumar
e6e46fe616 fix 2026-04-15 13:40:22 +05:30
pradeepkumar
9c293a106f fix 2026-04-15 12:43:15 +05:30
pradeepkumar
f053691d4a fix 2026-04-15 12:43:05 +05:30
pradeepkumar
76ad688cd8 refactor: remove state abbreviations from location labels in US_CITIES_CO_NE_ND_SD data file 2026-04-14 12:08:14 +05:30
pradeepkumar
e434863b88 feat: add personal tagline field to seed data and update subsequent field sort orders 2026-04-14 10:11:03 +05:30
pradeepkumar
0b2bcd285a feat: add Preferred Work Environment field and update subsequent field sort orders in seed script 2026-04-14 09:07:53 +05:30
pradeepkumar
66be448fa2 feat: include field options and resolve display labels for structured field values in agent service 2026-04-14 08:47:14 +05:30
pradeepkumar
756e803384 feat: add Real Estate Agency & Designation field group and update subsequent sort orders in seed script 2026-04-14 07:54:20 +05:30
pradeepkumar
2e8c097b7c fix: remove unnecessary double quotes from hero section headline in seed data 2026-04-13 23:31:36 +05:30
pradeepkumar
d84e55cb61 feat: mark related message notifications as read when updating conversation unread count 2026-04-13 22:48:05 +05:30
pradeepkumar
02a1f15324 feat: implement role-based login validation to restrict user/agent portal access 2026-04-13 20:26:14 +05:30
pradeepkumar
7be1b03383 refactor: disable agent match scoring and sorting when no search filters are active and strip privacy preferences from user objects 2026-04-13 16:51:47 +05:30
pradeepkumar
e1a364dc5b chore: remove description and helper text from seed data content 2026-04-12 16:18:35 +05:30
pradeepkumar
b66b5c963b feat: add script and data to update state and city location options for CO, NE, ND, and SD 2026-04-12 00:01:21 +05:30
pradeepkumar
91336e5ead feat: add optional slug field to UpdateSectionDto and update service to support manual slug overrides 2026-04-11 23:05:56 +05:30
pradeepkumar
bebff19052 chore: update ctaButtonText in seed data to See All 2026-04-11 22:14:07 +05:30
pradeepkumar
400f9e6c4a chore: remove obsolete testimonials CMS update script 2026-04-11 22:12:33 +05:30
pradeepkumar
e05a76a94f fix: update landing page topProfessionals section content text 2026-04-11 22:10:51 +05:30
pradeepkumar
a435a3d25e feat: update testimonials content and implement automatic CMS record updates during seeding 2026-04-11 21:44:38 +05:30
pradeepkumar
09003bd409 refactor: update deleteConversation to perform soft-delete without notifying other participants 2026-04-10 17:44:38 +05:30
pradeepkumar
78133497b3 feat: implement per-user soft delete for conversations with automatic restoration on new messages 2026-04-10 16:48:12 +05:30
pradeepkumar
d80f75a39e refactor: update email templates to use dynamic logo URLs and standardize branding to RE-Quest 2026-04-09 21:34:04 +05:30
pradeepkumar
92a29b664c feat: migrate getRevenueStats to fetch directly from Stripe API with database fallback 2026-04-09 16:03:01 +05:30