8b677251cc
Merge pull request 'fix(security): resolve client audit findings' ( #1 ) from fix/security-audit into main
...
Reviewed-on: #1
2026-08-04 13:18:41 +00:00
567487a87c
docs(env): document S3_PUBLIC_ENDPOINT and the /s3 path-prefix behaviour
...
Follow-up to 4df4d8cnoreply@anthropic.com >
2026-08-04 16:12:43 +05:30
c9b38dc6ab
fix(security): resolve audit findings — secrets, env contract, migrations
...
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-08-04 16:03:08 +05:30
4df4d8c9b5
object storage related updates
2026-08-04 03:34:52 -05:00
pradeepkumar
60c5ca23b2
feat: role-aware welcome email (USER vs Professional/AGENT variants)
2026-05-05 22:52:03 +05:30
pradeepkumar
b082d5d3a2
feat: enable Swagger for beta environments and add /docs route alias
2026-04-29 18:24:56 +05:30
pradeepkumar
38052a190f
refactor: update auth error messages to use Professional terminology instead of Agent
2026-04-28 13:59:22 +05:30
pradeepkumar
80c6fd1d71
feat: implement audit logging system with service, controller, and interceptor to track user actions across core services
2026-04-28 11:12:25 +05:30
pradeepkumar
4eda556059
feat: update registration conflict exception to specify existing user role in error message
2026-04-27 15:48:49 +05:30
pradeepkumar
fdbc727139
feat: prioritize favorited conversations in query results for both agents and users
2026-04-24 22:04:30 +05:30
pradeepkumar
9ae2f6516b
refactor: centralize profile field retrieval and filtering logic in buildFieldValuesResponse helper
2026-04-24 12:55:55 +05:30
pradeepkumar
360746c868
feat: remove subscription status as a visibility gate for agent profiles and include status in user service response
2026-04-20 23:38:21 +05:30
pradeepkumar
1541dba6e9
feat: implement secure email change workflow with verification token and event handling
2026-04-20 14:07:41 +05:30
pradeepkumar
37df1f49d4
fix: update default logo URL in base email template
2026-04-20 12:40:59 +05:30
pradeepkumar
0d063b2b6b
feat: add admin endpoints to list all subscription plans and sync plan details from Stripe
2026-04-17 18:58:29 +05:30
pradeepkumar
f79bf5f521
refactor: update field exclusion logic to use stable slugs and hide expertise areas from search filters
2026-04-17 12:40:48 +05:30
pradeepkumar
b6b95ea643
feat: exclude specific profile fields from search filter UI
2026-04-17 12:31:48 +05:30
pradeepkumar
4b36591812
feat: add optional agentTypeId query parameter to filter fields by agent type scope
2026-04-16 16:45:57 +05:30
pradeepkumar
d7a8da539a
feat: exempt presigned download URL endpoint from rate limiting to support avatar rendering
2026-04-16 10:03:00 +05:30
pradeepkumar
9245ab91ef
feat: implement radio field value expansion for ordinal filter matching in agent search
2026-04-16 07:29:36 +05:30
pradeepkumar
623fb9283f
feat: add sort order to agent profile field value queries by section and field position
2026-04-15 23:54:37 +05:30
pradeepkumar
678630fa8e
feat: add support for RADIO field type in filtering logic by including textValue in agent field matching
2026-04-15 23:45:12 +05:30
pradeepkumar
ef52858990
feat: include agentProfileId in connection response notifications to enable direct navigation to agent profiles
2026-04-15 19:37:59 +05:30
pradeepkumar
416257a881
refactor: disable automatic slug regeneration on field and section name updates to ensure stable references
2026-04-15 16:33:08 +05:30
pradeepkumar
29447de5b2
feat: implement sanitization for enumerated field values to remove stale options and add a cleanup script for existing data.
2026-04-15 15:46:33 +05:30
pradeepkumar
625d1d669a
refactor: comment out agentTypeSections in seed script to prevent unintended application during bootstrap
2026-04-15 14:00:27 +05:30
pradeepkumar
d97657b475
refactor: remove auto-seeding logic for agent-type-specific sections to preserve admin customizations
2026-04-15 13:41:29 +05:30
pradeepkumar
e6e46fe616
fix
2026-04-15 13:40:22 +05:30
pradeepkumar
9c293a106f
fix
2026-04-15 12:43:15 +05:30
pradeepkumar
f053691d4a
fix
2026-04-15 12:43:05 +05:30
pradeepkumar
76ad688cd8
refactor: remove state abbreviations from location labels in US_CITIES_CO_NE_ND_SD data file
2026-04-14 12:08:14 +05:30
pradeepkumar
e434863b88
feat: add personal tagline field to seed data and update subsequent field sort orders
2026-04-14 10:11:03 +05:30
pradeepkumar
0b2bcd285a
feat: add Preferred Work Environment field and update subsequent field sort orders in seed script
2026-04-14 09:07:53 +05:30
pradeepkumar
66be448fa2
feat: include field options and resolve display labels for structured field values in agent service
2026-04-14 08:47:14 +05:30
pradeepkumar
756e803384
feat: add Real Estate Agency & Designation field group and update subsequent sort orders in seed script
2026-04-14 07:54:20 +05:30
pradeepkumar
2e8c097b7c
fix: remove unnecessary double quotes from hero section headline in seed data
2026-04-13 23:31:36 +05:30
pradeepkumar
d84e55cb61
feat: mark related message notifications as read when updating conversation unread count
2026-04-13 22:48:05 +05:30
pradeepkumar
02a1f15324
feat: implement role-based login validation to restrict user/agent portal access
2026-04-13 20:26:14 +05:30
pradeepkumar
7be1b03383
refactor: disable agent match scoring and sorting when no search filters are active and strip privacy preferences from user objects
2026-04-13 16:51:47 +05:30
pradeepkumar
e1a364dc5b
chore: remove description and helper text from seed data content
2026-04-12 16:18:35 +05:30
pradeepkumar
b66b5c963b
feat: add script and data to update state and city location options for CO, NE, ND, and SD
2026-04-12 00:01:21 +05:30
pradeepkumar
91336e5ead
feat: add optional slug field to UpdateSectionDto and update service to support manual slug overrides
2026-04-11 23:05:56 +05:30
pradeepkumar
bebff19052
chore: update ctaButtonText in seed data to See All
2026-04-11 22:14:07 +05:30
pradeepkumar
400f9e6c4a
chore: remove obsolete testimonials CMS update script
2026-04-11 22:12:33 +05:30
pradeepkumar
e05a76a94f
fix: update landing page topProfessionals section content text
2026-04-11 22:10:51 +05:30
pradeepkumar
a435a3d25e
feat: update testimonials content and implement automatic CMS record updates during seeding
2026-04-11 21:44:38 +05:30
pradeepkumar
09003bd409
refactor: update deleteConversation to perform soft-delete without notifying other participants
2026-04-10 17:44:38 +05:30
pradeepkumar
78133497b3
feat: implement per-user soft delete for conversations with automatic restoration on new messages
2026-04-10 16:48:12 +05:30
pradeepkumar
d80f75a39e
refactor: update email templates to use dynamic logo URLs and standardize branding to RE-Quest
2026-04-09 21:34:04 +05:30
pradeepkumar
92a29b664c
feat: migrate getRevenueStats to fetch directly from Stripe API with database fallback
2026-04-09 16:03:01 +05:30
