4 commits

Author	SHA1	Message	Date
Ashwin Kumar Sivakumar	fdd5c7a418	Fix security audit findings: admin authz, captcha, secret leak, CORS ... - Require admin role on role/module/permission management endpoints that previously accepted any authenticated user (privilege escalation) - Add server-side captcha generation/verification (Redis-backed, single-use, 5 min TTL) enforced on register/login for users and employees services - Untrack .env.test111 (contained a live SMTP key) and harden .gitignore against future .env commits - Stop logging OTP codes in plaintext - Restrict jobs service CORS to an explicit origin allowlist - Mask PayU merchant secret/salt in payment-gateway-config responses, preserving the stored value on save when the field is left unchanged - Bump vulnerable transitive dependencies (quinn-proto, rustls-webpki, anyhow) via cargo update; switch aws-sdk-s3 off the legacy rustls feature Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-23 17:31:48 +05:30
Ashwin Kumar Sivakumar	0dd5045676	feat: Complete Ask Ash AI Credits implementation on high-performance branch (Tasks 1-10) ... - Task 1: Admin endpoints for wallet management - Task 2: AI Credits admin UI (pricing.tsx, credit.tsx) - Task 3: Ollama security (NetworkPolicy, prompt validation, audit) - Task 4: LiteLLM integration (litellm.rs, migrated AI feature handlers) - Task 5: Refund architecture (ai_refunds table, endpoints) - Task 6: Coupons, promotions, referrals (order creation with coupon) - Task 7: Subscription lifecycle (plan upgrades/downgrades, cron jobs) - Task 8: Credit expiration enforcement (daily cron task) - Task 9: Token cost engine (ai_model_cost_config, margin view) - Task 10: Observability (metrics tables, aggregation function) Cherry-picked from main branch commit 3c0f45f	2026-07-06 01:49:16 +05:30
Ashwin Kumar Sivakumar	8f0cf64eb4	fix: update jsonwebtoken 9.3→10.3, add audit.toml to ignore local crate false positives, fix cache/ollama.rs compile errors ... - Update jsonwebtoken from 9.3 to 10.3 in crates/auth/Cargo.toml and crates/contracts/Cargo.toml - Create .cargo/audit.toml to ignore false positives for local workspace crates 'cache' and 'users' - Fix pre-existing compile errors in crates/cache/src/ollama.rs (missing reqwest dep, broken format! string literals) - Add reqwest workspace dependency to crates/cache/Cargo.toml	2026-05-31 18:25:38 +05:30
Ashwin Kumar	bb8155dd27	feat: add Redis for OTP, auth tokens, rate limiting, lead dedup and marketplace cache ... - Add crates/cache with client, otp, rate_limit, token, lead, jobs modules - OTP tokens stored in Redis (15-min TTL, single-use GETDEL on verify) - Refresh tokens stored in Redis (30-day TTL) — removed DB storage - Password reset tokens stored in Redis (1-hour TTL, single-use) - Rate limiting: register (10/hr), login (10/15min), OTP resend (3/hr), lead (5/hr), job post (20/hr) - Lead request deduplication: 24-hour Redis lock per professional+requirement pair - Marketplace listings cached in Redis (5-min TTL per profession+page+limit) - Add ProfessionState{pool, redis} to contracts crate, replacing bare PgPool in all 9 profession apps - All profession handlers and main.rs updated to use ProfessionState - REDIS_URL env var (default: redis://127.0.0.1:6379) used across all services - Fix profession model struct name mangling in 6 handlers (MakeupArtistRepository etc.) - Add custom_data JSONB migration for all 9 profession profile tables - Add onboarding_state model and repository (save_progress, complete, is_complete) - Add onboarding handler accepting roleKey:String (not role_id:UUID) for frontend compat Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-18 22:58:42 +01:00