514 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Ashwin Kumar Sivakumar	efd2ec6222	fix: wire up dead admin router, IDOR on submit_requirement, dead code cleanup ... apps/payments/src/admin.rs (tax rules, ledger, orders, credits, invoice admin endpoints) was written but never actually shipped: no `mod admin;` in main.rs, no `wallet` crate dependency in Cargo.toml, and its routes used axum 0.6-style `:id` path syntax (this workspace is on 0.8, which requires `{id}` and panics on `:id` at router-build time). Meanwhile apps/gateway explicitly forwards /api/admin/invoices*, /api/admin/tax, /api/admin/orders, /api/admin/ledger, and /api/admin/credits/* to this service, so every one of those admin endpoints has been 404ing in production. Fixed all three issues and merged the router in. Also fixed three inline SQL queries (list_ledger x2, get_credit_ledger) still selecting the nonexistent `type`/`reason` columns this session's earlier wallet-crate fix already corrected everywhere else -- these went unnoticed until now because dynamic SQL isn't checked at compile time, and the file had literally never been compiled before. apps/customers/src/handlers.rs submit_requirement had no ownership check -- every sibling handler on the same resource (get_requirement, update_requirement, mark_requirement_urgent) checks req.created_by_user_id against auth.user_id; this one didn't, so any authenticated customer could submit another customer's DRAFT requirement into the approval queue by id, with the verification case and email misattributed to the caller instead of the actual owner. Removed ProfessionalRepository::try_reserve_tracecoins/ try_debit_reserved_tracecoins/try_release_reserved_tracecoins (crates/db/src/models/professional.rs) -- a dead, unreferenced duplicate of TracecoinWalletRepository's already-correct reserve/debit/release, whose ledger INSERTs used the same nonexistent `type`/`reason` columns and would have errored at runtime if anything had ever called it. A second implementation of the same money-moving logic is itself the risk, so removed rather than fixed in place. Added the missing FK constraints on lead_requests.lead_id and .user_role_profile_id (only professional_user_id/customer_user_id had one) -- app code always populates them correctly today, but nothing DB-side stopped a future bug from writing a dangling reference. Centralized the 18% GST rate (invoice::STANDARD_GST_RATE_PERCENT) instead of the literal 18.0 duplicated at both invoice-generation call sites. Not fixed, flagged instead: the admin reconcile_credits report compares each wallet's all-time balance against a ledger sum restricted to a 30-day-by-default window -- objectively wrong, but the deeper problem is that tracecoin_ledger.amount's sign convention differs between writers (TracecoinWalletRepository stores unsigned magnitudes keyed by transaction_type; crates/wallet stores signed balance deltas directly), so a correct "balance == sum(ledger)" reconciliation needs that inconsistency resolved first -- not a quick fix, a design decision on the write side.	2026-08-18 01:44:10 +05:30
Ashwin Kumar Sivakumar	024fa05e96	feat(marketplace): urgent/featured leads for customers, correct request cap ... New paid feature per product clarification: a customer can pay 50 Tracecoins to mark their own open requirement ("lead", professional- facing) urgent. Urgent leads: - sort first in the professional-facing open-leads feed (new -- there was previously no way for a professional to discover a requirement other than being handed its id directly, so this adds GET /marketplace alongside the existing GET /marketplace/{id}) - get a raised per-lead request cap: 20 instead of the normal 10 (was hardcoded to 20 for everyone -- corrected to the actual intended normal cap while adding the urgent tier) - trigger an immediate best-effort notification to approved professionals in the same profession + location No separate expiry: urgent status rides the existing 7-day expires_at, it doesn't extend anything -- it only changes ordering, cap, and notification while the lead is already live. TracecoinWalletRepository::try_debit_balance is a new one-shot debit primitive (SELECT...FOR UPDATE, idempotent on reference_type + reference_id) for spends that don't need reserve/confirm's two-step hold -- mark_requirement_urgent debits before flagging the lead, so a failed/insufficient-funds debit leaves no state to compensate, and a retry (or two concurrent requests for the same lead) can't double- charge.	2026-08-18 01:34:24 +05:30
Ashwin Kumar Sivakumar	0432ddcb51	fix(wallet): fund-leak on lead rejection, broken expiry refund, dead admin_adjust ... Three independent Tracecoin correctness bugs found auditing the services-marketplace lead flow: 1. reject_request passed lead.user_role_profile_id -- the wrong id -- to try_release_reserved_tracecoins, which looks the wallet up by user_id. It never found a matching wallet, silently returned Ok(false), and the handler returned 409 to the customer -- but lead_requests.status had already committed to REJECTED on the previous statement. Every rejected lead permanently stranded the professional's reserved Tracecoins, with no cron sweeping REJECTED leads to recover them. Now uses professional_user_id, matching approve_request's (correct) debit call. 2. apps/cron/src/tasks/leads.rs's stale-PENDING-lead refund wrote `UPDATE tracecoin_wallets SET current_balance = current_balance + $1` -- that column doesn't exist (it's `balance`), so this errored on every run that hit a reserved-coins expiry, aborting the whole function via `?` before the transaction committed (rolling back the EXPIRED status flip with it). Leads with reserved coins never actually expired or refunded, silently, every 15 minutes. Fixed the column name and made it also decrement `reserved` (previously it only ever credited `balance`, never releasing the hold itself). 3. crates/wallet (credit/reserve/release/confirm/admin_adjust) and its hold/escrow submodule were built against a tracecoin_ledger schema (`type`, `reason`, `balance_after`, `actor_user_id`, `metadata` columns, a `lock_tracecoin_wallet()` SQL function) that was never actually migrated -- the migration that would have added it was disabled (`.up.sql.skip`), and even that skipped file assumed column names that don't match this repo's real, separately-evolved ledger schema (`transaction_type`/`reference_type`). Every call into crates/wallet errored before doing anything. The one live caller is the admin manual wallet-adjustment endpoint (apps/payments/src/ admin.rs), so every admin credit/debit adjustment 500'd. Migration adds the function plus the genuinely-new audit columns (balance_after/actor_user_id/metadata) and an idempotency index, while the code now reads/writes through the existing transaction_ type/reference_type columns instead of introducing a second, competing pair. Also fixes the underlying check-then-act race on lead_requests.status: approve_request/reject_request read status, branched in Rust, then called an unconditional UPDATE with no re-check -- concurrent approve/reject on the same lead could both pass the in-memory check. LeadRequestRepository::update_status_from adds a `WHERE status = $from` guard, used both for the initial PENDING transition and to compensate (revert to PENDING) if the wallet debit/release fails after the status flip already committed. hold::place (the escrow "reserve" half) has zero callers anywhere in the codebase -- flagging separately, not fixed here, since wiring it up or removing it is a product decision, not a bug fix.	2026-08-18 00:51:19 +05:30
Ashwin Kumar Sivakumar	617a75971f	fix(companies): contact-unlock double-spend and job-quota race ... view_contact previously decremented free_contact_views/ purchased_contact_views on every call with no record of which applications had already had their contact unlocked -- refreshing the same application's contact panel silently re-spent the allowance every time, not just under concurrency, and the check-then-act shape also let concurrent requests both pass the exhausted-quota check before either UPDATE committed. Now the whole claim (dedup check + conditional decrement + job_applications.contact_unlocked_at write) runs in one transaction with company_profiles locked FOR UPDATE, gated on a WHERE ... > 0 guard on the decrement itself. create_job had the same shape for the 1-free-job/month rule and purchased_job_slots: two concurrent requests could both observe "quota available" before either committed, letting a company publish 2+ free jobs in a month or drive purchased_job_slots negative. Same fix: lock company_profiles FOR UPDATE for the whole check+mutate+ insert sequence. Also adds CHECK (>= 0) constraints on all four company_profiles counters as defense-in-depth, matching the pattern tracecoin_wallets already uses for balance/reserved.	2026-08-18 00:51:02 +05:30
Ashwin Kumar Sivakumar	cdf78635f6	fix(payments): reconcile PENDING payments that never redirect back from PayU ... /verify only runs if the client's browser makes it back after PayU redirects; a payment that succeeded on PayU's side but whose tab was closed or lost network before redirecting sat at PENDING forever with no server-side path to notice. Adds a poll job (apps/payments/src/reconcile.rs) run every 5 minutes that queries PayU's verify_payment API directly for any payment still PENDING after 15 minutes (giving up after 7 days -- almost certainly an abandoned cart by then, not a missed callback), and finalizes or fails it server-side. Extracts the actual claim-and-credit transaction (SELECT ... FOR UPDATE gated on status = 'PENDING') out of verify_payment into reconcile::finalize_successful_payment, shared by both callers so there's exactly one implementation of the double-credit-proof claim to reason about; it's what makes it safe for the poll job to independently race /verify on the same txnid. Also unifies invoice/notification side-effects into finish_successful_payment_side_effects, drawing billing contact from `users` rather than the client-supplied /verify payload (the poll path has no such payload, and it's the more correct source of truth for the GST invoice either way).	2026-08-17 23:51:01 +05:30
Ashwin Kumar Sivakumar	f6a23cb99a	fix(db): add missing job_applications unique(job_id, applicant_user_id) ... apply_to_job does check-then-insert with no transaction/lock to block duplicate applications - race-condition-prone. The INSERT error handler already anticipated a unique-violation ('unique' in error string -> 409 ALREADY_APPLIED) but the constraint itself was never created, so that branch was dead code. Adding it now gives the existing handling a real backstop. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-17 20:42:53 +05:30
Ashwin Kumar Sivakumar	4ee593f407	fix(db): pricing_packages.price_inr was seeded as rupees, treated as paise ... 58 of 59 rows were inserted with plain rupee-looking values (499, 999, 1999, ...) but every consumer (apps/payments/src/main.rs) treats price_inr as paise, so PayU would have charged 1/100th of the intended price. Confirmed zero rows in payments/orders — pre-launch data fix, not a refund situation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-17 19:23:56 +05:30
Ashwin Kumar Sivakumar	c486f60775	chore: retrigger CI after Forgejo restart ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-17 19:18:49 +05:30
Ashwin Kumar Sivakumar	4beb380aca	chore: trigger CI rebuild after clearing Forgejo disk pressure ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-17 19:16:08 +05:30
Ashwin Kumar Sivakumar	e8f4262804	fix(db): drop untracked invoices_payment_id_check trigger before 050000 recreates it ... Prod has this trigger from an out-of-band creation that was never recorded in _sqlx_migrations, so migration 20260814050000 failed with 'trigger already exists' and stopped the whole migrate run partway through. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-17 18:37:08 +05:30
Tracewebstudio Dev	92072f04bd	fix: testing session bugs (BUG-54 through BUG-56) and API improvements ... - BUG-55: Fix coupon min_order_amount display dividing rupees by 100 (users/handlers/coupons.rs - remove /100 from error message format) - BUG-56: Fix admin applications endpoint 500 - add reference_number to SELECT in list_applications query (companies/handlers/admin.rs) - BUG-54: KB category requires explicit slug field (documented; by-design) - Various API handler improvements discovered during end-to-end testing: auth, profile, support, reviews, kb, pricing, modules, activity_logs, admin, ai_phase4, config handlers in users service - Job seekers and customers service handler fixes - Gateway and jobs service improvements - DB model field additions for professional role types Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-17 14:57:50 +02:00
Ashwin Kumar Sivakumar	4f1f4f733d	chore: rebuild all — force build all services ... Registry retention (keep-last-3, every 10min) pruned the SHA-tagged images that several nxtgauge-gitops image-automation commits had already bumped deployments to, before those images were ever successfully pulled by the cluster. Result: 14 services stuck in ImagePullBackOff on 'manifest unknown' (catering-services, companies, cron, developers, employees, fitness-trainers, gateway, graphic-designers, job-seekers, jobs, makeup-artists, social-media-managers, tutors, ugc-content-creators) - old replicas kept serving traffic so nothing was actually down, but rollouts were stuck. This empty commit forces build.yaml to rebuild+push every service in one batch so gitops automation bumps them all to freshly-pushed, currently-retained digests together.	2026-08-15 22:39:45 +05:30
Ashwin Kumar Sivakumar	8f0505c36c	chore(compose): pin service images to build SHA, add MOCK_STORAGE, drop exposed db/redis ports ... - close direct host exposure of postgres:5432 and redis:6379 in dev compose - pin all service images to a specific build SHA instead of floating :high-performance-latest - enable MOCK_STORAGE for local dev across services	2026-08-15 22:32:06 +05:30
Ashwin Kumar Sivakumar	f9718f85d0	ci: build and push nxtgauge-db-migrate image on every push ... The migrate image (Dockerfile.migrate) was never part of the CI build matrix - it's a separate crate, not an apps/* service, and the running K8s Job pulls a static <branch>-latest tag rather than a pinned digest. Without this, a stale image silently no-ops new migrations: the Job reports success but applies nothing, which is exactly what happened with the ai_guard_violations migration on 2026-08-15.	2026-08-15 20:20:26 +05:30
Ashwin Kumar Sivakumar	605f3bdaaa	Move ai_guard_violations migration to migrations/ dir picked up by db-migrate ... migrations_new/ is not read by db-migrate (it only honors MIGRATIONS_DIR, which defaults to /migrations, i.e. crates/db/migrations). The file was misplaced and would never have run.	2026-08-15 20:15:05 +05:30
Tracewebstudio Dev	d9b3bb4d94	feat(ai-guard): add semantic moderation layer + guard violations DB logging ... - Add llm_moderation_check() — async call to LiteLLM /moderations endpoint (routes to OpenAI Moderation API, free) for hate/sexual/violence detection. Fails open: if LiteLLM is unreachable, message is allowed through with a warning log so core chat is never broken by a network hiccup. - Add spawn_guard_log() — fire-and-forget tokio task that persists every guard rejection (keyword AND moderation) to ai_guard_violations table. - Wire both guards into ai_chat_message, ai_chat_ask, and ai_chat_stream. - Add migration: ai_guard_violations(id, user_id, message_excerpt, guard_type, reason, categories JSONB, created_at). - Add GET /api/admin/ai/guard-events with filter by guard_type, pagination. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-15 14:20:44 +02:00
Tracewebstudio Dev	4da502ded8	feat(voice): implement Whisper STT via LiteLLM audio/transcriptions ... Replaces the Ollama stub (always 501) with a real call to LiteLLM's OpenAI-compatible audio/transcriptions endpoint: POST {LITELLM_BASE_URL}/audio/transcriptions Authorization: Bearer {LITELLM_API_KEY} multipart: model=whisper-1, file=<audio.webm> - LITELLM_WHISPER_MODEL env var selects the model (default: whisper-1) - Reuses the existing LITELLM_BASE_URL / LITELLM_API_KEY vars - Empty audio body returns 400 (not 501) with a helpful message - LiteLLM error returns 502 with the upstream detail logged - Network error returns 503 with a clear message Response shape unchanged (TranscribeResponse with transcript, language, confidence, duration_ms, stub=false). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-15 14:08:00 +02:00
Tracewebstudio Dev	b039ed7342	feat(kb): POST /api/admin/kb/articles/ai-draft endpoint ... Generates a full KB article (content + summary) via LiteLLM given a title, optional category name, and optional topic hints. - Prompt instructs the LLM to produce markdown-formatted body (300-500 words) followed by ===SUMMARY=== delimiter and a ≤200-char summary - Falls back gracefully if LLM omits the delimiter: derives summary from the first non-heading sentence - Charges kb_article_draft feature credits against the admin's account - Route is /api/admin/kb/articles/ai-draft (POST) — must be registered BEFORE /api/admin/kb/articles/{id} so the literal segment wins Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-15 14:03:45 +02:00
Tracewebstudio Dev	ad4ab0477a	feat(ai): cover letter inline generation + draft_content field on AskAshResponse ... AskAshResponse now carries draft_content: Option<String> — a clean raw generated text separate from the prose wrapper in message. Used by: - profile_draft: the improved summary text (for Save to Profile) - cover_letter_draft: the letter body (for clipboard copy) When Intent::CoverLetter is detected in ask_ash: - Fetches job_seeker_profiles (full_name, summary, experience, skills) - Calls LLM with cover_letter_generate feature key (charges credits) - Returns action_type: 'cover_letter_draft', suggested_action: 'open_cover_letter' - draft_content holds the raw letter body; message wraps it in --- delimiters - If no profile found: returns navigation response to open_cover_letter - LLM failure falls through to generic path Profile draft updated to populate draft_content: Some(improved) so the frontend no longer needs regex parsing to extract the clean text. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-15 13:16:20 +02:00
Tracewebstudio Dev	cd7e5bdc05	feat(ai): profile improvement draft + save_profile confirm action ... When a job seeker asks Ask Ash to improve their resume/profile/summary: - Fetches current job_seeker_profiles.summary from DB - Calls LLM (via orchestrator, charges profile_improve feature credits) - Returns action_type: 'profile_draft' with the improved text - If no summary exists yet, returns a navigation response to profile page ai_chat_confirm now handles action='save_profile': - Takes draft_text from fields - UPDATEs job_seeker_profiles.summary for the authenticated user - Returns 404 if no profile row found (not yet onboarded) - Returns helpful error messages on failure Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-14 18:43:24 +02:00
Tracewebstudio Dev	38981ffe70	feat(ai): add action_type to AskAshResponse + POST /api/ai/chat/confirm ... AskAshResponse gains action_type: Option<String> so the frontend knows what kind of UI to render for each response: ticket_created — ticket was auto-created inline ticket_pending — user wants a ticket but none was created (show confirm button) kb_results — KB articles found usage_info — usage/credits summary navigation — navigate to the relevant feature page POST /api/ai/chat/confirm (new): executes AI-suggested actions the user confirms in the chat widget. action = 'create_ticket' creates a support ticket from the conversation text and returns the ticket id + subject. Additional actions (profile save, contact request) can be added here. Wired into ai_router() at /chat/confirm. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-14 18:06:33 +02:00
Ashwin Kumar Sivakumar	cc2dab112b	fix(db): 4 fresh-bootstrap migration chain bugs found + verified today ... Reconciling the local dev DB (63 migrations behind) surfaced 4 genuine bugs in the migration chain itself -- not just this DB's legacy scripts/init-db.sql seeding -- confirmed by replaying the full chain against a brand new, completely empty database from scratch: - 20260318235959: customer_profiles.status is UPDATEd by 20260319090000's backfill 4 months before it's ever ADDed (20260721020000). Adds it early (IF NOT EXISTS). - 20260401235959: 20260317190000 creates the old users-linked `employees` shape; 20260402030000's CREATE TABLE IF NOT EXISTS no-ops against it and fails creating an index on a column that was never added. Conditionally drops the old shape first (only if it's still pre-transition -- gated on the missing `email` column), restoring 20260402030000's own documented original intent. - 20260419235959: the schema `20260420000003_external_role_modules` needs (persona_types, modules, role_module_access, ...) was only ever defined in a disabled .up.sql.skip (its version slot was taken by ...seed.sql); the seed data that depends on it was never skipped. Creates that schema early -- verbatim content, purely additive. - 20260421235959: same disabled-migration pattern for the role_permissions -> role_admin_permissions / dashboard_configs -> role_sidebar_configs / runtime_configs -> role_runtime_configs / user_roles -> user_role_assignments renames that 20260422000000's widget seed needs. Conditionally renames each pair (only if old name exists and new name doesn't), verified against live Rust code that already queries the new names exclusively. payments/invoices were NOT chain bugs -- confirmed clean on the fresh bootstrap test -- so no fix needed for those; they only conflicted on this one DB because of its scripts/init-db.sql legacy seed, which is already a documented, known gap. Verified twice: applied cleanly as no-ops against the now-fully-migrated local dev DB, and applied successfully end-to-end (0 manual steps) against a brand new empty database created from scratch. Runbook updated with the full pending-migration list and today's findings. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-14 18:30:42 +05:30
Ashwin Kumar Sivakumar	c394d9fc07	feat(ai-credits): real coupon validation endpoint; restore invoice FK integrity ... - Add POST /api/ai-credits/coupons/validate: a dry-run of the same validate_coupon() check create_order applies, so the checkout UI can show a real discount/error before Pay instead of only finding out at order-creation time. Never inserts anything. - Add migration 20260814050000: restores integrity on invoices.payment_id after 20260814030000 dropped the hard FK to support polymorphic invoice_type (TRACECOIN_PURCHASE -> payments, AI_CREDIT_PURCHASE -> ai_credit_orders). A BEFORE INSERT/UPDATE trigger now validates payment_id against the right table per invoice_type instead of leaving it fully unchecked. Verified against a live Postgres in a scratch schema (valid/invalid payment_id, valid/bogus invoice_type). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-14 15:26:47 +05:30
Tracewebstudio Dev	4e0e6af3e1	fix(payments): compare global coupon redemptions against max_redemptions not max_redemptions_per_user ... validate_coupon was checking: total_redemptions (= redemptions_used, global count) >= max_per_user (per-user limit) which means a coupon with max_redemptions=1000 and max_redemptions_per_user=1 would be marked exhausted after the first person ever used it. Fix: also SELECT max_redemptions and compare global count against it. The per-user check on line 192 (user_redemptions >= max_per_user) was already correct and is unchanged. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-14 11:19:00 +02:00
Ashwin Kumar Sivakumar	86e1fd47d2	feat(waitlist): admin listing endpoint (GET /api/admin/waitlist) ... Paginated, admin-only list of waitlist_signups (email + created_at, newest first) for the upcoming admin-solid waitlist page. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-14 04:05:17 +05:30
Ashwin Kumar Sivakumar	77c8330b11	feat(waitlist): POST /api/waitlist for the nxtgauge.com coming-soon form ... The coming-soon page's 'Notify Me' form (nxtgauge-gitops/coming-soon/ index.html) only console.logged the email - nothing was actually captured. Adds a public (no auth, same trust model as a newsletter signup) endpoint on the users service: - New waitlist_signups table (email unique, created_at) - no user_id/ FK since these are anonymous pre-launch signups, not necessarily existing accounts. - apps/users/src/handlers/waitlist.rs: POST / -> INSERT ... ON CONFLICT DO NOTHING (repeat signups from the same email are a no-op, not an error), loose email validation (has @ and a dotted domain - this is a marketing signup, not an account, so overly strict validation just loses real signups to minor typos). - Routed /api/waitlist through the gateway to the users service, alongside the other public routes (packages, kb, etc.) Applied migration to nxtgauge_test and prod. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-14 03:46:28 +05:30
Ashwin Kumar Sivakumar	c2fb7d61f7	feat(invoices): generate GST invoices for AI credit purchases ... AI credit purchases (money -> credits via PayU) never generated an invoice, even though the exact same infrastructure already works for TraceCoin purchases in main.rs's generate_purchase_invoice. Spending credits (try_reserve_credits/capture) correctly does NOT get an invoice - only real-money purchases do, matching existing TraceCoin behavior. - invoices.payment_id had a hard FK to payments(id) only, which blocks using it for ai_credit_orders(id) rows. Postgres has no polymorphic FK; dropped the constraint (invoice_type already says which table payment_id points into) via a new migration rather than editing the original invoices migration. - Added generate_ai_credit_invoice in ai_credits.rs, called from verify_order after a successful PayU payment - mirrors main.rs's pattern exactly (same non-blocking failure handling, same seller details via the now pub(crate) seller_details(), invoice_type 'AI_CREDIT_PURCHASE'). - Caught a real bug while writing this: order.amount_inr is the POST-discount final price, but NewInvoice.discount_amount is subtracted again inside compute_totals (subtotal - discount) - using amount_inr directly as unit_price_paise would have double-subtracted the discount. Reconstructed the pre-discount price (amount_inr + discount_applied) for the line item instead. Applied the FK-drop migration to nxtgauge_test and prod; verified the constraint is gone and user_id's FK is untouched. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-14 03:17:17 +05:30
Tracewebstudio Dev	65262e842c	fix(db): add missing ai_credit_orders columns + ai_coupons tables ... 20260814000000: add coupon_code + discount_applied to ai_credit_orders CREATE TABLE — create_order inserts both columns but the original migration omitted them. 20260814020000 (new): create ai_coupons + ai_coupon_redemptions, the tables referenced by create_order/verify_order in ai_credits.rs. Extracted from the skipped 20260706300000 migration which couldn't be enabled because it referenced ai_credit_orders before that table existed. Runbook updated with the 3 pending prod migrations and redeploy step. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-13 23:10:40 +02:00
Ashwin Kumar Sivakumar	41b17baa14	feat(ai-credits): role-scoped purchasable credit packages ... Adds applicable_roles TEXT[] to ai_credit_packages (empty = visible to every role, matching today's behavior for the 4 existing packages - nothing changes for them until an admin opts them into specific roles). Mirrors pricing_packages' existing role_key convention, as an array since one AI package can reasonably apply to several roles at once. - GET /api/ai-credits (list_packages) now accepts optional auth (via a local MaybeAuthUser wrapper, since AuthUser doesn't implement axum's optional-extraction trait) and filters out packages not applicable to the viewer's roles. Anonymous viewers only see role-unrestricted packages. - POST /api/ai-credits/order (create_order) re-validates role eligibility server-side too, not just in the listing - closes off a logged-in user buying a package never shown to them. - Admin CRUD (GET/POST /api/admin/ai-credits/packages, PATCH .../{id}) now reads/writes applicable_roles. Applied to nxtgauge_test and prod; verified column + index created, existing 4 packages default to empty (all roles). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-14 01:46:03 +05:30
Ashwin Kumar Sivakumar	57146b2e19	Merge remote-tracking branch 'origin/high-performance' into high-performance	2026-08-14 01:39:43 +05:30
Ashwin Kumar Sivakumar	8e4d64d33b	fix(db): correct ai_credit_packages pricing (paise not rupees), add missing ai_credit_orders table ... Discovered while wiring up role-scoped AI credit packages: the active seed migration (20260615060600) stored price_inr as 99/349/999/2499 - values that read like whole rupees, but every consumer (PayU's paise_to_rupee_string, matching pricing_packages' existing paise convention) treats price_inr as paise, meaning a real purchase would have charged ~1% of the intended price. The actual fix already existed as 20260705110000_ai_credit_packages .up.sql.skip (correct paise values + the ai_credit_orders table create_order inserts into) but got disabled in the same bulk skip pass as everything else this session has been un-tangling - its CREATE TABLE ai_credit_packages (no IF NOT EXISTS) hit 'relation already exists' since 20260615060600 had already created it, aborting before ai_credit_orders was ever created. Net effect before this fix: buying AI credits was completely broken (create_order would 500 - no ai_credit_orders table to insert into). Confirmed zero rows anywhere in ai_credit_orders (the table simply didn't exist) - nothing to reconcile, this is a pre-launch fix. New migration (not resurrecting the old .skip file, to keep a clean linear history matching this session's other fixes): UPDATE the 4 known-wrong rows by name to their correct paise values, CREATE TABLE IF NOT EXISTS ai_credit_orders. Applied to both nxtgauge_test and prod; verified. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-14 01:38:59 +05:30
Tracewebstudio Dev	0e2bbd34eb	docs: mark DB migrations as completed in runbook ... All four DB tasks confirmed applied to production (2026-08-13): - wallet_full migration re-enabled - ai_credits_wallet migration rewritten as idempotent and applied - TIMESTAMP → TIMESTAMPTZ fix for 9 AI table columns - nxtgauge_test DB + Forgejo CI secret wired Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-13 21:32:48 +02:00
Ashwin Kumar Sivakumar	eefc0457be	fix(test): use a fresh random user per ai_credits_reaper.rs run ... The fixed UUID (33333333-...) meant every re-run against the same persistent test database reused the same wallet - any earlier partial run that panicked before its own capture/release step left reserved_credits permanently stuck above zero, so this run's fresh reserve (expected to bring it to exactly 4) actually reads 8, 12, etc. depending on how many times the suite had previously failed midway. Matches ai_credits.rs's make_user() pattern (Uuid::new_v4()) instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-13 22:09:33 +05:30
Ashwin Kumar Sivakumar	85690b3002	fix(test): make ai_credits_reaper.rs resilient to accumulated stale holds ... The sweep query is intentionally global (matches the real cron reaper), but against a persistent, never-reset test database re-run many times over a debugging session, other tests' un-captured/ un-released reservations eventually go stale and get picked up alongside this test's own hold, breaking the exact-match assertion (observed: 6 expired holds instead of 1). Clear pre-existing stale 'held' rows first, matching the clean slate a continuously-running production reaper would actually maintain. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-13 22:01:24 +05:30
Ashwin Kumar Sivakumar	b48a1dd204	fix(test): self-provision the fixture user in ai_credits_reaper.rs ... expired_hold_is_swept_and_credits_return_to_available used a hardcoded UUID assuming a matching users row already existed in whatever database it ran against, but user_ai_subscriptions.user_id has a FK to users(id) - against a fresh database (like CI's nxtgauge_test) this failed with a foreign key violation before the actual sweep/release logic under test ever ran. Provision it inline instead, matching ai_credits.rs's make_user() pattern. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-13 21:52:54 +05:30
Ashwin Kumar Sivakumar	1af10420ce	fix(db): convert ai_credits timestamp columns to TIMESTAMPTZ ... 9 columns across ai_plans/user_ai_subscriptions/ai_feature_costs/ ai_usage_logs were TIMESTAMP (no timezone), left over from whatever pre-20260703210000 mechanism originally created these 4 tables, but crates/db/src/models/ai_credits.rs maps all of them to DateTime<Utc>, which sqlx requires TIMESTAMPTZ for. This is a live bug, not just a test-setup gap - discovered via crates/db/tests/ai_credits.rs failing with ColumnDecode errors, but any production code path selecting these columns (e.g. current_period_start/end on every wallet read) would hit the same failure. ALTER COLUMN ... USING col AT TIME ZONE 'UTC' is lossless here since every write path uses NOW()/DEFAULT NOW() with no other timezone handling anywhere in the codebase. Applied to both nxtgauge_test and the live nxtgauge database directly; verified all 9 columns converted and the 3 existing user_ai_subscriptions + 4 ai_plans rows' values are intact and correctly interpreted as UTC afterward. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-13 21:44:30 +05:30
Ashwin Kumar Sivakumar	675a5a12c5	chore: trigger ai-credits CI re-run with seeded test data	2026-08-13 20:24:00 +05:30
Ashwin Kumar Sivakumar	9605636c7f	chore: re-trigger ai-credits CI now that nxtgauge_test has the free plan seeded ... pg_dump --schema-only (used to create nxtgauge_test) only copies structure, not data - the 'free' plan row that 20260703210000's own INSERT seeds only existed in prod. Applied that migration to nxtgauge_test directly to seed it there too.	2026-08-13 20:23:50 +05:30
Ashwin Kumar Sivakumar	1106b0cb8c	fix: remove invalid trailing line from Dockerfile.test ... My own previous trivial-touch commit appended a bare '-- ...' line without a # prefix, which isn't valid Dockerfile syntax and broke the buildx parse ('unknown instruction: --') - explains why the last CI run died immediately again despite the actual fix (corrected password) being in place.	2026-08-13 20:19:59 +05:30
Ashwin Kumar Sivakumar	f2ee346a37	chore: trivial touch to Dockerfile.test to trigger a real ai-credits CI run	2026-08-13 20:16:26 +05:30
Ashwin Kumar Sivakumar	786ad41bd8	chore: re-trigger ai-credits CI with corrected TEST_DATABASE_URL password ... Discovered POSTGRES_PASSWORD env var on the postgres pod itself is stale/unused for network auth - pg_hba.conf only trusts it for local socket connections (no password check at all there). The real scram-sha-256 password the live app pods actually use over the network lives in the nxtgauge-backend-rust-secrets K8s secret's DATABASE_URL key. Used that instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-13 20:14:04 +05:30
Ashwin Kumar Sivakumar	c307ef1ba4	fix(ci): run ai_credits tests via buildx build, not runtime apt-get/docker run -v ... The bare bookworm runner image has no apt-get/package manager at all (the earlier build-essential install attempt failed with 'apt-get: command not found'), and a plain 'docker run -v $PWD:/workspace' wouldn't work either - DOCKER_HOST points at the sibling dind engine (same nested-container setup build.yaml's own comments describe), so a bind mount would look for the path on the wrong filesystem. Matches build.yaml's actual working pattern instead: docker buildx build with context transfer (not a volume mount), using a Dockerfile (Dockerfile.test) whose RUN step runs the test suite and fails the build on a non-zero exit. TEST_DATABASE_URL passed via buildx --secret (not --build-arg) so it never lands in image layer history. Isolated this by testing each piece of the original workflow independently (env/secrets, id+GITHUB_OUTPUT, if: conditionals all checked out fine one at a time) until apt-get was confirmed as the actual failure point. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-13 18:08:31 +05:30
Ashwin Kumar Sivakumar	a0a4259d50	debug: test apt-get network access in isolation	2026-08-13 18:04:31 +05:30
Ashwin Kumar Sivakumar	24e85db097	debug: add back a conditional step to isolate the failure further	2026-08-13 18:01:39 +05:30
Ashwin Kumar Sivakumar	c0a961c8ef	debug: add back the check step to isolate the failure further	2026-08-13 17:59:04 +05:30
Ashwin Kumar Sivakumar	22cbd3e285	debug: add back job-level env secret reference to isolate the failure	2026-08-13 17:55:30 +05:30
Ashwin Kumar Sivakumar	e80c58641f	debug: strip test.yaml to bare minimum to isolate why the job dies mid-run	2026-08-13 17:53:14 +05:30
Ashwin Kumar Sivakumar	3740bb81c5	fix(ci): fetch full git history in ai-credits job for diff-based change detection ... Previous job died silently right after checkout with no logs at all from the 'Check for relevant changes' step onward - shallow clone (default fetch-depth:1, unlike build.yaml which sets fetch-depth:0) may have been the cause. Matching build.yaml's checkout config. Also re-set TEST_DATABASE_URL with a properly percent-encoded password (the raw '@' in it made the postgresql:// URI ambiguous to parse). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-13 17:48:43 +05:30
Ashwin Kumar Sivakumar	8893eaa230	chore: re-trigger ai-credits CI job (previous run died mid-checkout, likely runner contention) ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-13 17:45:19 +05:30
Ashwin Kumar Sivakumar	3b4a4eac3f	fix(ci): install build-essential before cargo test in ai-credits job ... The bare bookworm runner image has no C toolchain at all, unlike build.yaml's jobs which build inside a Dockerfile-based image with one already present. proc-macro2/libc/etc build scripts need `cc` to link and failed immediately (error: linker `cc` not found) before any real test code ran. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-13 17:39:12 +05:30