5 commits

Author	SHA1	Message	Date
Ashwin Kumar Sivakumar	da9be7f6a3	feat(db,ci): fix missing ai_credits tables, wire integration tests to CI ... Re-enables and corrects 20260703210000_ai_credits_wallet, which had been disabled (.up.sql.skip) in commit 0163349 because 'relation already exists' aborted the original CREATE TABLE script on its very first table (ai_plans) - silently leaving ai_credit_ledger and ai_reservation_holds never created, despite the wallet system being actively wired into apps/users/handlers/ai_credits.rs, apps/payments, apps/cron with real subscription rows already in prod. Rewrote the migration to be idempotent: ADD COLUMN IF NOT EXISTS to bring ai_plans/user_ai_subscriptions/ai_feature_costs/ai_usage_logs up to the full column set crates/db/src/models/ai_credits.rs expects (safe zero/default backfills, no data loss - verified against the 3 existing subscription rows), and CREATE TABLE IF NOT EXISTS for the 2 genuinely-missing tables. down.sql updated to only reverse what this corrected version actually adds, not drop tables that predate it. Applied directly to the live database (verified schema + existing rows intact afterward). Also wires crates/db/tests/ai_credits.rs + ai_credits_reaper.rs to Forgejo Actions CI (docs/LIVE_SERVER_RUNBOOK.md step 6): - New TEST_DATABASE_URL repo secret, pointing at a dedicated nxtgauge_test database (created fresh, schema mirrored from live prod via pg_dump --schema-only - never runs against the real nxtgauge DB). - .forgejo/workflows/test.yaml: runs on push to main/high-performance, skips when crates/db/ isn't touched, cargo test -p db --test ai_credits --test ai_credits_reaper -- --test-threads=1. Also commits docs/openapi.wallet-holds.json (hand-written minimal OpenAPI spec used for schemathesis fuzzing in step 4) and gitignores the local .schemathesis/ cache directory from that run. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-13 17:31:22 +05:30
Tracewebstudio Dev	7b4a23cee6	chore: gitignore *.pid runtime files ... PID files are created by running services locally and should never be tracked in version control. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-08-12 18:25:40 +02:00
Ashwin Kumar Sivakumar	fdd5c7a418	Fix security audit findings: admin authz, captcha, secret leak, CORS ... - Require admin role on role/module/permission management endpoints that previously accepted any authenticated user (privilege escalation) - Add server-side captcha generation/verification (Redis-backed, single-use, 5 min TTL) enforced on register/login for users and employees services - Untrack .env.test111 (contained a live SMTP key) and harden .gitignore against future .env commits - Stop logging OTP codes in plaintext - Restrict jobs service CORS to an explicit origin allowlist - Mask PayU merchant secret/salt in payment-gateway-config responses, preserving the stored value on save when the field is left unchanged - Bump vulnerable transitive dependencies (quinn-proto, rustls-webpki, anyhow) via cargo update; switch aws-sdk-s3 off the legacy rustls feature Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-23 17:31:48 +05:30
Ashwin Kumar	e16d28a405	fix: track Cargo.lock (required for reproducible Docker builds)	2026-04-09 02:09:11 +02:00
Ashwin Kumar	bb8155dd27	feat: add Redis for OTP, auth tokens, rate limiting, lead dedup and marketplace cache ... - Add crates/cache with client, otp, rate_limit, token, lead, jobs modules - OTP tokens stored in Redis (15-min TTL, single-use GETDEL on verify) - Refresh tokens stored in Redis (30-day TTL) — removed DB storage - Password reset tokens stored in Redis (1-hour TTL, single-use) - Rate limiting: register (10/hr), login (10/15min), OTP resend (3/hr), lead (5/hr), job post (20/hr) - Lead request deduplication: 24-hour Redis lock per professional+requirement pair - Marketplace listings cached in Redis (5-min TTL per profession+page+limit) - Add ProfessionState{pool, redis} to contracts crate, replacing bare PgPool in all 9 profession apps - All profession handlers and main.rs updated to use ProfessionState - REDIS_URL env var (default: redis://127.0.0.1:6379) used across all services - Fix profession model struct name mangling in 6 handlers (MakeupArtistRepository etc.) - Add custom_data JSONB migration for all 9 profession profile tables - Add onboarding_state model and repository (save_progress, complete, is_complete) - Add onboarding handler accepting roleKey:String (not role_id:UUID) for frontend compat Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-18 22:58:42 +01:00