The captcha on login and all four signup forms was generated and
checked entirely in the browser (answer readable via window global),
so it provided no real bot/brute-force protection. Wire up the new
server-side captcha endpoint instead: fetch a challenge on mount,
submit captcha_id + captcha_answer with login/register, and refresh
the challenge on CAPTCHA_FAILED.
Also bump patchable dependency vulnerabilities via npm audit fix
(all criticals resolved; remainder needs an upstream SolidStart/vinxi
bump not yet available).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The dashboard's Submit for Verification widget checked profile_data for
a documents/documents_data field that GET /api/jobseeker/profile/me never
returns, so the Submit button stayed permanently disabled. Even bypassing
that, it POSTed {document_urls: []}, a field the backend doesn't
recognize, instead of the profile_data shape submit-for-verification
actually expects.
Now fetches the job seeker's real uploaded documents via
GET /api/jobseeker/profile/documents, checks the correct document_type
field, and submits profile_data merged with the uploaded document URLs.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
An entire route/component cluster was built on a legacy sibling of
DashboardShell (DashboardLayout.tsx) and called APIs via the bare
api.get/post/patch/delete helper, which never prefixes /api/ — so
every call 404s against the real ingress (which only routes /api/*
to the backend). Confirmed orphaned: nothing in the live dashboard
shell (DashboardShell.tsx / dashboard.tsx) links to any of it; the
only cross-references are within the cluster itself. Some of it also
targeted the apps/leads backend service removed in the companion
backend commit.
Removed:
- src/routes/dashboard/wallet/ (buy.tsx, payu-return.tsx, invoices/*)
- src/routes/dashboard/requests.tsx
- src/routes/dashboard/leads/accepted/*
- src/routes/dashboard/marketplace/*
- src/components/dashboard/AcceptedLeadsView.tsx
- src/components/DashboardLayout.tsx (only consumer was the above)
- the unused `api` object in src/lib/api.ts (the unprefixed-path
footgun itself — `request()`, which it wrapped, stays; it's used
correctly elsewhere with explicit /api/ paths)
Fixed rather than deleted: src/components/NotificationBell.tsx uses
the same broken convention but IS live (rendered on every dashboard
page via DashboardShell). Switched it to apiFetch with correct
/api/me/notifications/* paths, matching the routes that actually exist
in apps/users/src/handlers/notifications.rs.
`tsc --noEmit` shows no errors under src/ after these changes (pre-
existing node_modules/type-declaration noise unrelated to this change
remains, as it did before).
Replaces raw/truncated UUID labels with the backend's new reference_number
field across verification, application, and lead request views. Verification
status page now renders actual uploaded documents (previously invisible
after submission since the API never returned them).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
All dashboard pages and widgets had one of three bugs:
- const API = "/api" combined with paths already starting /api → double prefix
- const API = '/api/gateway' → nonexistent gateway path prefix
- cleanPath stripping /api off paths when API was set to ""
Fix: set const API = "" uniformly and remove cleanPath rewrite in all 30+
affected files (CompanyJobsPage, CompanyApplicationsPage, CreditsPage,
JobSeekerJobsPage, CustomerRequirementsPage, all widgets, etc.).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AiChatWidget.tsx's local API constant was still "/api/gateway", a path
that only exists via the dev-only vite proxy and has no equivalent in
production (the gateway's resolve_upstream() has no "/api/gateway"
prefix). The usage-summary fetch had been patched to add auth headers
but this constant was left broken, and the two chat-send calls
(/chat/ask, /chat/message - the widget's core send-message path) were
untouched and doubly broken (wrong prefix plus a duplicated "/api").
Every send would 404 in production. Changed API to "/api" and dropped
the duplicated segment from both chat-send calls.
Also corrected a comment in CompanyJobsPage.tsx that incorrectly
described its own local API constant as "/api/gateway" (it's "/api");
no behavior change there, that fetch was already correct.
help-center.ts's uncommitted change (adding an "/api/gateway" prefix to
already-correct direct "/api/kb" calls) was reverted separately since it
introduced the same class of bug rather than fixing anything - it now
matches HEAD with no diff.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
registry_prune.py sorted candidate tags by the manifest GET response's
Date header - which is just "now", the moment the prune script made
that request - not when the image was actually built. Every tag it
queries in the same prune run lands within the same second, so the
"sort by age" was effectively random. On run #56 this deleted the tag
this same CI run had just pushed (4efe848, digest 60114dea) seconds
after pushing it, and seconds before the gitops step committed a
deployment pointing at that now-deleted digest - the cluster then
sat in ImagePullBackOff since the referenced image no longer existed.
Now reads the real "created" timestamp from the image's config blob
(resolving through a manifest list/index if the tag is multi-platform),
and always protects the current run's own SHA from deletion regardless
of sort order, as defense in depth against any remaining timestamp edge
cases.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The K8s ingress for this domain routes any /api/* path directly to the
Rust gateway service — there is no rewrite/proxy layer in production that
collapses /api/gateway/* down to /api/*. That rewrite only exists as a
dev-only vite proxy, so lib/api.ts's request()/apiFetch() (used by Save
Changes, Submit for Verification, document upload, wallet, jobs,
marketplace, portfolio, and more) were 404ing on every call in production
with "Route not found in gateway". ProfilePage.tsx and
VerificationStatusPage.tsx each had their own local apiFetch with the same
assumption, doubly broken (paths already included /api/, prefixed again).
All three now hit the already-fully-qualified /api/... path directly,
matching how the working signup/login calls have always done it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The register() request body sent both profession and role_key with the
same value. The backend's registration DTO aliases role_key onto the same
field as profession, so serde_json rejected the payload outright with a
"duplicate field" deserialization error — professional signup was
returning 422 for every role in production.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Uploaded document URLs lived only in a client-side signal and were never
included in the Save or Submit-for-Verification payloads (the latter sent
a document_urls field the backend silently ignored), so every submitted
verification case ended up with no attached documents for every role
except COMPANY. Now merges doc URLs into profile_data on save/submit and
repopulates them from the saved profile on reload.
Also adds the missing DOC_FIELDS entries for Developer, Video Editor,
Graphic Designer, Social Media Manager, and UGC Content Creator, and makes
the verification-status Documents tab role-aware instead of showing 3
hardcoded generic labels.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
GITOPS_PAT auth was failing against Forgejo. GitHub is the source of
truth for nxtgauge-gitops; push there and let sync-to-forgejo.yml
relay to Forgejo, which Flux actually watches.
Third bug in the same chain: GITEOPS_REPO/GITEOPS_SSH_KEY were
referenced but never actually configured as repo secrets (only
REGISTRY_*, GITOPS_GITHUB_*, and GITOPS_PAT exist) — the digest
extraction fix got the job to actually reach this step, where it then
failed instantly and silently (a bare `test -n` with no echo). Switch
to an HTTPS clone with GITOPS_PAT, matching nxtgauge-backend-rust's
already-working workflow.
The docker gateway fix got the build to actually run and push
successfully, but the digest-extraction grep required a compact
":" with no space, while buildx writes the metadata file
pretty-printed ("containerimage.digest": "sha256:..."), so the match
always failed, aborting the step post-push and skipping the
GitOps-release step entirely. Match nxtgauge-backend-rust's
whitespace-tolerant pattern.
Every build on this branch has been failing with "Cannot connect to
the Docker daemon at tcp://127.0.0.1:2375" — the job container is
nested one level inside the runner pod's dind sidecar, so its own
loopback isn't the sidecar's. nxtgauge-backend-rust already carries
the fix (read the container's default-route gateway from
/proc/net/route); porting the same step here.
- DashboardLayout sidebar: Leads/Credits/Settings/Logout pointed to
routes with no matching file (404). Leads now routes to the real
accepted-leads page; Credits/Settings/Logout reuse the working
/dashboard?nav= deep-link into the main dashboard's tab switcher
(fixes Logout leaving users authenticated on a 404).
- wallet/buy.tsx, wallet/payu-return.tsx: post-purchase, cancel, and
payment-verification redirects targeted non-existent /dashboard/wallet;
now redirect to the existing credits/wallet tab.
- leads/accepted.tsx already contained a detail view gated on
useParams().id, but was only registered as a flat route with no :id
segment, so the detail view was dead code. Split into
leads/accepted/index.tsx + leads/accepted/[id].tsx backed by a shared
AcceptedLeadsView component.
- Added marketplace/[id].tsx: "View Requirement" buttons navigated to
a route that never existed.
This is a test commit to verify:
1. GitHub Actions syncs to Forgejo
2. Forgejo Actions triggers build
3. Runners execute build
4. Image is pushed and deployed
Test timestamp: 2026-07-08T04:28:54+05:30
- Changed all buttons with orange background (#fd6116) and white text
to navy blue background (#050026) with white text
- Maintains 12.5:1 contrast ratio (exceeds WCAG AA 4.5:1 requirement)
- Keeps brand orange (#fd6116) for decorative elements and accents
- Preserves all hover states and transitions
Fixes accessibility violations for chip buttons, nav buttons, auth buttons,
submit buttons, and primary action buttons.
- Change background from dark #07051a to light #F4F2EC
- Update dashboard background to white #ffffff
- Update text color to #0F1729 (dark navy)
- Add light theme CSS variables
- Keep brand orange #fd6116
- Keep original brand orange #fd6116 for buttons
- Use brand navy #050026 as text color on orange background
- Ensures WCAG AA compliance (6.67:1 contrast ratio)
- Maintains brand consistency
- Fix Storybook path alias resolution for ~ imports
- Fix Playwright runtime error by using production build
- Fix accessibility color contrast issues (WCAG AA compliant)
- Fix test route from /jobs to /professionals
- Update chip-btn.active and .btn.primary colors to #a33500
- Remove build-and-deploy-forgejo.yml from GitHub Actions
- Forgejo CI at ci.nxtgauge.com now handles all builds and deployments
- All images pushed to Forgejo registry (ci.nxtgauge.com/ashwin/*)
- Update workflow to push to ci.nxtgauge.com/ashwin/nxtgauge-frontend-solid
- Use FORGEJO_USERNAME and FORGEJO_TOKEN secrets
- Fix gitops repo cloning to use x-access-token
- Add AiCreditsAdmin component for managing AI credits
- View user balance with detailed credit breakdown
- Transaction history (ledger) viewer with pagination
- Manual credit adjustment (ADD/DEDUCT) with audit reasons
- Reconcile tab for generating reports
- Integrate with backend /admin/ai-credits endpoints
Three related bugs made signup pages appear blank/'Not found':
1. /signup/index.tsx redirected to /signup/job-seeker (hyphen) but the
actual file was signup/jobseeker.tsx (no hyphen). Result: every
/signup visit (no intent) 404'd.
2. signup/company.tsx had the same broken link in the 'Register as
Job Seeker instead' link.
3. Landing page CTAs link to /signup?intent=professional&role=DEVELOPER
which the index correctly redirects to /signup/professional - but
/signup/developer, /signup/photographer etc. were 404 because there
were no route files for them. Added signup/[role].tsx catch-all
that maps all professional role slugs (developer, photographer,
tutor, makeup-artist, video-editor, graphic-designer,
social-media-manager, fitness-trainer, catering-services,
ugc-content-creator) to /signup/professional?role=<ROLE>.
Verified via Playwright: all role-specific signup paths now load the
full signup form instead of 'Not found'.
- Update homepage CTAs to point to new signup URLs
- Fix company signup to not validate lastName
- Add customer signup page
- Fix professionals page CTA
- /signup/company - dedicated company registration page
- /signup/job-seeker - dedicated job seeker registration page
- /signup/professional - dedicated professional registration page
- /signup - redirects to appropriate role-specific page
- Removed tabs, each role has its own clean registration flow
Fixes role assignment issues by having dedicated pages per role type.
- Hide role selector tabs when intent is provided via URL
- Show role badge for professional/customer roles
- Add profession field to API call for backend role assignment
- Fixes issue where roles weren't properly assigned after signup
This form (card number/expiry/CVV/name) was never wired to anything -
PayU collects card details on its own hosted page. Now that AI credit
purchases actually open a real PayU checkout instead of faking a
payment_id/signature, this leftover UI was just misleading.
- NotificationsPage: full paginated notification list with unread filter, mark read, load more
- SettingsPage: AI auto-apply section for job seekers (toggle, preferences, skills/titles/locations, salary range)
- CustomerResponsesPage: enriched professional response cards with avatar, bio, skills, location
- CompanyJobsPage: show rejection reason banner and pending-approval notice on job cards
- NotificationBell: fix "View all" link to /dashboard?nav=notifications (deep-link support)
- dashboard.tsx: ?nav= param reads sidebar page on mount; Notifications added to all role sidebars
- PayU integration: payu.ts lib, payu-return route, wallet buy/invoice pages, marketplace route
- Razorpay removed, replaced by PayU across payments flow
- ProfilePage: photo upload UI with avatar preview for all roles
- PortfolioPage: showcase image upload with file picker and preview
- CompanyApplicationsPage: applicant profile snapshot with avatar, headline, skills, resume download
- profile-fields-config: removed resume_doc from job seeker (resume is now AI-generated)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
