Spaces:

AndreaNotes1
/

auth-app-api

Sleeping

@@ -1,33 +1,33 @@
-FROM node:20-slim
-WORKDIR /app
-# Install dependencies in their own layer so this only re-runs when
-# package*.json actually changes, speeding up rebuilds. Using `npm
-# install` rather than `npm ci` since this repo doesn't ship a
-# package-lock.json — if you generate one locally (recommended:
-# `npm install` once, then commit package-lock.json), switch this to
-# `npm ci --omit=dev` for fully reproducible, faster builds.
-COPY package*.json ./
-RUN npm install --omit=dev
-# Copy the rest of the application source
-COPY . .
-# Hugging Face Spaces (Docker SDK) route external traffic to whatever
-# port is declared as "app_port" in the Space's README.md metadata —
-# 7860 is Hugging Face's own default, so we match it here. If you set a
-# different app_port in your Space's README, update PORT to match.
-ENV NODE_ENV=production
-ENV PORT=7860
-EXPOSE 7860
-# Run as the non-root "node" user (built into the official Node image)
-# rather than root, as one more layer of defense-in-depth.
-RUN chown -R node:node /app
-USER node
-HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD node -e "require('http').get('http://localhost:7860/api/health', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"
-CMD ["node", "src/server.js"]

+FROM node:20-slim
+WORKDIR /app
+# Install dependencies in their own layer so this only re-runs when
+# package*.json actually changes, speeding up rebuilds. Using `npm
+# install` rather than `npm ci` since this repo doesn't ship a
+# package-lock.json — if you generate one locally (recommended:
+# `npm install` once, then commit package-lock.json), switch this to
+# `npm ci --omit=dev` for fully reproducible, faster builds.
+COPY package*.json ./
+RUN npm install --omit=dev
+# Copy the rest of the application source
+COPY . .
+# Hugging Face Spaces (Docker SDK) route external traffic to whatever
+# port is declared as "app_port" in the Space's README.md metadata —
+# 7860 is Hugging Face's own default, so we match it here. If you set a
+# different app_port in your Space's README, update PORT to match.
+ENV NODE_ENV=production
+ENV PORT=7860
+EXPOSE 7860
+# Run as the non-root "node" user (built into the official Node image)
+# rather than root, as one more layer of defense-in-depth.
+RUN chown -R node:node /app
+USER node
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD node -e "require('http').get('http://localhost:7860/api/health', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"
+CMD ["node", "src/server.js"]

app.js CHANGED Viewed

@@ -1,91 +1,91 @@
-const express = require("express");
-const helmet = require("helmet");
-const cors = require("cors");
-const cookieParser = require("cookie-parser");
-const compression = require("compression");
-const morgan = require("morgan");
-const mongoSanitize = require("express-mongo-sanitize");
-const hpp = require("hpp");
-const { env } = require("./config/env");
-const { apiLimiter } = require("./middleware/rateLimiters");
-const { errorHandler, notFound } = require("./middleware/errorHandler");
-const logger = require("./utils/logger");
-const authRoutes = require("./routes/auth.routes");
-const courseRoutes = require("./routes/course.routes");
-const orderRoutes = require("./routes/order.routes");
-const adminRoutes = require("./routes/admin.routes");
-const app = express();
-// Trust the first proxy hop (Render/Heroku/Nginx/etc.) so req.ip and the
-// "secure" cookie/HSTS logic reflect the real client over HTTPS.
-app.set("trust proxy", 1);
-// --- Security headers -------------------------------------------------
-app.use(
-  helmet({
-    contentSecurityPolicy: {
-      directives: {
-        defaultSrc: ["'self'"],
-        scriptSrc: ["'self'"],
-        styleSrc: ["'self'", "'unsafe-inline'"],
-        imgSrc: ["'self'", "data:", "https:"],
-        objectSrc: ["'none'"],
-        frameAncestors: ["'none'"],
-      },
-    },
-    crossOriginResourcePolicy: { policy: "same-site" },
-    hsts: { maxAge: 63072000, includeSubDomains: true, preload: true },
-  })
-);
-// --- CORS: only the configured frontend origins may call the API, and
-// credentials (refresh-token cookie) are only sent to those origins. ---
-app.use(
-  cors({
-    origin(origin, callback) {
-      if (!origin || env.clientOrigins.includes(origin)) return callback(null, true);
-      // Logged (not just thrown) so a mismatched frontend domain shows up
-      // immediately in the server logs with the exact rejected value —
-      // compare this directly against the CORS allow-list logged at
-      // startup to spot typos, protocol mismatches, or a missing entry.
-      logger.warn(`CORS rejected origin: "${origin}" (allow-list: ${JSON.stringify(env.clientOrigins)})`);
-      return callback(new Error("Not allowed by CORS"));
-    },
-    credentials: true,
-  })
-);
-app.use(compression());
-app.use(express.json({ limit: "100kb" })); // small limit: this API never needs large bodies
-app.use(express.urlencoded({ extended: true, limit: "100kb" }));
-app.use(cookieParser(env.cookieSecret));
-// Strip any keys starting with "$" or containing "." from user input to
-// block MongoDB operator-injection attacks.
-app.use(mongoSanitize());
-// Prevent HTTP parameter-pollution (e.g. ?role=user&role=admin).
-app.use(hpp());
-app.use(
-  morgan("combined", {
-    stream: { write: (message) => logger.info(message.trim()) },
-    skip: () => env.nodeEnv === "test",
-  })
-);
-app.use("/api/", apiLimiter);
-app.get("/api/health", (req, res) => res.json({ status: "ok", time: new Date().toISOString() }));
-app.use("/api/auth", authRoutes);
-app.use("/api/courses", courseRoutes);
-app.use("/api/orders", orderRoutes);
-app.use("/api/admin", adminRoutes);
-app.use(notFound);
-app.use(errorHandler);
-module.exports = app;

+const express = require("express");
+const helmet = require("helmet");
+const cors = require("cors");
+const cookieParser = require("cookie-parser");
+const compression = require("compression");
+const morgan = require("morgan");
+const mongoSanitize = require("express-mongo-sanitize");
+const hpp = require("hpp");
+const { env } = require("./config/env");
+const { apiLimiter } = require("./middleware/rateLimiters");
+const { errorHandler, notFound } = require("./middleware/errorHandler");
+const logger = require("./utils/logger");
+const authRoutes = require("./routes/auth.routes");
+const courseRoutes = require("./routes/course.routes");
+const orderRoutes = require("./routes/order.routes");
+const adminRoutes = require("./routes/admin.routes");
+const app = express();
+// Trust the first proxy hop (Render/Heroku/Nginx/etc.) so req.ip and the
+// "secure" cookie/HSTS logic reflect the real client over HTTPS.
+app.set("trust proxy", 1);
+// --- Security headers -------------------------------------------------
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'self'"],
+        scriptSrc: ["'self'"],
+        styleSrc: ["'self'", "'unsafe-inline'"],
+        imgSrc: ["'self'", "data:", "https:"],
+        objectSrc: ["'none'"],
+        frameAncestors: ["'none'"],
+      },
+    },
+    crossOriginResourcePolicy: { policy: "same-site" },
+    hsts: { maxAge: 63072000, includeSubDomains: true, preload: true },
+  })
+);
+// --- CORS: only the configured frontend origins may call the API, and
+// credentials (refresh-token cookie) are only sent to those origins. ---
+app.use(
+  cors({
+    origin(origin, callback) {
+      if (!origin || env.clientOrigins.includes(origin)) return callback(null, true);
+      // Logged (not just thrown) so a mismatched frontend domain shows up
+      // immediately in the server logs with the exact rejected value —
+      // compare this directly against the CORS allow-list logged at
+      // startup to spot typos, protocol mismatches, or a missing entry.
+      logger.warn(`CORS rejected origin: "${origin}" (allow-list: ${JSON.stringify(env.clientOrigins)})`);
+      return callback(new Error("Not allowed by CORS"));
+    },
+    credentials: true,
+  })
+);
+app.use(compression());
+app.use(express.json({ limit: "100kb" })); // small limit: this API never needs large bodies
+app.use(express.urlencoded({ extended: true, limit: "100kb" }));
+app.use(cookieParser(env.cookieSecret));
+// Strip any keys starting with "$" or containing "." from user input to
+// block MongoDB operator-injection attacks.
+app.use(mongoSanitize());
+// Prevent HTTP parameter-pollution (e.g. ?role=user&role=admin).
+app.use(hpp());
+app.use(
+  morgan("combined", {
+    stream: { write: (message) => logger.info(message.trim()) },
+    skip: () => env.nodeEnv === "test",
+  })
+);
+app.use("/api/", apiLimiter);
+app.get("/api/health", (req, res) => res.json({ status: "ok", time: new Date().toISOString() }));
+app.use("/api/auth", authRoutes);
+app.use("/api/courses", courseRoutes);
+app.use("/api/orders", orderRoutes);
+app.use("/api/admin", adminRoutes);
+app.use(notFound);
+app.use(errorHandler);
+module.exports = app;

package.json CHANGED Viewed

@@ -1,39 +1,39 @@
-{
-  "name": "aynwerd-server",
-  "version": "1.0.0",
-  "private": true,
-  "description": "Node.js/Express + MongoDB Atlas backend for courses, checkout, and admin-approved enrolment.",
-  "type": "commonjs",
-  "main": "src/server.js",
-  "scripts": {
-    "start": "node src/server.js",
-    "dev": "nodemon src/server.js",
-    "seed": "node src/seed/seed.js"
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "dependencies": {
-    "bcryptjs": "^2.4.3",
-    "cloudinary": "^2.5.1",
-    "compression": "^1.7.4",
-    "cors": "^2.8.5",
-    "dotenv": "^16.4.5",
-    "express": "^4.19.2",
-    "express-mongo-sanitize": "^2.2.0",
-    "express-rate-limit": "^7.4.0",
-    "express-validator": "^7.2.0",
-    "helmet": "^7.1.0",
-    "hpp": "^0.2.3",
-    "jsonwebtoken": "^9.0.2",
-    "mongoose": "^8.6.0",
-    "morgan": "^1.10.0",
-    "multer": "^1.4.5-lts.1",
-    "nodemailer": "^6.9.14",
-    "uuid": "^9.0.1",
-    "winston": "^3.14.2"
-  },
-  "devDependencies": {
-    "nodemon": "^3.1.4"
-  }
-}

+{
+  "name": "aynwerd-server",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Node.js/Express + MongoDB Atlas backend for courses, checkout, and admin-approved enrolment.",
+  "type": "commonjs",
+  "main": "src/server.js",
+  "scripts": {
+    "start": "node src/server.js",
+    "dev": "nodemon src/server.js",
+    "seed": "node src/seed/seed.js"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "bcryptjs": "^2.4.3",
+    "cloudinary": "^2.5.1",
+    "compression": "^1.7.4",
+    "cors": "^2.8.5",
+    "dotenv": "^16.4.5",
+    "express": "^4.19.2",
+    "express-mongo-sanitize": "^2.2.0",
+    "express-rate-limit": "^7.4.0",
+    "express-validator": "^7.2.0",
+    "helmet": "^7.1.0",
+    "hpp": "^0.2.3",
+    "jsonwebtoken": "^9.0.2",
+    "mongoose": "^8.6.0",
+    "morgan": "^1.10.0",
+    "multer": "^1.4.5-lts.1",
+    "nodemailer": "^6.9.14",
+    "uuid": "^9.0.1",
+    "winston": "^3.14.2"
+  },
+  "devDependencies": {
+    "nodemon": "^3.1.4"
+  }
+}

server.js CHANGED Viewed

@@ -1,53 +1,53 @@
-const { env, assertProductionSafety } = require("./config/env");
-const { connectDB, disconnectDB } = require("./config/db");
-const logger = require("./utils/logger");
-const app = require("./app");
-assertProductionSafety();
-let server;
-async function start() {
-  try {
-    await connectDB();
-    server = app.listen(env.port, () => {
-      logger.info(`Aynwerd API listening on port ${env.port} [${env.nodeEnv}]`);
-      // Logged deliberately at startup: this is the #1 source of CORS
-      // support confusion (a typo'd env var name, stray quotes, a
-      // trailing slash, or the value falling back to its localhost
-      // default because it was never actually set). Seeing the parsed
-      // array here removes all guesswork versus staring at the raw
-      // dashboard value.
-      logger.info(`CORS allow-list (CLIENT_ORIGINS parsed as): ${JSON.stringify(env.clientOrigins)}`);
-    });
-  } catch (err) {
-    logger.error("Failed to start server", { error: err.message });
-    process.exit(1);
-  }
-}
-async function shutdown(signal) {
-  logger.info(`Received ${signal}, shutting down gracefully...`);
-  if (server) {
-    server.close(async () => {
-      await disconnectDB();
-      process.exit(0);
-    });
-    // Force-exit if something hangs
-    setTimeout(() => process.exit(1), 10000).unref();
-  } else {
-    process.exit(0);
-  }
-}
-process.on("SIGINT", () => shutdown("SIGINT"));
-process.on("SIGTERM", () => shutdown("SIGTERM"));
-process.on("unhandledRejection", (reason) => {
-  logger.error("Unhandled promise rejection", { reason: reason?.message || reason });
-});
-process.on("uncaughtException", (err) => {
-  logger.error("Uncaught exception", { error: err.message, stack: err.stack });
-  process.exit(1);
-});
-start();

+const { env, assertProductionSafety } = require("./config/env");
+const { connectDB, disconnectDB } = require("./config/db");
+const logger = require("./utils/logger");
+const app = require("./app");
+assertProductionSafety();
+let server;
+async function start() {
+  try {
+    await connectDB();
+    server = app.listen(env.port, () => {
+      logger.info(`Aynwerd API listening on port ${env.port} [${env.nodeEnv}]`);
+      // Logged deliberately at startup: this is the #1 source of CORS
+      // support confusion (a typo'd env var name, stray quotes, a
+      // trailing slash, or the value falling back to its localhost
+      // default because it was never actually set). Seeing the parsed
+      // array here removes all guesswork versus staring at the raw
+      // dashboard value.
+      logger.info(`CORS allow-list (CLIENT_ORIGINS parsed as): ${JSON.stringify(env.clientOrigins)}`);
+    });
+  } catch (err) {
+    logger.error("Failed to start server", { error: err.message });
+    process.exit(1);
+  }
+}
+async function shutdown(signal) {
+  logger.info(`Received ${signal}, shutting down gracefully...`);
+  if (server) {
+    server.close(async () => {
+      await disconnectDB();
+      process.exit(0);
+    });
+    // Force-exit if something hangs
+    setTimeout(() => process.exit(1), 10000).unref();
+  } else {
+    process.exit(0);
+  }
+}
+process.on("SIGINT", () => shutdown("SIGINT"));
+process.on("SIGTERM", () => shutdown("SIGTERM"));
+process.on("unhandledRejection", (reason) => {
+  logger.error("Unhandled promise rejection", { reason: reason?.message || reason });
+});
+process.on("uncaughtException", (err) => {
+  logger.error("Uncaught exception", { error: err.message, stack: err.stack });
+  process.exit(1);
+});
+start();

src/app.js CHANGED Viewed

@@ -1,99 +1,99 @@
-const express = require("express");
-const helmet = require("helmet");
-const cors = require("cors");
-const compression = require("compression");
-const morgan = require("morgan");
-const mongoSanitize = require("express-mongo-sanitize");
-const hpp = require("hpp");
-const { env } = require("./config/env");
-const { apiLimiter } = require("./middleware/rateLimiters");
-const { errorHandler, notFound } = require("./middleware/errorHandler");
-const logger = require("./utils/logger");
-const authRoutes = require("./routes/auth.routes");
-const courseRoutes = require("./routes/course.routes");
-const orderRoutes = require("./routes/order.routes");
-const adminRoutes = require("./routes/admin.routes");
-const app = express();
-// Trust the first proxy hop (Render/Heroku/Nginx/etc.) so req.ip and the
-// "secure" cookie/HSTS logic reflect the real client over HTTPS.
-app.set("trust proxy", 1);
-// --- Security headers -------------------------------------------------
-app.use(
-  helmet({
-    contentSecurityPolicy: {
-      directives: {
-        defaultSrc: ["'self'"],
-        scriptSrc: ["'self'"],
-        styleSrc: ["'self'", "'unsafe-inline'"],
-        imgSrc: ["'self'", "data:", "https:"],
-        objectSrc: ["'none'"],
-        frameAncestors: ["'none'"],
-      },
-    },
-    crossOriginResourcePolicy: { policy: "same-site" },
-    hsts: { maxAge: 63072000, includeSubDomains: true, preload: true },
-  })
-);
-// --- CORS: only the configured frontend origins may call the API.
-// `credentials: false` is deliberate — this API is designed to run
-// cross-site from its frontend (e.g. a Hugging Face Space backend +
-// a separate Vercel-hosted frontend), and some hosting proxies in that
-// kind of setup intercept CORS preflight requests before they reach
-// this app and strip the Access-Control-Allow-Credentials header,
-// which silently breaks anything relying on `credentials: include`.
-// Sessions are carried via a bearer access token (Authorization
-// header) plus a refresh token returned in the JSON response body
-// instead of a cookie, so no cross-site credentialed request is ever
-// needed — see controllers/auth.controller.js for the reasoning and
-// trade-offs of that approach in more detail. ---
-app.use(
-  cors({
-    origin(origin, callback) {
-      if (!origin || env.clientOrigins.includes(origin)) return callback(null, true);
-      // Logged (not just thrown) so a mismatched frontend domain shows up
-      // immediately in the server logs with the exact rejected value —
-      // compare this directly against the CORS allow-list logged at
-      // startup to spot typos, protocol mismatches, or a missing entry.
-      logger.warn(`CORS rejected origin: "${origin}" (allow-list: ${JSON.stringify(env.clientOrigins)})`);
-      return callback(new Error("Not allowed by CORS"));
-    },
-    credentials: false,
-  })
-);
-app.use(compression());
-app.use(express.json({ limit: "100kb" })); // small limit: this API never needs large bodies
-app.use(express.urlencoded({ extended: true, limit: "100kb" }));
-// Strip any keys starting with "$" or containing "." from user input to
-// block MongoDB operator-injection attacks.
-app.use(mongoSanitize());
-// Prevent HTTP parameter-pollution (e.g. ?role=user&role=admin).
-app.use(hpp());
-app.use(
-  morgan("combined", {
-    stream: { write: (message) => logger.info(message.trim()) },
-    skip: () => env.nodeEnv === "test",
-  })
-);
-app.use("/api/", apiLimiter);
-app.get("/api/health", (req, res) => res.json({ status: "ok", time: new Date().toISOString() }));
-app.use("/api/auth", authRoutes);
-app.use("/api/courses", courseRoutes);
-app.use("/api/orders", orderRoutes);
-app.use("/api/admin", adminRoutes);
-app.use(notFound);
-app.use(errorHandler);
-module.exports = app;

+const express = require("express");
+const helmet = require("helmet");
+const cors = require("cors");
+const compression = require("compression");
+const morgan = require("morgan");
+const mongoSanitize = require("express-mongo-sanitize");
+const hpp = require("hpp");
+const { env } = require("./config/env");
+const { apiLimiter } = require("./middleware/rateLimiters");
+const { errorHandler, notFound } = require("./middleware/errorHandler");
+const logger = require("./utils/logger");
+const authRoutes = require("./routes/auth.routes");
+const courseRoutes = require("./routes/course.routes");
+const orderRoutes = require("./routes/order.routes");
+const adminRoutes = require("./routes/admin.routes");
+const app = express();
+// Trust the first proxy hop (Render/Heroku/Nginx/etc.) so req.ip and the
+// "secure" cookie/HSTS logic reflect the real client over HTTPS.
+app.set("trust proxy", 1);
+// --- Security headers -------------------------------------------------
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'self'"],
+        scriptSrc: ["'self'"],
+        styleSrc: ["'self'", "'unsafe-inline'"],
+        imgSrc: ["'self'", "data:", "https:"],
+        objectSrc: ["'none'"],
+        frameAncestors: ["'none'"],
+      },
+    },
+    crossOriginResourcePolicy: { policy: "same-site" },
+    hsts: { maxAge: 63072000, includeSubDomains: true, preload: true },
+  })
+);
+// --- CORS: only the configured frontend origins may call the API.
+// `credentials: false` is deliberate — this API is designed to run
+// cross-site from its frontend (e.g. a Hugging Face Space backend +
+// a separate Vercel-hosted frontend), and some hosting proxies in that
+// kind of setup intercept CORS preflight requests before they reach
+// this app and strip the Access-Control-Allow-Credentials header,
+// which silently breaks anything relying on `credentials: include`.
+// Sessions are carried via a bearer access token (Authorization
+// header) plus a refresh token returned in the JSON response body
+// instead of a cookie, so no cross-site credentialed request is ever
+// needed — see controllers/auth.controller.js for the reasoning and
+// trade-offs of that approach in more detail. ---
+app.use(
+  cors({
+    origin(origin, callback) {
+      if (!origin || env.clientOrigins.includes(origin)) return callback(null, true);
+      // Logged (not just thrown) so a mismatched frontend domain shows up
+      // immediately in the server logs with the exact rejected value —
+      // compare this directly against the CORS allow-list logged at
+      // startup to spot typos, protocol mismatches, or a missing entry.
+      logger.warn(`CORS rejected origin: "${origin}" (allow-list: ${JSON.stringify(env.clientOrigins)})`);
+      return callback(new Error("Not allowed by CORS"));
+    },
+    credentials: false,
+  })
+);
+app.use(compression());
+app.use(express.json({ limit: "100kb" })); // small limit: this API never needs large bodies
+app.use(express.urlencoded({ extended: true, limit: "100kb" }));
+// Strip any keys starting with "$" or containing "." from user input to
+// block MongoDB operator-injection attacks.
+app.use(mongoSanitize());
+// Prevent HTTP parameter-pollution (e.g. ?role=user&role=admin).
+app.use(hpp());
+app.use(
+  morgan("combined", {
+    stream: { write: (message) => logger.info(message.trim()) },
+    skip: () => env.nodeEnv === "test",
+  })
+);
+app.use("/api/", apiLimiter);
+app.get("/api/health", (req, res) => res.json({ status: "ok", time: new Date().toISOString() }));
+app.use("/api/auth", authRoutes);
+app.use("/api/courses", courseRoutes);
+app.use("/api/orders", orderRoutes);
+app.use("/api/admin", adminRoutes);
+app.use(notFound);
+app.use(errorHandler);
+module.exports = app;

src/config/cloudinary.js CHANGED Viewed

@@ -1,11 +1,11 @@
-const { v2: cloudinary } = require("cloudinary");
-const { env } = require("./env");
-cloudinary.config({
-  cloud_name: env.cloudinary.cloudName,
-  api_key: env.cloudinary.apiKey,
-  api_secret: env.cloudinary.apiSecret,
-  secure: true,
-});
-module.exports = cloudinary;

+const { v2: cloudinary } = require("cloudinary");
+const { env } = require("./env");
+cloudinary.config({
+  cloud_name: env.cloudinary.cloudName,
+  api_key: env.cloudinary.apiKey,
+  api_secret: env.cloudinary.apiSecret,
+  secure: true,
+});
+module.exports = cloudinary;

src/config/db.js CHANGED Viewed

@@ -1,44 +1,44 @@
-const mongoose = require("mongoose");
-const { env } = require("./env");
-const logger = require("../utils/logger");
-mongoose.set("strictQuery", true);
-async function connectDB() {
-  if (!env.mongoUri) {
-    throw new Error("MONGODB_URI is not set. Copy .env.example to .env and configure your Atlas connection string.");
-  }
-  mongoose.connection.on("connected", () => logger.info("MongoDB connected"));
-  mongoose.connection.on("error", (err) => logger.error("MongoDB connection error", { error: err.message }));
-  mongoose.connection.on("disconnected", () => logger.warn("MongoDB disconnected"));
-  try {
-    await mongoose.connect(env.mongoUri, {
-      // Modern mongoose driver already defaults to these; kept explicit for clarity.
-      autoIndex: env.nodeEnv !== "production", // build indexes lazily in prod via migration/ops task
-      maxPoolSize: 20,
-      serverSelectionTimeoutMS: 10000,
-    });
-  } catch (err) {
-    if (err.code === "ECONNREFUSED" && err.syscall === "querySrv") {
-      throw new Error(
-        "Could not resolve your MongoDB Atlas SRV connection string " +
-          `(${err.hostname || "the cluster hostname"}). This almost always means your network, router, ` +
-          "or ISP is blocking DNS SRV record lookups (common on home/office Wi-Fi) — it is not a code " +
-          "or credentials problem. Fix: in Atlas, go to your cluster → Connect → Drivers, and use the " +
-          "'standard connection string' (starts with mongodb:// and lists three hosts) instead of the " +
-          "mongodb+srv:// one, then update MONGODB_URI in your .env. See server/README.md for details."
-      );
-    }
-    throw err;
-  }
-  return mongoose.connection;
-}
-async function disconnectDB() {
-  await mongoose.disconnect();
-}
-module.exports = { connectDB, disconnectDB };

+const mongoose = require("mongoose");
+const { env } = require("./env");
+const logger = require("../utils/logger");
+mongoose.set("strictQuery", true);
+async function connectDB() {
+  if (!env.mongoUri) {
+    throw new Error("MONGODB_URI is not set. Copy .env.example to .env and configure your Atlas connection string.");
+  }
+  mongoose.connection.on("connected", () => logger.info("MongoDB connected"));
+  mongoose.connection.on("error", (err) => logger.error("MongoDB connection error", { error: err.message }));
+  mongoose.connection.on("disconnected", () => logger.warn("MongoDB disconnected"));
+  try {
+    await mongoose.connect(env.mongoUri, {
+      // Modern mongoose driver already defaults to these; kept explicit for clarity.
+      autoIndex: env.nodeEnv !== "production", // build indexes lazily in prod via migration/ops task
+      maxPoolSize: 20,
+      serverSelectionTimeoutMS: 10000,
+    });
+  } catch (err) {
+    if (err.code === "ECONNREFUSED" && err.syscall === "querySrv") {
+      throw new Error(
+        "Could not resolve your MongoDB Atlas SRV connection string " +
+          `(${err.hostname || "the cluster hostname"}). This almost always means your network, router, ` +
+          "or ISP is blocking DNS SRV record lookups (common on home/office Wi-Fi) — it is not a code " +
+          "or credentials problem. Fix: in Atlas, go to your cluster → Connect → Drivers, and use the " +
+          "'standard connection string' (starts with mongodb:// and lists three hosts) instead of the " +
+          "mongodb+srv:// one, then update MONGODB_URI in your .env. See server/README.md for details."
+      );
+    }
+    throw err;
+  }
+  return mongoose.connection;
+}
+async function disconnectDB() {
+  await mongoose.disconnect();
+}
+module.exports = { connectDB, disconnectDB };

src/config/env.js CHANGED Viewed

@@ -1,100 +1,100 @@
-require("dotenv").config();
-// Fail fast if critical secrets are missing or left as placeholders — this
-// is a cheap, high-value guard against accidentally deploying with
-// insecure defaults.
-const REQUIRED_IN_PRODUCTION = [
-  "MONGODB_URI",
-  "JWT_ACCESS_SECRET",
-  "JWT_REFRESH_SECRET",
-  "FIELD_ENCRYPTION_KEY",
-  "SMTP_HOST",
-  "SMTP_USER",
-  "SMTP_PASS",
-  "CLOUDINARY_CLOUD_NAME",
-  "CLOUDINARY_API_KEY",
-  "CLOUDINARY_API_SECRET",
-];
-const env = {
-  nodeEnv: process.env.NODE_ENV || "development",
-  port: parseInt(process.env.PORT, 10) || 5000,
-  clientOrigins: (process.env.CLIENT_ORIGINS || "http://localhost:5173")
-    .split(",")
-    .map((s) => s.trim())
-    .filter(Boolean),
-  mongoUri: process.env.MONGODB_URI,
-  jwtAccessSecret: process.env.JWT_ACCESS_SECRET,
-  jwtRefreshSecret: process.env.JWT_REFRESH_SECRET,
-  jwtAccessExpiresIn: process.env.JWT_ACCESS_EXPIRES_IN || "15m",
-  jwtRefreshExpiresIn: process.env.JWT_REFRESH_EXPIRES_IN || "7d",
-  fieldEncryptionKey: process.env.FIELD_ENCRYPTION_KEY,
-  smtp: {
-    host: process.env.SMTP_HOST,
-    port: parseInt(process.env.SMTP_PORT, 10) || 587,
-    secure: process.env.SMTP_SECURE === "true",
-    user: process.env.SMTP_USER,
-    pass: process.env.SMTP_PASS,
-  },
-  emailFrom: process.env.EMAIL_FROM || "Aynwerd Academy <no-reply@aynwerd.com>",
-  adminNotifyEmail: process.env.ADMIN_NOTIFY_EMAIL,
-  bank: {
-    name: process.env.BANK_NAME || "",
-    accountName: process.env.BANK_ACCOUNT_NAME || "",
-    accountNumber: process.env.BANK_ACCOUNT_NUMBER || "",
-    routingNumber: process.env.BANK_ROUTING_NUMBER || "",
-    swiftBic: process.env.BANK_SWIFT_BIC || "",
-    iban: process.env.BANK_IBAN || "",
-    address: process.env.BANK_ADDRESS || "",
-  },
-  payoneer: {
-    paymentUrl: process.env.PAYONEER_PAYMENT_URL || "https://www.payoneer.com/",
-    accountEmail: process.env.PAYONEER_ACCOUNT_EMAIL || "",
-  },
-  seedAdmin: {
-    name: process.env.SEED_ADMIN_NAME || "Site Admin",
-    email: process.env.SEED_ADMIN_EMAIL,
-    password: process.env.SEED_ADMIN_PASSWORD,
-  },
-  // Cloudinary: free-tier media storage used exclusively for admin-uploaded
-  // course videos/documents. Files are uploaded with delivery type
-  // "authenticated" so nothing is reachable without a freshly signed,
-  // short-lived URL minted server-side for a verified, paying learner.
-  cloudinary: {
-    cloudName: process.env.CLOUDINARY_CLOUD_NAME,
-    apiKey: process.env.CLOUDINARY_API_KEY,
-    apiSecret: process.env.CLOUDINARY_API_SECRET,
-  },
-};
-function assertProductionSafety() {
-  if (env.nodeEnv !== "production") return;
-  const missing = REQUIRED_IN_PRODUCTION.filter((key) => {
-    const value = process.env[key];
-    return !value || value.startsWith("replace_with_") || value.includes("<");
-  });
-  if (missing.length > 0) {
-    // eslint-disable-next-line no-console
-    console.error(
-      `FATAL: refusing to start in production with missing/placeholder env vars: ${missing.join(", ")}`
-    );
-    process.exit(1);
-  }
-  if (Buffer.from(env.fieldEncryptionKey || "", "hex").length !== 32) {
-    // eslint-disable-next-line no-console
-    console.error("FATAL: FIELD_ENCRYPTION_KEY must be a 32-byte (64 hex character) value.");
-    process.exit(1);
-  }
-}
-module.exports = { env, assertProductionSafety };

+require("dotenv").config();
+// Fail fast if critical secrets are missing or left as placeholders — this
+// is a cheap, high-value guard against accidentally deploying with
+// insecure defaults.
+const REQUIRED_IN_PRODUCTION = [
+  "MONGODB_URI",
+  "JWT_ACCESS_SECRET",
+  "JWT_REFRESH_SECRET",
+  "FIELD_ENCRYPTION_KEY",
+  "SMTP_HOST",
+  "SMTP_USER",
+  "SMTP_PASS",
+  "CLOUDINARY_CLOUD_NAME",
+  "CLOUDINARY_API_KEY",
+  "CLOUDINARY_API_SECRET",
+];
+const env = {
+  nodeEnv: process.env.NODE_ENV || "development",
+  port: parseInt(process.env.PORT, 10) || 5000,
+  clientOrigins: (process.env.CLIENT_ORIGINS || "http://localhost:5173")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean),
+  mongoUri: process.env.MONGODB_URI,
+  jwtAccessSecret: process.env.JWT_ACCESS_SECRET,
+  jwtRefreshSecret: process.env.JWT_REFRESH_SECRET,
+  jwtAccessExpiresIn: process.env.JWT_ACCESS_EXPIRES_IN || "15m",
+  jwtRefreshExpiresIn: process.env.JWT_REFRESH_EXPIRES_IN || "7d",
+  fieldEncryptionKey: process.env.FIELD_ENCRYPTION_KEY,
+  smtp: {
+    host: process.env.SMTP_HOST,
+    port: parseInt(process.env.SMTP_PORT, 10) || 587,
+    secure: process.env.SMTP_SECURE === "true",
+    user: process.env.SMTP_USER,
+    pass: process.env.SMTP_PASS,
+  },
+  emailFrom: process.env.EMAIL_FROM || "Aynwerd Academy <no-reply@aynwerd.com>",
+  adminNotifyEmail: process.env.ADMIN_NOTIFY_EMAIL,
+  bank: {
+    name: process.env.BANK_NAME || "",
+    accountName: process.env.BANK_ACCOUNT_NAME || "",
+    accountNumber: process.env.BANK_ACCOUNT_NUMBER || "",
+    routingNumber: process.env.BANK_ROUTING_NUMBER || "",
+    swiftBic: process.env.BANK_SWIFT_BIC || "",
+    iban: process.env.BANK_IBAN || "",
+    address: process.env.BANK_ADDRESS || "",
+  },
+  payoneer: {
+    paymentUrl: process.env.PAYONEER_PAYMENT_URL || "https://www.payoneer.com/",
+    accountEmail: process.env.PAYONEER_ACCOUNT_EMAIL || "",
+  },
+  seedAdmin: {
+    name: process.env.SEED_ADMIN_NAME || "Site Admin",
+    email: process.env.SEED_ADMIN_EMAIL,
+    password: process.env.SEED_ADMIN_PASSWORD,
+  },
+  // Cloudinary: free-tier media storage used exclusively for admin-uploaded
+  // course videos/documents. Files are uploaded with delivery type
+  // "authenticated" so nothing is reachable without a freshly signed,
+  // short-lived URL minted server-side for a verified, paying learner.
+  cloudinary: {
+    cloudName: process.env.CLOUDINARY_CLOUD_NAME,
+    apiKey: process.env.CLOUDINARY_API_KEY,
+    apiSecret: process.env.CLOUDINARY_API_SECRET,
+  },
+};
+function assertProductionSafety() {
+  if (env.nodeEnv !== "production") return;
+  const missing = REQUIRED_IN_PRODUCTION.filter((key) => {
+    const value = process.env[key];
+    return !value || value.startsWith("replace_with_") || value.includes("<");
+  });
+  if (missing.length > 0) {
+    // eslint-disable-next-line no-console
+    console.error(
+      `FATAL: refusing to start in production with missing/placeholder env vars: ${missing.join(", ")}`
+    );
+    process.exit(1);
+  }
+  if (Buffer.from(env.fieldEncryptionKey || "", "hex").length !== 32) {
+    // eslint-disable-next-line no-console
+    console.error("FATAL: FIELD_ENCRYPTION_KEY must be a 32-byte (64 hex character) value.");
+    process.exit(1);
+  }
+}
+module.exports = { env, assertProductionSafety };

src/controllers/admin.controller.js CHANGED Viewed

@@ -1,198 +1,198 @@
-const mongoose = require("mongoose");
-const Order = require("../models/Order");
-const User = require("../models/User");
-const Course = require("../models/Course");
-const AuditLog = require("../models/AuditLog");
-const { sendPaymentConfirmedEmail, sendPaymentRejectedEmail } = require("../utils/email");
-const logger = require("../utils/logger");
-async function listOrders(req, res, next) {
-  try {
-    const { status } = req.query;
-    const filter = {};
-    if (status) filter.status = status;
-    const orders = await Order.find(filter)
-      .sort({ createdAt: -1 })
-      .populate("user", "name email")
-      .populate("course", "title");
-    res.json({
-      orders: orders.map((o) => ({
-        ...o.toPublicJSON(),
-        user: o.user ? { id: o.user._id, name: o.user.name, email: o.user.email } : null,
-      })),
-    });
-  } catch (err) {
-    next(err);
-  }
-}
-/** Admin views the decrypted payment reference only when actively reviewing a specific order. */
-async function getOrderDetail(req, res, next) {
-  try {
-    const order = await Order.findById(req.params.id)
-      .select("+paymentReferenceEncrypted +payerNoteEncrypted")
-      .populate("user", "name email")
-      .populate("course", "title price");
-    if (!order) return res.status(404).json({ error: "Order not found." });
-    await AuditLog.create({
-      actor: req.user._id,
-      actorEmail: req.user.email,
-      action: "admin.order_viewed",
-      targetType: "Order",
-      targetId: order._id,
-      ip: req.ip,
-      userAgent: req.headers["user-agent"],
-    });
-    res.json({
-      order: {
-        ...order.toPublicJSON({ includeSensitive: true }),
-        user: order.user ? { id: order.user._id, name: order.user.name, email: order.user.email } : null,
-      },
-    });
-  } catch (err) {
-    next(err);
-  }
-}
-/**
- * Confirms a payment: marks the order confirmed, grants course access to
- * the user, and emails the customer. Wrapped in a transaction so a
- * partial failure can't leave the order confirmed without access
- * granted (or vice versa).
- */
-async function confirmOrder(req, res, next) {
-  const session = await mongoose.startSession();
-  try {
-    let resultOrder;
-    let resultUser;
-    let course;
-    await session.withTransaction(async () => {
-      const order = await Order.findById(req.params.id).session(session);
-      if (!order) throw Object.assign(new Error("Order not found."), { status: 404 });
-      if (order.status === "confirmed") throw Object.assign(new Error("Order already confirmed."), { status: 409 });
-      if (!["awaiting_confirmation", "pending_payment"].includes(order.status)) {
-        throw Object.assign(new Error("Order cannot be confirmed from its current status."), { status: 409 });
-      }
-      order.status = "confirmed";
-      order.confirmedBy = req.user._id;
-      order.confirmedAt = new Date();
-      await order.save({ session });
-      const user = await User.findById(order.user).session(session);
-      if (!user) throw Object.assign(new Error("Associated user not found."), { status: 404 });
-      const alreadyEnrolled = user.enrolledCourses.some((ec) => ec.course.toString() === order.course.toString());
-      if (!alreadyEnrolled) {
-        user.enrolledCourses.push({ course: order.course, order: order._id, accessGrantedAt: new Date() });
-        await user.save({ session });
-      }
-      course = await Course.findById(order.course).session(session);
-      resultOrder = order;
-      resultUser = user;
-    });
-    await AuditLog.create({
-      actor: req.user._id,
-      actorEmail: req.user.email,
-      action: "admin.order_confirmed",
-      targetType: "Order",
-      targetId: resultOrder._id,
-      ip: req.ip,
-      userAgent: req.headers["user-agent"],
-      metadata: { userId: resultUser._id.toString() },
-    });
-    sendPaymentConfirmedEmail({
-      to: resultUser.email,
-      name: resultUser.name,
-      order: resultOrder,
-      courseTitle: course ? course.title : resultOrder.courseTitleSnapshot,
-    }).catch((err) => logger.error("Payment-confirmed email failed", { error: err.message }));
-    res.json({ order: resultOrder.toPublicJSON() });
-  } catch (err) {
-    next(err);
-  } finally {
-    session.endSession();
-  }
-}
-async function rejectOrder(req, res, next) {
-  try {
-    const { reason } = req.body;
-    const order = await Order.findById(req.params.id).populate("user", "name email");
-    if (!order) return res.status(404).json({ error: "Order not found." });
-    if (order.status === "confirmed") {
-      return res.status(409).json({ error: "A confirmed order cannot be rejected. Consider revoking access separately." });
-    }
-    order.status = "rejected";
-    order.rejectionReason = reason || null;
-    await order.save();
-    await AuditLog.create({
-      actor: req.user._id,
-      actorEmail: req.user.email,
-      action: "admin.order_rejected",
-      targetType: "Order",
-      targetId: order._id,
-      ip: req.ip,
-      userAgent: req.headers["user-agent"],
-      metadata: { reason: reason || null },
-    });
-    if (order.user) {
-      sendPaymentRejectedEmail({
-        to: order.user.email,
-        name: order.user.name,
-        order,
-        courseTitle: order.courseTitleSnapshot,
-        reason,
-      }).catch((err) => logger.error("Payment-rejected email failed", { error: err.message }));
-    }
-    res.json({ order: order.toPublicJSON() });
-  } catch (err) {
-    next(err);
-  }
-}
-async function dashboardStats(req, res, next) {
-  try {
-    const [pendingCount, confirmedCount, rejectedCount, totalUsers, revenueAgg] = await Promise.all([
-      Order.countDocuments({ status: "awaiting_confirmation" }),
-      Order.countDocuments({ status: "confirmed" }),
-      Order.countDocuments({ status: "rejected" }),
-      User.countDocuments({ role: "user" }),
-      Order.aggregate([{ $match: { status: "confirmed" } }, { $group: { _id: "$currency", total: { $sum: "$amount" } } }]),
-    ]);
-    res.json({
-      pendingOrders: pendingCount,
-      confirmedOrders: confirmedCount,
-      rejectedOrders: rejectedCount,
-      totalUsers,
-      revenueByCurrency: revenueAgg.map((r) => ({ currency: r._id, total: r.total })),
-    });
-  } catch (err) {
-    next(err);
-  }
-}
-async function listUsers(req, res, next) {
-  try {
-    const users = await User.find({}).sort({ createdAt: -1 }).limit(500);
-    res.json({ users: users.map((u) => u.toSafeJSON()) });
-  } catch (err) {
-    next(err);
-  }
-}
-module.exports = { listOrders, getOrderDetail, confirmOrder, rejectOrder, dashboardStats, listUsers };

+const mongoose = require("mongoose");
+const Order = require("../models/Order");
+const User = require("../models/User");
+const Course = require("../models/Course");
+const AuditLog = require("../models/AuditLog");
+const { sendPaymentConfirmedEmail, sendPaymentRejectedEmail } = require("../utils/email");
+const logger = require("../utils/logger");
+async function listOrders(req, res, next) {
+  try {
+    const { status } = req.query;
+    const filter = {};
+    if (status) filter.status = status;
+    const orders = await Order.find(filter)
+      .sort({ createdAt: -1 })
+      .populate("user", "name email")
+      .populate("course", "title");
+    res.json({
+      orders: orders.map((o) => ({
+        ...o.toPublicJSON(),
+        user: o.user ? { id: o.user._id, name: o.user.name, email: o.user.email } : null,
+      })),
+    });
+  } catch (err) {
+    next(err);
+  }
+}
+/** Admin views the decrypted payment reference only when actively reviewing a specific order. */
+async function getOrderDetail(req, res, next) {
+  try {
+    const order = await Order.findById(req.params.id)
+      .select("+paymentReferenceEncrypted +payerNoteEncrypted")
+      .populate("user", "name email")
+      .populate("course", "title price");
+    if (!order) return res.status(404).json({ error: "Order not found." });
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "admin.order_viewed",
+      targetType: "Order",
+      targetId: order._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+    });
+    res.json({
+      order: {
+        ...order.toPublicJSON({ includeSensitive: true }),
+        user: order.user ? { id: order.user._id, name: order.user.name, email: order.user.email } : null,
+      },
+    });
+  } catch (err) {
+    next(err);
+  }
+}
+/**
+ * Confirms a payment: marks the order confirmed, grants course access to
+ * the user, and emails the customer. Wrapped in a transaction so a
+ * partial failure can't leave the order confirmed without access
+ * granted (or vice versa).
+ */
+async function confirmOrder(req, res, next) {
+  const session = await mongoose.startSession();
+  try {
+    let resultOrder;
+    let resultUser;
+    let course;
+    await session.withTransaction(async () => {
+      const order = await Order.findById(req.params.id).session(session);
+      if (!order) throw Object.assign(new Error("Order not found."), { status: 404 });
+      if (order.status === "confirmed") throw Object.assign(new Error("Order already confirmed."), { status: 409 });
+      if (!["awaiting_confirmation", "pending_payment"].includes(order.status)) {
+        throw Object.assign(new Error("Order cannot be confirmed from its current status."), { status: 409 });
+      }
+      order.status = "confirmed";
+      order.confirmedBy = req.user._id;
+      order.confirmedAt = new Date();
+      await order.save({ session });
+      const user = await User.findById(order.user).session(session);
+      if (!user) throw Object.assign(new Error("Associated user not found."), { status: 404 });
+      const alreadyEnrolled = user.enrolledCourses.some((ec) => ec.course.toString() === order.course.toString());
+      if (!alreadyEnrolled) {
+        user.enrolledCourses.push({ course: order.course, order: order._id, accessGrantedAt: new Date() });
+        await user.save({ session });
+      }
+      course = await Course.findById(order.course).session(session);
+      resultOrder = order;
+      resultUser = user;
+    });
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "admin.order_confirmed",
+      targetType: "Order",
+      targetId: resultOrder._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: { userId: resultUser._id.toString() },
+    });
+    sendPaymentConfirmedEmail({
+      to: resultUser.email,
+      name: resultUser.name,
+      order: resultOrder,
+      courseTitle: course ? course.title : resultOrder.courseTitleSnapshot,
+    }).catch((err) => logger.error("Payment-confirmed email failed", { error: err.message }));
+    res.json({ order: resultOrder.toPublicJSON() });
+  } catch (err) {
+    next(err);
+  } finally {
+    session.endSession();
+  }
+}
+async function rejectOrder(req, res, next) {
+  try {
+    const { reason } = req.body;
+    const order = await Order.findById(req.params.id).populate("user", "name email");
+    if (!order) return res.status(404).json({ error: "Order not found." });
+    if (order.status === "confirmed") {
+      return res.status(409).json({ error: "A confirmed order cannot be rejected. Consider revoking access separately." });
+    }
+    order.status = "rejected";
+    order.rejectionReason = reason || null;
+    await order.save();
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "admin.order_rejected",
+      targetType: "Order",
+      targetId: order._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: { reason: reason || null },
+    });
+    if (order.user) {
+      sendPaymentRejectedEmail({
+        to: order.user.email,
+        name: order.user.name,
+        order,
+        courseTitle: order.courseTitleSnapshot,
+        reason,
+      }).catch((err) => logger.error("Payment-rejected email failed", { error: err.message }));
+    }
+    res.json({ order: order.toPublicJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+async function dashboardStats(req, res, next) {
+  try {
+    const [pendingCount, confirmedCount, rejectedCount, totalUsers, revenueAgg] = await Promise.all([
+      Order.countDocuments({ status: "awaiting_confirmation" }),
+      Order.countDocuments({ status: "confirmed" }),
+      Order.countDocuments({ status: "rejected" }),
+      User.countDocuments({ role: "user" }),
+      Order.aggregate([{ $match: { status: "confirmed" } }, { $group: { _id: "$currency", total: { $sum: "$amount" } } }]),
+    ]);
+    res.json({
+      pendingOrders: pendingCount,
+      confirmedOrders: confirmedCount,
+      rejectedOrders: rejectedCount,
+      totalUsers,
+      revenueByCurrency: revenueAgg.map((r) => ({ currency: r._id, total: r.total })),
+    });
+  } catch (err) {
+    next(err);
+  }
+}
+async function listUsers(req, res, next) {
+  try {
+    const users = await User.find({}).sort({ createdAt: -1 }).limit(500);
+    res.json({ users: users.map((u) => u.toSafeJSON()) });
+  } catch (err) {
+    next(err);
+  }
+}
+module.exports = { listOrders, getOrderDetail, confirmOrder, rejectOrder, dashboardStats, listUsers };

src/controllers/auth.controller.js CHANGED Viewed

@@ -1,193 +1,193 @@
-const User = require("../models/User");
-const AuditLog = require("../models/AuditLog");
-const { signAccessToken, signRefreshToken, verifyRefreshToken } = require("../utils/jwt");
-const logger = require("../utils/logger");
-const MAX_FAILED_ATTEMPTS = 5;
-const LOCK_DURATION_MS = 15 * 60 * 1000; // 15 minutes
-const REFRESH_TOKEN_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
-// --------------------------------------------------------------------
-// Refresh tokens are returned in the JSON response body (and stored by
-// the client in localStorage) rather than as an httpOnly cookie.
-//
-// Why: this API and its frontend are deployed on different domains
-// (e.g. a Hugging Face Space + a separate Vercel domain), and some
-// hosting proxies in that kind of cross-site setup intercept CORS
-// preflight requests before they reach the app and strip the
-// Access-Control-Allow-Credentials header — which silently breaks any
-// flow that depends on browsers sending a cross-site cookie. Avoiding
-// `credentials: include` entirely sidesteps that class of problem.
-//
-// The trade-off: an httpOnly cookie can never be read by JavaScript,
-// even from an XSS payload; a token sitting in localStorage can be.
-// We narrow that risk with what's still in our control — access
-// tokens stay short-lived (15 min) and refresh tokens rotate on every
-// use with reuse detection (see `refresh` below) — but this is
-// genuinely a lower security bar than the cookie-based approach, and
-// worth knowing if you migrate this API to a same-site deployment
-// later (at which point switching back to an httpOnly cookie is
-// recommended).
-// --------------------------------------------------------------------
-async function audit(action, req, extra = {}) {
-  try {
-    await AuditLog.create({
-      actor: req.user ? req.user._id : null,
-      actorEmail: req.user ? req.user.email : extra.email || null,
-      action,
-      ip: req.ip,
-      userAgent: req.headers["user-agent"],
-      metadata: extra.metadata || {},
-    });
-  } catch (err) {
-    logger.error("Failed to write audit log", { action, error: err.message });
-  }
-}
-function issueSession(user, req) {
-  const accessToken = signAccessToken(user);
-  const { token: refreshToken, jti } = signRefreshToken(user);
-  user.activeRefreshTokens = (user.activeRefreshTokens || [])
-    .filter((rt) => rt.expiresAt > new Date()) // prune expired sessions as we go
-    .concat({
-      jti,
-      expiresAt: new Date(Date.now() + REFRESH_TOKEN_LIFETIME_MS),
-      userAgent: req.headers["user-agent"],
-      ip: req.ip,
-    });
-  return { accessToken, refreshToken };
-}
-async function signup(req, res, next) {
-  try {
-    const { name, email, password } = req.body;
-    const existing = await User.findOne({ email: email.toLowerCase() });
-    if (existing) {
-      // Do not reveal which part of the credential pair is wrong to
-      // avoid account enumeration.
-      return res.status(409).json({ error: "Unable to create account with the details provided." });
-    }
-    const user = new User({ name, email: email.toLowerCase() });
-    await user.setPassword(password);
-    await user.save();
-    await audit("user.signup", req, { email: user.email });
-    const { accessToken, refreshToken } = issueSession(user, req);
-    await user.save();
-    res.status(201).json({ user: user.toSafeJSON(), accessToken, refreshToken });
-  } catch (err) {
-    next(err);
-  }
-}
-async function login(req, res, next) {
-  try {
-    const { email, password } = req.body;
-    const user = await User.findOne({ email: email.toLowerCase() }).select(
-      "+passwordHash +failedLoginAttempts +lockUntil +activeRefreshTokens"
-    );
-    // Constant-shaped response whether the user exists or not.
-    const genericError = () => res.status(401).json({ error: "Invalid email or password." });
-    if (!user || !user.isActive) return genericError();
-    if (user.isLocked()) {
-      return res.status(423).json({
-        error: "Account temporarily locked due to repeated failed attempts. Try again later.",
-      });
-    }
-    const valid = await user.comparePassword(password);
-    if (!valid) {
-      user.failedLoginAttempts = (user.failedLoginAttempts || 0) + 1;
-      if (user.failedLoginAttempts >= MAX_FAILED_ATTEMPTS) {
-        user.lockUntil = new Date(Date.now() + LOCK_DURATION_MS);
-        user.failedLoginAttempts = 0;
-        await audit("user.login.locked", req, { email: user.email });
-      }
-      await user.save();
-      return genericError();
-    }
-    user.failedLoginAttempts = 0;
-    user.lockUntil = null;
-    const { accessToken, refreshToken } = issueSession(user, req);
-    await user.save();
-    await audit("user.login", req, { email: user.email });
-    res.json({ user: user.toSafeJSON(), accessToken, refreshToken });
-  } catch (err) {
-    next(err);
-  }
-}
-async function refresh(req, res, next) {
-  try {
-    const { refreshToken: token } = req.body;
-    if (!token) return res.status(401).json({ error: "No refresh token provided." });
-    let payload;
-    try {
-      payload = verifyRefreshToken(token);
-    } catch {
-      return res.status(401).json({ error: "Invalid or expired session, please log in again." });
-    }
-    const user = await User.findById(payload.sub).select("+activeRefreshTokens");
-    if (!user || !user.isActive || user.tokenVersion !== payload.tokenVersion) {
-      return res.status(401).json({ error: "Session no longer valid, please log in again." });
-    }
-    const stillActive = (user.activeRefreshTokens || []).some((rt) => rt.jti === payload.jti);
-    if (!stillActive) {
-      // Possible reuse of an already-rotated (or logged-out) refresh
-      // token — deny it. As a precaution, also revoke every other
-      // active session for this account, since a replayed token is a
-      // signal the original may have leaked.
-      user.activeRefreshTokens = [];
-      await user.save();
-      return res.status(401).json({ error: "Session no longer valid, please log in again." });
-    }
-    // Rotate: remove old jti, issue a new refresh token.
-    user.activeRefreshTokens = user.activeRefreshTokens.filter((rt) => rt.jti !== payload.jti);
-    const { accessToken, refreshToken: newRefreshToken } = issueSession(user, req);
-    await user.save();
-    res.json({ accessToken, refreshToken: newRefreshToken, user: user.toSafeJSON() });
-  } catch (err) {
-    next(err);
-  }
-}
-async function logout(req, res, next) {
-  try {
-    const { refreshToken: token } = req.body;
-    if (token) {
-      try {
-        const payload = verifyRefreshToken(token);
-        await User.findByIdAndUpdate(payload.sub, { $pull: { activeRefreshTokens: { jti: payload.jti } } });
-      } catch {
-        // token already invalid — nothing to revoke
-      }
-    }
-    res.json({ success: true });
-  } catch (err) {
-    next(err);
-  }
-}
-async function me(req, res) {
-  res.json({ user: req.user.toSafeJSON() });
-}
-module.exports = { signup, login, refresh, logout, me };

+const User = require("../models/User");
+const AuditLog = require("../models/AuditLog");
+const { signAccessToken, signRefreshToken, verifyRefreshToken } = require("../utils/jwt");
+const logger = require("../utils/logger");
+const MAX_FAILED_ATTEMPTS = 5;
+const LOCK_DURATION_MS = 15 * 60 * 1000; // 15 minutes
+const REFRESH_TOKEN_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
+// --------------------------------------------------------------------
+// Refresh tokens are returned in the JSON response body (and stored by
+// the client in localStorage) rather than as an httpOnly cookie.
+//
+// Why: this API and its frontend are deployed on different domains
+// (e.g. a Hugging Face Space + a separate Vercel domain), and some
+// hosting proxies in that kind of cross-site setup intercept CORS
+// preflight requests before they reach the app and strip the
+// Access-Control-Allow-Credentials header — which silently breaks any
+// flow that depends on browsers sending a cross-site cookie. Avoiding
+// `credentials: include` entirely sidesteps that class of problem.
+//
+// The trade-off: an httpOnly cookie can never be read by JavaScript,
+// even from an XSS payload; a token sitting in localStorage can be.
+// We narrow that risk with what's still in our control — access
+// tokens stay short-lived (15 min) and refresh tokens rotate on every
+// use with reuse detection (see `refresh` below) — but this is
+// genuinely a lower security bar than the cookie-based approach, and
+// worth knowing if you migrate this API to a same-site deployment
+// later (at which point switching back to an httpOnly cookie is
+// recommended).
+// --------------------------------------------------------------------
+async function audit(action, req, extra = {}) {
+  try {
+    await AuditLog.create({
+      actor: req.user ? req.user._id : null,
+      actorEmail: req.user ? req.user.email : extra.email || null,
+      action,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: extra.metadata || {},
+    });
+  } catch (err) {
+    logger.error("Failed to write audit log", { action, error: err.message });
+  }
+}
+function issueSession(user, req) {
+  const accessToken = signAccessToken(user);
+  const { token: refreshToken, jti } = signRefreshToken(user);
+  user.activeRefreshTokens = (user.activeRefreshTokens || [])
+    .filter((rt) => rt.expiresAt > new Date()) // prune expired sessions as we go
+    .concat({
+      jti,
+      expiresAt: new Date(Date.now() + REFRESH_TOKEN_LIFETIME_MS),
+      userAgent: req.headers["user-agent"],
+      ip: req.ip,
+    });
+  return { accessToken, refreshToken };
+}
+async function signup(req, res, next) {
+  try {
+    const { name, email, password } = req.body;
+    const existing = await User.findOne({ email: email.toLowerCase() });
+    if (existing) {
+      // Do not reveal which part of the credential pair is wrong to
+      // avoid account enumeration.
+      return res.status(409).json({ error: "Unable to create account with the details provided." });
+    }
+    const user = new User({ name, email: email.toLowerCase() });
+    await user.setPassword(password);
+    await user.save();
+    await audit("user.signup", req, { email: user.email });
+    const { accessToken, refreshToken } = issueSession(user, req);
+    await user.save();
+    res.status(201).json({ user: user.toSafeJSON(), accessToken, refreshToken });
+  } catch (err) {
+    next(err);
+  }
+}
+async function login(req, res, next) {
+  try {
+    const { email, password } = req.body;
+    const user = await User.findOne({ email: email.toLowerCase() }).select(
+      "+passwordHash +failedLoginAttempts +lockUntil +activeRefreshTokens"
+    );
+    // Constant-shaped response whether the user exists or not.
+    const genericError = () => res.status(401).json({ error: "Invalid email or password." });
+    if (!user || !user.isActive) return genericError();
+    if (user.isLocked()) {
+      return res.status(423).json({
+        error: "Account temporarily locked due to repeated failed attempts. Try again later.",
+      });
+    }
+    const valid = await user.comparePassword(password);
+    if (!valid) {
+      user.failedLoginAttempts = (user.failedLoginAttempts || 0) + 1;
+      if (user.failedLoginAttempts >= MAX_FAILED_ATTEMPTS) {
+        user.lockUntil = new Date(Date.now() + LOCK_DURATION_MS);
+        user.failedLoginAttempts = 0;
+        await audit("user.login.locked", req, { email: user.email });
+      }
+      await user.save();
+      return genericError();
+    }
+    user.failedLoginAttempts = 0;
+    user.lockUntil = null;
+    const { accessToken, refreshToken } = issueSession(user, req);
+    await user.save();
+    await audit("user.login", req, { email: user.email });
+    res.json({ user: user.toSafeJSON(), accessToken, refreshToken });
+  } catch (err) {
+    next(err);
+  }
+}
+async function refresh(req, res, next) {
+  try {
+    const { refreshToken: token } = req.body;
+    if (!token) return res.status(401).json({ error: "No refresh token provided." });
+    let payload;
+    try {
+      payload = verifyRefreshToken(token);
+    } catch {
+      return res.status(401).json({ error: "Invalid or expired session, please log in again." });
+    }
+    const user = await User.findById(payload.sub).select("+activeRefreshTokens");
+    if (!user || !user.isActive || user.tokenVersion !== payload.tokenVersion) {
+      return res.status(401).json({ error: "Session no longer valid, please log in again." });
+    }
+    const stillActive = (user.activeRefreshTokens || []).some((rt) => rt.jti === payload.jti);
+    if (!stillActive) {
+      // Possible reuse of an already-rotated (or logged-out) refresh
+      // token — deny it. As a precaution, also revoke every other
+      // active session for this account, since a replayed token is a
+      // signal the original may have leaked.
+      user.activeRefreshTokens = [];
+      await user.save();
+      return res.status(401).json({ error: "Session no longer valid, please log in again." });
+    }
+    // Rotate: remove old jti, issue a new refresh token.
+    user.activeRefreshTokens = user.activeRefreshTokens.filter((rt) => rt.jti !== payload.jti);
+    const { accessToken, refreshToken: newRefreshToken } = issueSession(user, req);
+    await user.save();
+    res.json({ accessToken, refreshToken: newRefreshToken, user: user.toSafeJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+async function logout(req, res, next) {
+  try {
+    const { refreshToken: token } = req.body;
+    if (token) {
+      try {
+        const payload = verifyRefreshToken(token);
+        await User.findByIdAndUpdate(payload.sub, { $pull: { activeRefreshTokens: { jti: payload.jti } } });
+      } catch {
+        // token already invalid — nothing to revoke
+      }
+    }
+    res.json({ success: true });
+  } catch (err) {
+    next(err);
+  }
+}
+async function me(req, res) {
+  res.json({ user: req.user.toSafeJSON() });
+}
+module.exports = { signup, login, refresh, logout, me };

src/controllers/content.controller.js CHANGED Viewed

@@ -1,278 +1,278 @@
-const fs = require("fs/promises");
-const mongoose = require("mongoose");
-const Course = require("../models/Course");
-const AuditLog = require("../models/AuditLog");
-const { uploadFromPath, deleteAsset, getSignedPlaybackUrl, resourceTypeForMimetype } = require("../utils/cloudinaryUpload");
-const logger = require("../utils/logger");
-function userHasAccess(user, courseId) {
-  if (!user) return false;
-  if (user.role === "admin") return true;
-  return user.hasAccessToCourse(courseId);
-}
-// ---------------------------------------------------------------------
-// Learner-facing: view curriculum structure, and request a signed,
-// time-limited playback URL for one lesson at a time.
-// ---------------------------------------------------------------------
-async function getCourseCurriculum(req, res, next) {
-  try {
-    const course = await Course.findById(req.params.id);
-    if (!course || !course.isPublished) return res.status(404).json({ error: "Course not found." });
-    const hasAccess = userHasAccess(req.user, course._id);
-    res.json({
-      courseId: course._id,
-      title: course.title,
-      hasAccess,
-      curriculum: hasAccess ? course.toCurriculumJSON() : course.toLockedCurriculumJSON(),
-    });
-  } catch (err) {
-    next(err);
-  }
-}
-async function getLessonAccess(req, res, next) {
-  try {
-    const { id: courseId, sectionId, lessonId } = req.params;
-    const course = await Course.findById(courseId);
-    if (!course || !course.isPublished) return res.status(404).json({ error: "Course not found." });
-    const section = course.curriculum.id(sectionId);
-    const lesson = section?.lessons.id(lessonId);
-    if (!section || !lesson) return res.status(404).json({ error: "Lesson not found." });
-    const hasAccess = userHasAccess(req.user, course._id);
-    if (!hasAccess && !lesson.isPreview) {
-      return res.status(403).json({ error: "Purchase this course to access this lesson." });
-    }
-    const { url, expiresAt } = getSignedPlaybackUrl(lesson.cloudinaryPublicId, lesson.cloudinaryResourceType, {
-      format: lesson.format,
-    });
-    await AuditLog.create({
-      actor: req.user._id,
-      actorEmail: req.user.email,
-      action: "lesson.access_granted",
-      targetType: "Lesson",
-      targetId: lesson._id,
-      ip: req.ip,
-      userAgent: req.headers["user-agent"],
-      metadata: { courseId: course._id.toString() },
-    });
-    res.json({
-      url,
-      expiresAt,
-      type: lesson.type,
-      title: lesson.title,
-    });
-  } catch (err) {
-    next(err);
-  }
-}
-// ---------------------------------------------------------------------
-// Admin-only: manage curriculum structure and upload content to
-// Cloudinary. No learner-facing route ever exposes an upload capability.
-// ---------------------------------------------------------------------
-async function createSection(req, res, next) {
-  try {
-    const { title } = req.body;
-    const course = await Course.findById(req.params.id);
-    if (!course) return res.status(404).json({ error: "Course not found." });
-    const order = course.curriculum.length;
-    course.curriculum.push({ title, order, lessons: [] });
-    await course.save();
-    res.status(201).json({ curriculum: course.toCurriculumJSON() });
-  } catch (err) {
-    next(err);
-  }
-}
-async function updateSection(req, res, next) {
-  try {
-    const { title, order } = req.body;
-    const course = await Course.findById(req.params.id);
-    if (!course) return res.status(404).json({ error: "Course not found." });
-    const section = course.curriculum.id(req.params.sectionId);
-    if (!section) return res.status(404).json({ error: "Section not found." });
-    if (title !== undefined) section.title = title;
-    if (order !== undefined) section.order = order;
-    await course.save();
-    res.json({ curriculum: course.toCurriculumJSON() });
-  } catch (err) {
-    next(err);
-  }
-}
-async function deleteSection(req, res, next) {
-  try {
-    const course = await Course.findById(req.params.id);
-    if (!course) return res.status(404).json({ error: "Course not found." });
-    const section = course.curriculum.id(req.params.sectionId);
-    if (!section) return res.status(404).json({ error: "Section not found." });
-    // Clean up every Cloudinary asset in this section before removing it.
-    await Promise.all(
-      section.lessons.map((lesson) =>
-        deleteAsset(lesson.cloudinaryPublicId, lesson.cloudinaryResourceType).catch((err) =>
-          logger.error("Failed to delete Cloudinary asset", { error: err.message, lessonId: lesson._id.toString() })
-        )
-      )
-    );
-    section.deleteOne();
-    await course.save();
-    res.json({ curriculum: course.toCurriculumJSON() });
-  } catch (err) {
-    next(err);
-  }
-}
-async function uploadLesson(req, res, next) {
-  const tempFilePath = req.file?.path;
-  try {
-    const { title, description, isPreview, order } = req.body;
-    if (!req.file) return res.status(400).json({ error: "A file is required." });
-    const course = await Course.findById(req.params.id);
-    if (!course) return res.status(404).json({ error: "Course not found." });
-    const section = course.curriculum.id(req.params.sectionId);
-    if (!section) return res.status(404).json({ error: "Section not found." });
-    const resourceType = resourceTypeForMimetype(req.file.mimetype);
-    const lessonType = resourceType === "video" ? "video" : "document";
-    const result = await uploadFromPath(tempFilePath, {
-      resourceType,
-      filenameHint: title,
-    });
-    section.lessons.push({
-      title,
-      description: description || "",
-      type: lessonType,
-      order: order !== undefined ? Number(order) : section.lessons.length,
-      isPreview: isPreview === "true" || isPreview === true,
-      cloudinaryPublicId: result.public_id,
-      cloudinaryResourceType: result.resource_type,
-      format: result.format || "",
-      bytes: result.bytes || 0,
-      durationSeconds: result.duration ? Math.round(result.duration) : 0,
-    });
-    await course.save();
-    await AuditLog.create({
-      actor: req.user._id,
-      actorEmail: req.user.email,
-      action: "admin.lesson_uploaded",
-      targetType: "Course",
-      targetId: course._id,
-      ip: req.ip,
-      userAgent: req.headers["user-agent"],
-      metadata: { sectionId: section._id.toString(), title },
-    });
-    res.status(201).json({ curriculum: course.toCurriculumJSON() });
-  } catch (err) {
-    next(err);
-  } finally {
-    // Always clean up the local temp file, whether the upload succeeded,
-    // failed partway, or Cloudinary itself errored out.
-    if (tempFilePath) {
-      fs.unlink(tempFilePath).catch((err) =>
-        logger.error("Failed to remove temp upload file", { error: err.message, tempFilePath })
-      );
-    }
-  }
-}
-async function updateLesson(req, res, next) {
-  try {
-    const { title, description, isPreview, order } = req.body;
-    const course = await Course.findById(req.params.id);
-    if (!course) return res.status(404).json({ error: "Course not found." });
-    const section = course.curriculum.id(req.params.sectionId);
-    const lesson = section?.lessons.id(req.params.lessonId);
-    if (!section || !lesson) return res.status(404).json({ error: "Lesson not found." });
-    if (title !== undefined) lesson.title = title;
-    if (description !== undefined) lesson.description = description;
-    if (isPreview !== undefined) lesson.isPreview = isPreview === "true" || isPreview === true;
-    if (order !== undefined) lesson.order = Number(order);
-    await course.save();
-    res.json({ curriculum: course.toCurriculumJSON() });
-  } catch (err) {
-    next(err);
-  }
-}
-async function deleteLesson(req, res, next) {
-  try {
-    const course = await Course.findById(req.params.id);
-    if (!course) return res.status(404).json({ error: "Course not found." });
-    const section = course.curriculum.id(req.params.sectionId);
-    const lesson = section?.lessons.id(req.params.lessonId);
-    if (!section || !lesson) return res.status(404).json({ error: "Lesson not found." });
-    await deleteAsset(lesson.cloudinaryPublicId, lesson.cloudinaryResourceType).catch((err) =>
-      logger.error("Failed to delete Cloudinary asset", { error: err.message })
-    );
-    lesson.deleteOne();
-    await course.save();
-    await AuditLog.create({
-      actor: req.user._id,
-      actorEmail: req.user.email,
-      action: "admin.lesson_deleted",
-      targetType: "Course",
-      targetId: course._id,
-      ip: req.ip,
-      userAgent: req.headers["user-agent"],
-    });
-    res.json({ curriculum: course.toCurriculumJSON() });
-  } catch (err) {
-    next(err);
-  }
-}
-/** Admin editing view: full curriculum, same shape as the learner view (no raw Cloudinary IDs sent to the browser here either — uploads/deletes are the only mutating ops, playback still goes through the signed-URL endpoint). */
-async function getCourseCurriculumForAdmin(req, res, next) {
-  try {
-    const course = await Course.findById(req.params.id);
-    if (!course) return res.status(404).json({ error: "Course not found." });
-    res.json({ courseId: course._id, title: course.title, curriculum: course.toCurriculumJSON() });
-  } catch (err) {
-    next(err);
-  }
-}
-module.exports = {
-  getCourseCurriculum,
-  getLessonAccess,
-  getCourseCurriculumForAdmin,
-  createSection,
-  updateSection,
-  deleteSection,
-  uploadLesson,
-  updateLesson,
-  deleteLesson,
-};

+const fs = require("fs/promises");
+const mongoose = require("mongoose");
+const Course = require("../models/Course");
+const AuditLog = require("../models/AuditLog");
+const { uploadFromPath, deleteAsset, getSignedPlaybackUrl, resourceTypeForMimetype } = require("../utils/cloudinaryUpload");
+const logger = require("../utils/logger");
+function userHasAccess(user, courseId) {
+  if (!user) return false;
+  if (user.role === "admin") return true;
+  return user.hasAccessToCourse(courseId);
+}
+// ---------------------------------------------------------------------
+// Learner-facing: view curriculum structure, and request a signed,
+// time-limited playback URL for one lesson at a time.
+// ---------------------------------------------------------------------
+async function getCourseCurriculum(req, res, next) {
+  try {
+    const course = await Course.findById(req.params.id);
+    if (!course || !course.isPublished) return res.status(404).json({ error: "Course not found." });
+    const hasAccess = userHasAccess(req.user, course._id);
+    res.json({
+      courseId: course._id,
+      title: course.title,
+      hasAccess,
+      curriculum: hasAccess ? course.toCurriculumJSON() : course.toLockedCurriculumJSON(),
+    });
+  } catch (err) {
+    next(err);
+  }
+}
+async function getLessonAccess(req, res, next) {
+  try {
+    const { id: courseId, sectionId, lessonId } = req.params;
+    const course = await Course.findById(courseId);
+    if (!course || !course.isPublished) return res.status(404).json({ error: "Course not found." });
+    const section = course.curriculum.id(sectionId);
+    const lesson = section?.lessons.id(lessonId);
+    if (!section || !lesson) return res.status(404).json({ error: "Lesson not found." });
+    const hasAccess = userHasAccess(req.user, course._id);
+    if (!hasAccess && !lesson.isPreview) {
+      return res.status(403).json({ error: "Purchase this course to access this lesson." });
+    }
+    const { url, expiresAt } = getSignedPlaybackUrl(lesson.cloudinaryPublicId, lesson.cloudinaryResourceType, {
+      format: lesson.format,
+    });
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "lesson.access_granted",
+      targetType: "Lesson",
+      targetId: lesson._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: { courseId: course._id.toString() },
+    });
+    res.json({
+      url,
+      expiresAt,
+      type: lesson.type,
+      title: lesson.title,
+    });
+  } catch (err) {
+    next(err);
+  }
+}
+// ---------------------------------------------------------------------
+// Admin-only: manage curriculum structure and upload content to
+// Cloudinary. No learner-facing route ever exposes an upload capability.
+// ---------------------------------------------------------------------
+async function createSection(req, res, next) {
+  try {
+    const { title } = req.body;
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    const order = course.curriculum.length;
+    course.curriculum.push({ title, order, lessons: [] });
+    await course.save();
+    res.status(201).json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+async function updateSection(req, res, next) {
+  try {
+    const { title, order } = req.body;
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    const section = course.curriculum.id(req.params.sectionId);
+    if (!section) return res.status(404).json({ error: "Section not found." });
+    if (title !== undefined) section.title = title;
+    if (order !== undefined) section.order = order;
+    await course.save();
+    res.json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+async function deleteSection(req, res, next) {
+  try {
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    const section = course.curriculum.id(req.params.sectionId);
+    if (!section) return res.status(404).json({ error: "Section not found." });
+    // Clean up every Cloudinary asset in this section before removing it.
+    await Promise.all(
+      section.lessons.map((lesson) =>
+        deleteAsset(lesson.cloudinaryPublicId, lesson.cloudinaryResourceType).catch((err) =>
+          logger.error("Failed to delete Cloudinary asset", { error: err.message, lessonId: lesson._id.toString() })
+        )
+      )
+    );
+    section.deleteOne();
+    await course.save();
+    res.json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+async function uploadLesson(req, res, next) {
+  const tempFilePath = req.file?.path;
+  try {
+    const { title, description, isPreview, order } = req.body;
+    if (!req.file) return res.status(400).json({ error: "A file is required." });
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    const section = course.curriculum.id(req.params.sectionId);
+    if (!section) return res.status(404).json({ error: "Section not found." });
+    const resourceType = resourceTypeForMimetype(req.file.mimetype);
+    const lessonType = resourceType === "video" ? "video" : "document";
+    const result = await uploadFromPath(tempFilePath, {
+      resourceType,
+      filenameHint: title,
+    });
+    section.lessons.push({
+      title,
+      description: description || "",
+      type: lessonType,
+      order: order !== undefined ? Number(order) : section.lessons.length,
+      isPreview: isPreview === "true" || isPreview === true,
+      cloudinaryPublicId: result.public_id,
+      cloudinaryResourceType: result.resource_type,
+      format: result.format || "",
+      bytes: result.bytes || 0,
+      durationSeconds: result.duration ? Math.round(result.duration) : 0,
+    });
+    await course.save();
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "admin.lesson_uploaded",
+      targetType: "Course",
+      targetId: course._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: { sectionId: section._id.toString(), title },
+    });
+    res.status(201).json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  } finally {
+    // Always clean up the local temp file, whether the upload succeeded,
+    // failed partway, or Cloudinary itself errored out.
+    if (tempFilePath) {
+      fs.unlink(tempFilePath).catch((err) =>
+        logger.error("Failed to remove temp upload file", { error: err.message, tempFilePath })
+      );
+    }
+  }
+}
+async function updateLesson(req, res, next) {
+  try {
+    const { title, description, isPreview, order } = req.body;
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    const section = course.curriculum.id(req.params.sectionId);
+    const lesson = section?.lessons.id(req.params.lessonId);
+    if (!section || !lesson) return res.status(404).json({ error: "Lesson not found." });
+    if (title !== undefined) lesson.title = title;
+    if (description !== undefined) lesson.description = description;
+    if (isPreview !== undefined) lesson.isPreview = isPreview === "true" || isPreview === true;
+    if (order !== undefined) lesson.order = Number(order);
+    await course.save();
+    res.json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+async function deleteLesson(req, res, next) {
+  try {
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    const section = course.curriculum.id(req.params.sectionId);
+    const lesson = section?.lessons.id(req.params.lessonId);
+    if (!section || !lesson) return res.status(404).json({ error: "Lesson not found." });
+    await deleteAsset(lesson.cloudinaryPublicId, lesson.cloudinaryResourceType).catch((err) =>
+      logger.error("Failed to delete Cloudinary asset", { error: err.message })
+    );
+    lesson.deleteOne();
+    await course.save();
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "admin.lesson_deleted",
+      targetType: "Course",
+      targetId: course._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+    });
+    res.json({ curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+/** Admin editing view: full curriculum, same shape as the learner view (no raw Cloudinary IDs sent to the browser here either — uploads/deletes are the only mutating ops, playback still goes through the signed-URL endpoint). */
+async function getCourseCurriculumForAdmin(req, res, next) {
+  try {
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    res.json({ courseId: course._id, title: course.title, curriculum: course.toCurriculumJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+module.exports = {
+  getCourseCurriculum,
+  getLessonAccess,
+  getCourseCurriculumForAdmin,
+  createSection,
+  updateSection,
+  deleteSection,
+  uploadLesson,
+  updateLesson,
+  deleteLesson,
+};

src/controllers/course.controller.js CHANGED Viewed

@@ -1,56 +1,56 @@
-const Course = require("../models/Course");
-async function listCourses(req, res, next) {
-  try {
-    const filter = req.user?.role === "admin" ? {} : { isPublished: true };
-    const courses = await Course.find(filter).sort({ createdAt: 1 });
-    res.json({ courses });
-  } catch (err) {
-    next(err);
-  }
-}
-async function getCourse(req, res, next) {
-  try {
-    const course = await Course.findById(req.params.id);
-    if (!course) return res.status(404).json({ error: "Course not found." });
-    res.json({ course });
-  } catch (err) {
-    next(err);
-  }
-}
-async function createCourse(req, res, next) {
-  try {
-    const course = await Course.create(req.body);
-    res.status(201).json({ course });
-  } catch (err) {
-    if (err.code === 11000) return res.status(409).json({ error: "A course with this slug already exists." });
-    next(err);
-  }
-}
-async function updateCourse(req, res, next) {
-  try {
-    const course = await Course.findByIdAndUpdate(req.params.id, req.body, {
-      new: true,
-      runValidators: true,
-    });
-    if (!course) return res.status(404).json({ error: "Course not found." });
-    res.json({ course });
-  } catch (err) {
-    next(err);
-  }
-}
-async function deleteCourse(req, res, next) {
-  try {
-    const course = await Course.findByIdAndUpdate(req.params.id, { isPublished: false }, { new: true });
-    if (!course) return res.status(404).json({ error: "Course not found." });
-    res.json({ success: true });
-  } catch (err) {
-    next(err);
-  }
-}
-module.exports = { listCourses, getCourse, createCourse, updateCourse, deleteCourse };

+const Course = require("../models/Course");
+async function listCourses(req, res, next) {
+  try {
+    const filter = req.user?.role === "admin" ? {} : { isPublished: true };
+    const courses = await Course.find(filter).sort({ createdAt: 1 });
+    res.json({ courses });
+  } catch (err) {
+    next(err);
+  }
+}
+async function getCourse(req, res, next) {
+  try {
+    const course = await Course.findById(req.params.id);
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    res.json({ course });
+  } catch (err) {
+    next(err);
+  }
+}
+async function createCourse(req, res, next) {
+  try {
+    const course = await Course.create(req.body);
+    res.status(201).json({ course });
+  } catch (err) {
+    if (err.code === 11000) return res.status(409).json({ error: "A course with this slug already exists." });
+    next(err);
+  }
+}
+async function updateCourse(req, res, next) {
+  try {
+    const course = await Course.findByIdAndUpdate(req.params.id, req.body, {
+      new: true,
+      runValidators: true,
+    });
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    res.json({ course });
+  } catch (err) {
+    next(err);
+  }
+}
+async function deleteCourse(req, res, next) {
+  try {
+    const course = await Course.findByIdAndUpdate(req.params.id, { isPublished: false }, { new: true });
+    if (!course) return res.status(404).json({ error: "Course not found." });
+    res.json({ success: true });
+  } catch (err) {
+    next(err);
+  }
+}
+module.exports = { listCourses, getCourse, createCourse, updateCourse, deleteCourse };

src/controllers/order.controller.js CHANGED Viewed

@@ -1,161 +1,161 @@
-const mongoose = require("mongoose");
-const Order = require("../models/Order");
-const Course = require("../models/Course");
-const AuditLog = require("../models/AuditLog");
-const { generateOrderNumber } = require("../utils/orderNumber");
-const { env } = require("../config/env");
-const { sendOrderPlacedEmail, sendAdminNewOrderAlert } = require("../utils/email");
-const logger = require("../utils/logger");
-/**
- * Public checkout configuration — payment instructions shown on the
- * frontend before the customer submits their reference number. No
- * secrets here, just receiving-account details that are meant to be
- * shared with paying customers.
- */
-function getPaymentOptions(req, res) {
-  res.json({
-    bankWire: {
-      currency: "USD",
-      bankName: env.bank.name,
-      accountName: env.bank.accountName,
-      accountNumber: env.bank.accountNumber,
-      routingNumber: env.bank.routingNumber,
-      swiftBic: env.bank.swiftBic,
-      iban: env.bank.iban || undefined,
-      address: env.bank.address,
-    },
-    payoneer: {
-      accountEmail: env.payoneer.accountEmail,
-      paymentUrl: env.payoneer.paymentUrl,
-    },
-  });
-}
-async function createOrder(req, res, next) {
-  try {
-    const { courseId, paymentMethod } = req.body;
-    if (!mongoose.isValidObjectId(courseId)) {
-      return res.status(400).json({ error: "Invalid course selected." });
-    }
-    const course = await Course.findById(courseId);
-    if (!course || !course.isPublished) {
-      return res.status(404).json({ error: "Course not found or unavailable." });
-    }
-    if (req.user.hasAccessToCourse(course._id)) {
-      return res.status(409).json({ error: "You already have access to this course." });
-    }
-    // Prevent duplicate open orders for the same course by the same user.
-    const existingOpenOrder = await Order.findOne({
-      user: req.user._id,
-      course: course._id,
-      status: { $in: ["pending_payment", "awaiting_confirmation"] },
-    });
-    if (existingOpenOrder) {
-      return res.status(200).json({ order: existingOpenOrder.toPublicJSON(), reused: true });
-    }
-    const order = new Order({
-      orderNumber: generateOrderNumber(),
-      user: req.user._id,
-      course: course._id,
-      courseTitleSnapshot: course.title,
-      amount: course.price,
-      currency: course.currency || "USD",
-      paymentMethod,
-      status: "awaiting_confirmation",
-    });
-    await order.save();
-    await AuditLog.create({
-      actor: req.user._id,
-      actorEmail: req.user.email,
-      action: "order.created",
-      targetType: "Order",
-      targetId: order._id,
-      ip: req.ip,
-      userAgent: req.headers["user-agent"],
-      metadata: { courseId: course._id.toString(), paymentMethod },
-    });
-    // Fire-and-forget emails; failures are logged but never block checkout.
-    sendOrderPlacedEmail({
-      to: req.user.email,
-      name: req.user.name,
-      order,
-      courseTitle: course.title,
-      bankDetails: env.bank,
-      payoneerDetails: env.payoneer,
-    })
-      .then(() => {
-        order.confirmationEmailSentAt = new Date();
-        return order.save();
-      })
-      .catch((err) => logger.error("Order confirmation email failed", { error: err.message }));
-    sendAdminNewOrderAlert({ order, courseTitle: course.title, customerEmail: req.user.email }).catch((err) =>
-      logger.error("Admin new-order alert failed", { error: err.message })
-    );
-    res.status(201).json({ order: order.toPublicJSON() });
-  } catch (err) {
-    next(err);
-  }
-}
-/** Customer submits their bank wire reference / Payoneer transaction ID after paying. */
-async function submitPaymentProof(req, res, next) {
-  try {
-    const { reference, note } = req.body;
-    const order = await Order.findOne({ _id: req.params.id, user: req.user._id });
-    if (!order) return res.status(404).json({ error: "Order not found." });
-    if (!["pending_payment", "awaiting_confirmation"].includes(order.status)) {
-      return res.status(409).json({ error: "This order can no longer be updated." });
-    }
-    order.setPaymentReference(reference);
-    if (note) order.setPayerNote(note);
-    order.status = "awaiting_confirmation";
-    await order.save();
-    await AuditLog.create({
-      actor: req.user._id,
-      actorEmail: req.user.email,
-      action: "order.payment_proof_submitted",
-      targetType: "Order",
-      targetId: order._id,
-      ip: req.ip,
-      userAgent: req.headers["user-agent"],
-    });
-    res.json({ order: order.toPublicJSON() });
-  } catch (err) {
-    next(err);
-  }
-}
-async function listMyOrders(req, res, next) {
-  try {
-    const orders = await Order.find({ user: req.user._id }).sort({ createdAt: -1 });
-    res.json({ orders: orders.map((o) => o.toPublicJSON()) });
-  } catch (err) {
-    next(err);
-  }
-}
-async function getMyOrder(req, res, next) {
-  try {
-    const order = await Order.findOne({ _id: req.params.id, user: req.user._id });
-    if (!order) return res.status(404).json({ error: "Order not found." });
-    res.json({ order: order.toPublicJSON({ includeSensitive: true }) });
-  } catch (err) {
-    next(err);
-  }
-}
-module.exports = { getPaymentOptions, createOrder, submitPaymentProof, listMyOrders, getMyOrder };

+const mongoose = require("mongoose");
+const Order = require("../models/Order");
+const Course = require("../models/Course");
+const AuditLog = require("../models/AuditLog");
+const { generateOrderNumber } = require("../utils/orderNumber");
+const { env } = require("../config/env");
+const { sendOrderPlacedEmail, sendAdminNewOrderAlert } = require("../utils/email");
+const logger = require("../utils/logger");
+/**
+ * Public checkout configuration — payment instructions shown on the
+ * frontend before the customer submits their reference number. No
+ * secrets here, just receiving-account details that are meant to be
+ * shared with paying customers.
+ */
+function getPaymentOptions(req, res) {
+  res.json({
+    bankWire: {
+      currency: "USD",
+      bankName: env.bank.name,
+      accountName: env.bank.accountName,
+      accountNumber: env.bank.accountNumber,
+      routingNumber: env.bank.routingNumber,
+      swiftBic: env.bank.swiftBic,
+      iban: env.bank.iban || undefined,
+      address: env.bank.address,
+    },
+    payoneer: {
+      accountEmail: env.payoneer.accountEmail,
+      paymentUrl: env.payoneer.paymentUrl,
+    },
+  });
+}
+async function createOrder(req, res, next) {
+  try {
+    const { courseId, paymentMethod } = req.body;
+    if (!mongoose.isValidObjectId(courseId)) {
+      return res.status(400).json({ error: "Invalid course selected." });
+    }
+    const course = await Course.findById(courseId);
+    if (!course || !course.isPublished) {
+      return res.status(404).json({ error: "Course not found or unavailable." });
+    }
+    if (req.user.hasAccessToCourse(course._id)) {
+      return res.status(409).json({ error: "You already have access to this course." });
+    }
+    // Prevent duplicate open orders for the same course by the same user.
+    const existingOpenOrder = await Order.findOne({
+      user: req.user._id,
+      course: course._id,
+      status: { $in: ["pending_payment", "awaiting_confirmation"] },
+    });
+    if (existingOpenOrder) {
+      return res.status(200).json({ order: existingOpenOrder.toPublicJSON(), reused: true });
+    }
+    const order = new Order({
+      orderNumber: generateOrderNumber(),
+      user: req.user._id,
+      course: course._id,
+      courseTitleSnapshot: course.title,
+      amount: course.price,
+      currency: course.currency || "USD",
+      paymentMethod,
+      status: "awaiting_confirmation",
+    });
+    await order.save();
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "order.created",
+      targetType: "Order",
+      targetId: order._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+      metadata: { courseId: course._id.toString(), paymentMethod },
+    });
+    // Fire-and-forget emails; failures are logged but never block checkout.
+    sendOrderPlacedEmail({
+      to: req.user.email,
+      name: req.user.name,
+      order,
+      courseTitle: course.title,
+      bankDetails: env.bank,
+      payoneerDetails: env.payoneer,
+    })
+      .then(() => {
+        order.confirmationEmailSentAt = new Date();
+        return order.save();
+      })
+      .catch((err) => logger.error("Order confirmation email failed", { error: err.message }));
+    sendAdminNewOrderAlert({ order, courseTitle: course.title, customerEmail: req.user.email }).catch((err) =>
+      logger.error("Admin new-order alert failed", { error: err.message })
+    );
+    res.status(201).json({ order: order.toPublicJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+/** Customer submits their bank wire reference / Payoneer transaction ID after paying. */
+async function submitPaymentProof(req, res, next) {
+  try {
+    const { reference, note } = req.body;
+    const order = await Order.findOne({ _id: req.params.id, user: req.user._id });
+    if (!order) return res.status(404).json({ error: "Order not found." });
+    if (!["pending_payment", "awaiting_confirmation"].includes(order.status)) {
+      return res.status(409).json({ error: "This order can no longer be updated." });
+    }
+    order.setPaymentReference(reference);
+    if (note) order.setPayerNote(note);
+    order.status = "awaiting_confirmation";
+    await order.save();
+    await AuditLog.create({
+      actor: req.user._id,
+      actorEmail: req.user.email,
+      action: "order.payment_proof_submitted",
+      targetType: "Order",
+      targetId: order._id,
+      ip: req.ip,
+      userAgent: req.headers["user-agent"],
+    });
+    res.json({ order: order.toPublicJSON() });
+  } catch (err) {
+    next(err);
+  }
+}
+async function listMyOrders(req, res, next) {
+  try {
+    const orders = await Order.find({ user: req.user._id }).sort({ createdAt: -1 });
+    res.json({ orders: orders.map((o) => o.toPublicJSON()) });
+  } catch (err) {
+    next(err);
+  }
+}
+async function getMyOrder(req, res, next) {
+  try {
+    const order = await Order.findOne({ _id: req.params.id, user: req.user._id });
+    if (!order) return res.status(404).json({ error: "Order not found." });
+    res.json({ order: order.toPublicJSON({ includeSensitive: true }) });
+  } catch (err) {
+    next(err);
+  }
+}
+module.exports = { getPaymentOptions, createOrder, submitPaymentProof, listMyOrders, getMyOrder };

src/middleware/auth.js CHANGED Viewed

@@ -1,45 +1,45 @@
-const { verifyAccessToken } = require("../utils/jwt");
-const User = require("../models/User");
-/**
- * Requires a valid, non-expired access token in the Authorization header.
- * Attaches the full (fresh) user document to req.user so downstream
- * handlers always see current role/lock/tokenVersion state rather than
- * trusting stale claims baked into the JWT.
- */
-async function requireAuth(req, res, next) {
-  try {
-    const header = req.headers.authorization || "";
-    const [scheme, token] = header.split(" ");
-    if (scheme !== "Bearer" || !token) {
-      return res.status(401).json({ error: "Authentication required." });
-    }
-    const payload = verifyAccessToken(token);
-    const user = await User.findById(payload.sub);
-    if (!user || !user.isActive) {
-      return res.status(401).json({ error: "Account not found or disabled." });
-    }
-    if (user.tokenVersion !== payload.tokenVersion) {
-      // Token was issued before a password change / forced logout.
-      return res.status(401).json({ error: "Session expired, please log in again." });
-    }
-    req.user = user;
-    next();
-  } catch (err) {
-    return res.status(401).json({ error: "Invalid or expired token." });
-  }
-}
-function requireRole(...roles) {
-  return (req, res, next) => {
-    if (!req.user || !roles.includes(req.user.role)) {
-      return res.status(403).json({ error: "You do not have permission to perform this action." });
-    }
-    next();
-  };
-}
-module.exports = { requireAuth, requireRole };

+const { verifyAccessToken } = require("../utils/jwt");
+const User = require("../models/User");
+/**
+ * Requires a valid, non-expired access token in the Authorization header.
+ * Attaches the full (fresh) user document to req.user so downstream
+ * handlers always see current role/lock/tokenVersion state rather than
+ * trusting stale claims baked into the JWT.
+ */
+async function requireAuth(req, res, next) {
+  try {
+    const header = req.headers.authorization || "";
+    const [scheme, token] = header.split(" ");
+    if (scheme !== "Bearer" || !token) {
+      return res.status(401).json({ error: "Authentication required." });
+    }
+    const payload = verifyAccessToken(token);
+    const user = await User.findById(payload.sub);
+    if (!user || !user.isActive) {
+      return res.status(401).json({ error: "Account not found or disabled." });
+    }
+    if (user.tokenVersion !== payload.tokenVersion) {
+      // Token was issued before a password change / forced logout.
+      return res.status(401).json({ error: "Session expired, please log in again." });
+    }
+    req.user = user;
+    next();
+  } catch (err) {
+    return res.status(401).json({ error: "Invalid or expired token." });
+  }
+}
+function requireRole(...roles) {
+  return (req, res, next) => {
+    if (!req.user || !roles.includes(req.user.role)) {
+      return res.status(403).json({ error: "You do not have permission to perform this action." });
+    }
+    next();
+  };
+}
+module.exports = { requireAuth, requireRole };

src/middleware/errorHandler.js CHANGED Viewed

@@ -1,33 +1,33 @@
-const logger = require("../utils/logger");
-// eslint-disable-next-line no-unused-vars
-function errorHandler(err, req, res, next) {
-  let status = err.status || 500;
-  // Multer surfaces file-size/type problems as plain Errors/MulterErrors
-  // without a status code — treat those as client errors (400), not
-  // server failures.
-  if (err.name === "MulterError" || /Unsupported file type/.test(err.message || "")) {
-    status = 400;
-  }
-  logger.error("Unhandled error", {
-    message: err.message,
-    status,
-    path: req.path,
-    method: req.method,
-    // stack only ever goes to server-side logs, never to the client
-    stack: err.stack,
-  });
-  const isProd = process.env.NODE_ENV === "production";
-  res.status(status).json({
-    error: status === 500 && isProd ? "Something went wrong. Please try again later." : err.message,
-  });
-}
-function notFound(req, res) {
-  res.status(404).json({ error: "Not found." });
-}
-module.exports = { errorHandler, notFound };

+const logger = require("../utils/logger");
+// eslint-disable-next-line no-unused-vars
+function errorHandler(err, req, res, next) {
+  let status = err.status || 500;
+  // Multer surfaces file-size/type problems as plain Errors/MulterErrors
+  // without a status code — treat those as client errors (400), not
+  // server failures.
+  if (err.name === "MulterError" || /Unsupported file type/.test(err.message || "")) {
+    status = 400;
+  }
+  logger.error("Unhandled error", {
+    message: err.message,
+    status,
+    path: req.path,
+    method: req.method,
+    // stack only ever goes to server-side logs, never to the client
+    stack: err.stack,
+  });
+  const isProd = process.env.NODE_ENV === "production";
+  res.status(status).json({
+    error: status === 500 && isProd ? "Something went wrong. Please try again later." : err.message,
+  });
+}
+function notFound(req, res) {
+  res.status(404).json({ error: "Not found." });
+}
+module.exports = { errorHandler, notFound };

src/middleware/rateLimiters.js CHANGED Viewed

@@ -1,31 +1,31 @@
-const rateLimit = require("express-rate-limit");
-// General API traffic
-const apiLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  limit: 300,
-  standardHeaders: true,
-  legacyHeaders: false,
-  message: { error: "Too many requests, please try again later." },
-});
-// Tight limits on auth endpoints to blunt credential stuffing / brute force
-const authLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  limit: 10,
-  standardHeaders: true,
-  legacyHeaders: false,
-  skipSuccessfulRequests: true,
-  message: { error: "Too many attempts. Please wait a few minutes and try again." },
-});
-// Checkout/order creation limiter to prevent order-spam / enumeration
-const orderLimiter = rateLimit({
-  windowMs: 60 * 60 * 1000,
-  limit: 20,
-  standardHeaders: true,
-  legacyHeaders: false,
-  message: { error: "Too many order attempts. Please try again later or contact support." },
-});
-module.exports = { apiLimiter, authLimiter, orderLimiter };

+const rateLimit = require("express-rate-limit");
+// General API traffic
+const apiLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  limit: 300,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: "Too many requests, please try again later." },
+});
+// Tight limits on auth endpoints to blunt credential stuffing / brute force
+const authLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  limit: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  skipSuccessfulRequests: true,
+  message: { error: "Too many attempts. Please wait a few minutes and try again." },
+});
+// Checkout/order creation limiter to prevent order-spam / enumeration
+const orderLimiter = rateLimit({
+  windowMs: 60 * 60 * 1000,
+  limit: 20,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: "Too many order attempts. Please try again later or contact support." },
+});
+module.exports = { apiLimiter, authLimiter, orderLimiter };

src/middleware/upload.js CHANGED Viewed

@@ -1,50 +1,50 @@
-const multer = require("multer");
-const os = require("os");
-const path = require("path");
-const crypto = require("crypto");
-// Only the file types actually needed for course content are allowed.
-// Uploads are only ever accepted from an authenticated admin (enforced
-// in the route, not here), but validating the mimetype/extension server-
-// side is still essential since a client can lie about content-type.
-const ALLOWED_MIMETYPES = new Set([
-  "video/mp4",
-  "video/webm",
-  "video/quicktime",
-  "application/pdf",
-  "application/msword",
-  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  "application/vnd.ms-powerpoint",
-  "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  "image/png",
-  "image/jpeg",
-  "image/webp",
-]);
-const MAX_FILE_SIZE_BYTES = 500 * 1024 * 1024; // 500MB — generous for course videos on Cloudinary's free tier
-// Files are streamed to a temp file on disk rather than buffered in
-// memory: buffering large videos in RAM can exhaust the memory limit on
-// small/free-tier hosts (e.g. a 512MB instance) well before hitting the
-// 500MB file-size cap. The temp file is deleted right after the upload
-// completes (see content.controller.js), whether it succeeds or fails.
-const storage = multer.diskStorage({
-  destination: (req, file, cb) => cb(null, os.tmpdir()),
-  filename: (req, file, cb) => {
-    const unique = crypto.randomBytes(16).toString("hex");
-    cb(null, `aynwerd-upload-${unique}${path.extname(file.originalname)}`);
-  },
-});
-const upload = multer({
-  storage,
-  limits: { fileSize: MAX_FILE_SIZE_BYTES, files: 1 },
-  fileFilter(req, file, cb) {
-    if (!ALLOWED_MIMETYPES.has(file.mimetype)) {
-      return cb(new Error("Unsupported file type. Allowed: mp4/webm/mov video, pdf, doc(x), ppt(x), png/jpg/webp."));
-    }
-    cb(null, true);
-  },
-});
-module.exports = { upload };

+const multer = require("multer");
+const os = require("os");
+const path = require("path");
+const crypto = require("crypto");
+// Only the file types actually needed for course content are allowed.
+// Uploads are only ever accepted from an authenticated admin (enforced
+// in the route, not here), but validating the mimetype/extension server-
+// side is still essential since a client can lie about content-type.
+const ALLOWED_MIMETYPES = new Set([
+  "video/mp4",
+  "video/webm",
+  "video/quicktime",
+  "application/pdf",
+  "application/msword",
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.ms-powerpoint",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  "image/png",
+  "image/jpeg",
+  "image/webp",
+]);
+const MAX_FILE_SIZE_BYTES = 500 * 1024 * 1024; // 500MB — generous for course videos on Cloudinary's free tier
+// Files are streamed to a temp file on disk rather than buffered in
+// memory: buffering large videos in RAM can exhaust the memory limit on
+// small/free-tier hosts (e.g. a 512MB instance) well before hitting the
+// 500MB file-size cap. The temp file is deleted right after the upload
+// completes (see content.controller.js), whether it succeeds or fails.
+const storage = multer.diskStorage({
+  destination: (req, file, cb) => cb(null, os.tmpdir()),
+  filename: (req, file, cb) => {
+    const unique = crypto.randomBytes(16).toString("hex");
+    cb(null, `aynwerd-upload-${unique}${path.extname(file.originalname)}`);
+  },
+});
+const upload = multer({
+  storage,
+  limits: { fileSize: MAX_FILE_SIZE_BYTES, files: 1 },
+  fileFilter(req, file, cb) {
+    if (!ALLOWED_MIMETYPES.has(file.mimetype)) {
+      return cb(new Error("Unsupported file type. Allowed: mp4/webm/mov video, pdf, doc(x), ppt(x), png/jpg/webp."));
+    }
+    cb(null, true);
+  },
+});
+module.exports = { upload };

src/middleware/validate.js CHANGED Viewed

@@ -1,14 +1,14 @@
-const { validationResult } = require("express-validator");
-function validate(req, res, next) {
-  const errors = validationResult(req);
-  if (!errors.isEmpty()) {
-    return res.status(400).json({
-      error: "Validation failed.",
-      details: errors.array().map((e) => ({ field: e.path, message: e.msg })),
-    });
-  }
-  next();
-}
-module.exports = { validate };

+const { validationResult } = require("express-validator");
+function validate(req, res, next) {
+  const errors = validationResult(req);
+  if (!errors.isEmpty()) {
+    return res.status(400).json({
+      error: "Validation failed.",
+      details: errors.array().map((e) => ({ field: e.path, message: e.msg })),
+    });
+  }
+  next();
+}
+module.exports = { validate };

src/models/AuditLog.js CHANGED Viewed

@@ -1,21 +1,21 @@
-const mongoose = require("mongoose");
-// Immutable-by-convention trail of security-sensitive actions (payment
-// confirmations/rejections, role changes, logins) for accountability and
-// incident investigation. Nothing sensitive (passwords, tokens, full
-// payment references) is ever written here.
-const auditLogSchema = new mongoose.Schema(
-  {
-    actor: { type: mongoose.Schema.Types.ObjectId, ref: "User", default: null },
-    actorEmail: { type: String, default: null },
-    action: { type: String, required: true, index: true },
-    targetType: { type: String, default: null },
-    targetId: { type: mongoose.Schema.Types.ObjectId, default: null },
-    metadata: { type: mongoose.Schema.Types.Mixed, default: {} },
-    ip: { type: String, default: null },
-    userAgent: { type: String, default: null },
-  },
-  { timestamps: true, capped: { size: 50 * 1024 * 1024, max: 200000 } }
-);
-module.exports = mongoose.model("AuditLog", auditLogSchema);

+const mongoose = require("mongoose");
+// Immutable-by-convention trail of security-sensitive actions (payment
+// confirmations/rejections, role changes, logins) for accountability and
+// incident investigation. Nothing sensitive (passwords, tokens, full
+// payment references) is ever written here.
+const auditLogSchema = new mongoose.Schema(
+  {
+    actor: { type: mongoose.Schema.Types.ObjectId, ref: "User", default: null },
+    actorEmail: { type: String, default: null },
+    action: { type: String, required: true, index: true },
+    targetType: { type: String, default: null },
+    targetId: { type: mongoose.Schema.Types.ObjectId, default: null },
+    metadata: { type: mongoose.Schema.Types.Mixed, default: {} },
+    ip: { type: String, default: null },
+    userAgent: { type: String, default: null },
+  },
+  { timestamps: true, capped: { size: 50 * 1024 * 1024, max: 200000 } }
+);
+module.exports = mongoose.model("AuditLog", auditLogSchema);

src/models/Course.js CHANGED Viewed

@@ -1,104 +1,104 @@
-const mongoose = require("mongoose");
-const lessonSchema = new mongoose.Schema(
-  {
-    title: { type: String, required: true, trim: true, maxlength: 200 },
-    description: { type: String, default: "", maxlength: 1000 },
-    type: { type: String, enum: ["video", "document"], required: true },
-    order: { type: Number, default: 0 },
-    // Free preview lessons can be viewed without purchasing the course
-    // (e.g. an intro video) — everything else requires confirmed access.
-    isPreview: { type: Boolean, default: false },
-    // Cloudinary storage details. Uploaded with delivery type
-    // "authenticated" so files can NEVER be fetched by guessing/sharing
-    // the public ID — every playback URL must be freshly signed
-    // server-side (see utils/cloudinaryUpload.js) for a user who is
-    // confirmed to have access. These are plain (selected-by-default)
-    // fields — deliberately NOT using Mongoose's `select: false` here,
-    // because that projection option is unreliable two levels deep
-    // inside an array-of-subdocuments-within-an-array-of-subdocuments
-    // (curriculum[].lessons[].field) across Mongoose versions. The real
-    // security boundary is that every response is built through
-    // toCurriculumJSON()/toLockedCurriculumJSON() below, which simply
-    // never copies these fields into what gets sent to the client.
-    cloudinaryPublicId: { type: String, required: true },
-    cloudinaryResourceType: { type: String, enum: ["video", "raw", "image"], required: true },
-    format: { type: String, default: "" },
-    bytes: { type: Number, default: 0 },
-    durationSeconds: { type: Number, default: 0 },
-  },
-  { timestamps: true }
-);
-const sectionSchema = new mongoose.Schema(
-  {
-    title: { type: String, required: true, trim: true, maxlength: 200 },
-    order: { type: Number, default: 0 },
-    lessons: { type: [lessonSchema], default: [] },
-  },
-  { timestamps: true }
-);
-const courseSchema = new mongoose.Schema(
-  {
-    title: { type: String, required: true, trim: true, maxlength: 200 },
-    slug: { type: String, required: true, unique: true, lowercase: true, trim: true, index: true },
-    price: { type: Number, required: true, min: 0 },
-    currency: { type: String, default: "USD", uppercase: true, minlength: 3, maxlength: 3 },
-    duration: { type: String, required: true, trim: true },
-    level: { type: String, required: true, trim: true },
-    description: { type: String, required: true },
-    image: { type: String, default: "" },
-    highlights: { type: [String], default: [] },
-    isPublished: { type: Boolean, default: true },
-    // Study content, uploaded exclusively by admins (see content.controller.js).
-    curriculum: { type: [sectionSchema], default: [] },
-  },
-  { timestamps: true }
-);
-/** Curriculum view for enrolled users / admins: structure + metadata, no storage internals. */
-courseSchema.methods.toCurriculumJSON = function toCurriculumJSON() {
-  return this.curriculum
-    .slice()
-    .sort((a, b) => a.order - b.order)
-    .map((section) => ({
-      id: section._id,
-      title: section.title,
-      order: section.order,
-      lessons: section.lessons
-        .slice()
-        .sort((a, b) => a.order - b.order)
-        .map((lesson) => ({
-          id: lesson._id,
-          title: lesson.title,
-          description: lesson.description,
-          type: lesson.type,
-          order: lesson.order,
-          isPreview: lesson.isPreview,
-          durationSeconds: lesson.durationSeconds,
-        })),
-    }));
-};
-/** Locked view for logged-in users who have NOT purchased the course: titles only, previews flagged. */
-courseSchema.methods.toLockedCurriculumJSON = function toLockedCurriculumJSON() {
-  return this.toCurriculumJSON().map((section) => ({
-    ...section,
-    lessons: section.lessons.map((lesson) => ({
-      id: lesson.id,
-      title: lesson.title,
-      type: lesson.type,
-      order: lesson.order,
-      isPreview: lesson.isPreview,
-      durationSeconds: lesson.durationSeconds,
-      locked: !lesson.isPreview,
-    })),
-  }));
-};
-module.exports = mongoose.model("Course", courseSchema);

+const mongoose = require("mongoose");
+const lessonSchema = new mongoose.Schema(
+  {
+    title: { type: String, required: true, trim: true, maxlength: 200 },
+    description: { type: String, default: "", maxlength: 1000 },
+    type: { type: String, enum: ["video", "document"], required: true },
+    order: { type: Number, default: 0 },
+    // Free preview lessons can be viewed without purchasing the course
+    // (e.g. an intro video) — everything else requires confirmed access.
+    isPreview: { type: Boolean, default: false },
+    // Cloudinary storage details. Uploaded with delivery type
+    // "authenticated" so files can NEVER be fetched by guessing/sharing
+    // the public ID — every playback URL must be freshly signed
+    // server-side (see utils/cloudinaryUpload.js) for a user who is
+    // confirmed to have access. These are plain (selected-by-default)
+    // fields — deliberately NOT using Mongoose's `select: false` here,
+    // because that projection option is unreliable two levels deep
+    // inside an array-of-subdocuments-within-an-array-of-subdocuments
+    // (curriculum[].lessons[].field) across Mongoose versions. The real
+    // security boundary is that every response is built through
+    // toCurriculumJSON()/toLockedCurriculumJSON() below, which simply
+    // never copies these fields into what gets sent to the client.
+    cloudinaryPublicId: { type: String, required: true },
+    cloudinaryResourceType: { type: String, enum: ["video", "raw", "image"], required: true },
+    format: { type: String, default: "" },
+    bytes: { type: Number, default: 0 },
+    durationSeconds: { type: Number, default: 0 },
+  },
+  { timestamps: true }
+);
+const sectionSchema = new mongoose.Schema(
+  {
+    title: { type: String, required: true, trim: true, maxlength: 200 },
+    order: { type: Number, default: 0 },
+    lessons: { type: [lessonSchema], default: [] },
+  },
+  { timestamps: true }
+);
+const courseSchema = new mongoose.Schema(
+  {
+    title: { type: String, required: true, trim: true, maxlength: 200 },
+    slug: { type: String, required: true, unique: true, lowercase: true, trim: true, index: true },
+    price: { type: Number, required: true, min: 0 },
+    currency: { type: String, default: "USD", uppercase: true, minlength: 3, maxlength: 3 },
+    duration: { type: String, required: true, trim: true },
+    level: { type: String, required: true, trim: true },
+    description: { type: String, required: true },
+    image: { type: String, default: "" },
+    highlights: { type: [String], default: [] },
+    isPublished: { type: Boolean, default: true },
+    // Study content, uploaded exclusively by admins (see content.controller.js).
+    curriculum: { type: [sectionSchema], default: [] },
+  },
+  { timestamps: true }
+);
+/** Curriculum view for enrolled users / admins: structure + metadata, no storage internals. */
+courseSchema.methods.toCurriculumJSON = function toCurriculumJSON() {
+  return this.curriculum
+    .slice()
+    .sort((a, b) => a.order - b.order)
+    .map((section) => ({
+      id: section._id,
+      title: section.title,
+      order: section.order,
+      lessons: section.lessons
+        .slice()
+        .sort((a, b) => a.order - b.order)
+        .map((lesson) => ({
+          id: lesson._id,
+          title: lesson.title,
+          description: lesson.description,
+          type: lesson.type,
+          order: lesson.order,
+          isPreview: lesson.isPreview,
+          durationSeconds: lesson.durationSeconds,
+        })),
+    }));
+};
+/** Locked view for logged-in users who have NOT purchased the course: titles only, previews flagged. */
+courseSchema.methods.toLockedCurriculumJSON = function toLockedCurriculumJSON() {
+  return this.toCurriculumJSON().map((section) => ({
+    ...section,
+    lessons: section.lessons.map((lesson) => ({
+      id: lesson.id,
+      title: lesson.title,
+      type: lesson.type,
+      order: lesson.order,
+      isPreview: lesson.isPreview,
+      durationSeconds: lesson.durationSeconds,
+      locked: !lesson.isPreview,
+    })),
+  }));
+};
+module.exports = mongoose.model("Course", courseSchema);

src/models/Order.js CHANGED Viewed

@@ -1,81 +1,81 @@
-const mongoose = require("mongoose");
-const { encryptField, decryptField, hmacIndex } = require("../utils/crypto");
-const PAYMENT_METHODS = ["bank_wire", "payoneer"];
-const ORDER_STATUSES = ["pending_payment", "awaiting_confirmation", "confirmed", "rejected", "cancelled"];
-const orderSchema = new mongoose.Schema(
-  {
-    orderNumber: { type: String, required: true, unique: true, index: true },
-    user: { type: mongoose.Schema.Types.ObjectId, ref: "User", required: true, index: true },
-    course: { type: mongoose.Schema.Types.ObjectId, ref: "Course", required: true },
-    // Snapshot of course price/title at time of purchase so historical
-    // orders remain accurate even if the course is later edited.
-    courseTitleSnapshot: { type: String, required: true },
-    amount: { type: Number, required: true, min: 0 },
-    currency: { type: String, default: "USD" },
-    paymentMethod: { type: String, enum: PAYMENT_METHODS, required: true },
-    // Sensitive: encrypted at rest with AES-256-GCM. Never returned by
-    // default queries (select: false) and never logged in plaintext.
-    // paymentReferenceIndex is a keyed HMAC used only to detect
-    // duplicate submissions without ever decrypting.
-    paymentReferenceEncrypted: { type: String, default: null, select: false },
-    paymentReferenceIndex: { type: String, default: null, index: true },
-    payerNoteEncrypted: { type: String, default: null, select: false },
-    status: { type: String, enum: ORDER_STATUSES, default: "pending_payment", index: true },
-    confirmedBy: { type: mongoose.Schema.Types.ObjectId, ref: "User", default: null },
-    confirmedAt: { type: Date, default: null },
-    rejectionReason: { type: String, default: null },
-    confirmationEmailSentAt: { type: Date, default: null },
-  },
-  { timestamps: true }
-);
-// --- Helpers to write/read the encrypted payment reference safely ---
-orderSchema.methods.setPaymentReference = function setPaymentReference(plainReference) {
-  this.paymentReferenceEncrypted = encryptField(plainReference);
-  this.paymentReferenceIndex = hmacIndex(plainReference);
-};
-orderSchema.methods.getPaymentReference = function getPaymentReference() {
-  return decryptField(this.paymentReferenceEncrypted);
-};
-orderSchema.methods.setPayerNote = function setPayerNote(note) {
-  this.payerNoteEncrypted = encryptField(note);
-};
-orderSchema.methods.getPayerNote = function getPayerNote() {
-  return decryptField(this.payerNoteEncrypted);
-};
-orderSchema.methods.toPublicJSON = function toPublicJSON({ includeSensitive = false } = {}) {
-  const json = {
-    id: this._id,
-    orderNumber: this.orderNumber,
-    course: this.course,
-    courseTitleSnapshot: this.courseTitleSnapshot,
-    amount: this.amount,
-    currency: this.currency,
-    paymentMethod: this.paymentMethod,
-    status: this.status,
-    confirmedAt: this.confirmedAt,
-    rejectionReason: this.rejectionReason,
-    createdAt: this.createdAt,
-  };
-  if (includeSensitive) {
-    json.paymentReference = this.getPaymentReference();
-    json.payerNote = this.getPayerNote();
-  }
-  return json;
-};
-module.exports = mongoose.model("Order", orderSchema);
-module.exports.PAYMENT_METHODS = PAYMENT_METHODS;
-module.exports.ORDER_STATUSES = ORDER_STATUSES;

+const mongoose = require("mongoose");
+const { encryptField, decryptField, hmacIndex } = require("../utils/crypto");
+const PAYMENT_METHODS = ["bank_wire", "payoneer"];
+const ORDER_STATUSES = ["pending_payment", "awaiting_confirmation", "confirmed", "rejected", "cancelled"];
+const orderSchema = new mongoose.Schema(
+  {
+    orderNumber: { type: String, required: true, unique: true, index: true },
+    user: { type: mongoose.Schema.Types.ObjectId, ref: "User", required: true, index: true },
+    course: { type: mongoose.Schema.Types.ObjectId, ref: "Course", required: true },
+    // Snapshot of course price/title at time of purchase so historical
+    // orders remain accurate even if the course is later edited.
+    courseTitleSnapshot: { type: String, required: true },
+    amount: { type: Number, required: true, min: 0 },
+    currency: { type: String, default: "USD" },
+    paymentMethod: { type: String, enum: PAYMENT_METHODS, required: true },
+    // Sensitive: encrypted at rest with AES-256-GCM. Never returned by
+    // default queries (select: false) and never logged in plaintext.
+    // paymentReferenceIndex is a keyed HMAC used only to detect
+    // duplicate submissions without ever decrypting.
+    paymentReferenceEncrypted: { type: String, default: null, select: false },
+    paymentReferenceIndex: { type: String, default: null, index: true },
+    payerNoteEncrypted: { type: String, default: null, select: false },
+    status: { type: String, enum: ORDER_STATUSES, default: "pending_payment", index: true },
+    confirmedBy: { type: mongoose.Schema.Types.ObjectId, ref: "User", default: null },
+    confirmedAt: { type: Date, default: null },
+    rejectionReason: { type: String, default: null },
+    confirmationEmailSentAt: { type: Date, default: null },
+  },
+  { timestamps: true }
+);
+// --- Helpers to write/read the encrypted payment reference safely ---
+orderSchema.methods.setPaymentReference = function setPaymentReference(plainReference) {
+  this.paymentReferenceEncrypted = encryptField(plainReference);
+  this.paymentReferenceIndex = hmacIndex(plainReference);
+};
+orderSchema.methods.getPaymentReference = function getPaymentReference() {
+  return decryptField(this.paymentReferenceEncrypted);
+};
+orderSchema.methods.setPayerNote = function setPayerNote(note) {
+  this.payerNoteEncrypted = encryptField(note);
+};
+orderSchema.methods.getPayerNote = function getPayerNote() {
+  return decryptField(this.payerNoteEncrypted);
+};
+orderSchema.methods.toPublicJSON = function toPublicJSON({ includeSensitive = false } = {}) {
+  const json = {
+    id: this._id,
+    orderNumber: this.orderNumber,
+    course: this.course,
+    courseTitleSnapshot: this.courseTitleSnapshot,
+    amount: this.amount,
+    currency: this.currency,
+    paymentMethod: this.paymentMethod,
+    status: this.status,
+    confirmedAt: this.confirmedAt,
+    rejectionReason: this.rejectionReason,
+    createdAt: this.createdAt,
+  };
+  if (includeSensitive) {
+    json.paymentReference = this.getPaymentReference();
+    json.payerNote = this.getPayerNote();
+  }
+  return json;
+};
+module.exports = mongoose.model("Order", orderSchema);
+module.exports.PAYMENT_METHODS = PAYMENT_METHODS;
+module.exports.ORDER_STATUSES = ORDER_STATUSES;

src/models/User.js CHANGED Viewed

@@ -1,88 +1,88 @@
-const mongoose = require("mongoose");
-const bcrypt = require("bcryptjs");
-const enrolledCourseSchema = new mongoose.Schema(
-  {
-    course: { type: mongoose.Schema.Types.ObjectId, ref: "Course", required: true },
-    order: { type: mongoose.Schema.Types.ObjectId, ref: "Order", required: true },
-    accessGrantedAt: { type: Date, default: Date.now },
-  },
-  { _id: false }
-);
-const userSchema = new mongoose.Schema(
-  {
-    name: { type: String, required: true, trim: true, maxlength: 120 },
-    email: {
-      type: String,
-      required: true,
-      unique: true,
-      lowercase: true,
-      trim: true,
-      maxlength: 254,
-      index: true,
-    },
-    passwordHash: { type: String, required: true, select: false },
-    role: { type: String, enum: ["user", "admin"], default: "user" },
-    // Access-control / session-security bookkeeping
-    tokenVersion: { type: Number, default: 0 }, // bump to invalidate all issued JWTs
-    activeRefreshTokens: {
-      // store only the jti + expiry, never the raw token, so a leaked DB
-      // dump can't be replayed as a session
-      type: [
-        {
-          jti: String,
-          expiresAt: Date,
-          userAgent: String,
-          ip: String,
-        },
-      ],
-      default: [],
-      select: false,
-    },
-    // Brute-force protection
-    failedLoginAttempts: { type: Number, default: 0, select: false },
-    lockUntil: { type: Date, default: null, select: false },
-    enrolledCourses: { type: [enrolledCourseSchema], default: [] },
-    isActive: { type: Boolean, default: true },
-  },
-  { timestamps: true }
-);
-userSchema.methods.setPassword = async function setPassword(plainPassword) {
-  const salt = await bcrypt.genSalt(12);
-  this.passwordHash = await bcrypt.hash(plainPassword, salt);
-};
-userSchema.methods.comparePassword = function comparePassword(plainPassword) {
-  return bcrypt.compare(plainPassword, this.passwordHash);
-};
-userSchema.methods.isLocked = function isLocked() {
-  return !!(this.lockUntil && this.lockUntil > Date.now());
-};
-userSchema.methods.hasAccessToCourse = function hasAccessToCourse(courseId) {
-  return this.enrolledCourses.some((ec) => ec.course.toString() === courseId.toString());
-};
-userSchema.methods.toSafeJSON = function toSafeJSON() {
-  return {
-    id: this._id,
-    name: this.name,
-    email: this.email,
-    role: this.role,
-    enrolledCourses: this.enrolledCourses.map((ec) => ({
-      course: ec.course,
-      order: ec.order,
-      accessGrantedAt: ec.accessGrantedAt,
-    })),
-    createdAt: this.createdAt,
-  };
-};
-module.exports = mongoose.model("User", userSchema);

+const mongoose = require("mongoose");
+const bcrypt = require("bcryptjs");
+const enrolledCourseSchema = new mongoose.Schema(
+  {
+    course: { type: mongoose.Schema.Types.ObjectId, ref: "Course", required: true },
+    order: { type: mongoose.Schema.Types.ObjectId, ref: "Order", required: true },
+    accessGrantedAt: { type: Date, default: Date.now },
+  },
+  { _id: false }
+);
+const userSchema = new mongoose.Schema(
+  {
+    name: { type: String, required: true, trim: true, maxlength: 120 },
+    email: {
+      type: String,
+      required: true,
+      unique: true,
+      lowercase: true,
+      trim: true,
+      maxlength: 254,
+      index: true,
+    },
+    passwordHash: { type: String, required: true, select: false },
+    role: { type: String, enum: ["user", "admin"], default: "user" },
+    // Access-control / session-security bookkeeping
+    tokenVersion: { type: Number, default: 0 }, // bump to invalidate all issued JWTs
+    activeRefreshTokens: {
+      // store only the jti + expiry, never the raw token, so a leaked DB
+      // dump can't be replayed as a session
+      type: [
+        {
+          jti: String,
+          expiresAt: Date,
+          userAgent: String,
+          ip: String,
+        },
+      ],
+      default: [],
+      select: false,
+    },
+    // Brute-force protection
+    failedLoginAttempts: { type: Number, default: 0, select: false },
+    lockUntil: { type: Date, default: null, select: false },
+    enrolledCourses: { type: [enrolledCourseSchema], default: [] },
+    isActive: { type: Boolean, default: true },
+  },
+  { timestamps: true }
+);
+userSchema.methods.setPassword = async function setPassword(plainPassword) {
+  const salt = await bcrypt.genSalt(12);
+  this.passwordHash = await bcrypt.hash(plainPassword, salt);
+};
+userSchema.methods.comparePassword = function comparePassword(plainPassword) {
+  return bcrypt.compare(plainPassword, this.passwordHash);
+};
+userSchema.methods.isLocked = function isLocked() {
+  return !!(this.lockUntil && this.lockUntil > Date.now());
+};
+userSchema.methods.hasAccessToCourse = function hasAccessToCourse(courseId) {
+  return this.enrolledCourses.some((ec) => ec.course.toString() === courseId.toString());
+};
+userSchema.methods.toSafeJSON = function toSafeJSON() {
+  return {
+    id: this._id,
+    name: this.name,
+    email: this.email,
+    role: this.role,
+    enrolledCourses: this.enrolledCourses.map((ec) => ({
+      course: ec.course,
+      order: ec.order,
+      accessGrantedAt: ec.accessGrantedAt,
+    })),
+    createdAt: this.createdAt,
+  };
+};
+module.exports = mongoose.model("User", userSchema);

src/routes/admin.routes.js CHANGED Viewed

@@ -1,49 +1,49 @@
-const express = require("express");
-const { body } = require("express-validator");
-const { validate } = require("../middleware/validate");
-const { requireAuth, requireRole } = require("../middleware/auth");
-const { upload } = require("../middleware/upload");
-const ctrl = require("../controllers/admin.controller");
-const contentCtrl = require("../controllers/content.controller");
-const router = express.Router();
-router.use(requireAuth, requireRole("admin"));
-router.get("/dashboard", ctrl.dashboardStats);
-router.get("/users", ctrl.listUsers);
-router.get("/orders", ctrl.listOrders);
-router.get("/orders/:id", ctrl.getOrderDetail);
-router.post("/orders/:id/confirm", ctrl.confirmOrder);
-router.post(
-  "/orders/:id/reject",
-  [body("reason").optional({ nullable: true }).trim().isLength({ max: 500 })],
-  validate,
-  ctrl.rejectOrder
-);
-// --- Course content management (admin-only; only admins may ever
-// upload or modify study materials, per course requirements) ----------
-router.get("/courses/:id/curriculum", contentCtrl.getCourseCurriculumForAdmin);
-router.post(
-  "/courses/:id/sections",
-  [body("title").trim().isLength({ min: 1, max: 200 })],
-  validate,
-  contentCtrl.createSection
-);
-router.put("/courses/:id/sections/:sectionId", contentCtrl.updateSection);
-router.delete("/courses/:id/sections/:sectionId", contentCtrl.deleteSection);
-router.post(
-  "/courses/:id/sections/:sectionId/lessons",
-  upload.single("file"),
-  [body("title").trim().isLength({ min: 1, max: 200 })],
-  validate,
-  contentCtrl.uploadLesson
-);
-router.put("/courses/:id/sections/:sectionId/lessons/:lessonId", contentCtrl.updateLesson);
-router.delete("/courses/:id/sections/:sectionId/lessons/:lessonId", contentCtrl.deleteLesson);
-module.exports = router;

+const express = require("express");
+const { body } = require("express-validator");
+const { validate } = require("../middleware/validate");
+const { requireAuth, requireRole } = require("../middleware/auth");
+const { upload } = require("../middleware/upload");
+const ctrl = require("../controllers/admin.controller");
+const contentCtrl = require("../controllers/content.controller");
+const router = express.Router();
+router.use(requireAuth, requireRole("admin"));
+router.get("/dashboard", ctrl.dashboardStats);
+router.get("/users", ctrl.listUsers);
+router.get("/orders", ctrl.listOrders);
+router.get("/orders/:id", ctrl.getOrderDetail);
+router.post("/orders/:id/confirm", ctrl.confirmOrder);
+router.post(
+  "/orders/:id/reject",
+  [body("reason").optional({ nullable: true }).trim().isLength({ max: 500 })],
+  validate,
+  ctrl.rejectOrder
+);
+// --- Course content management (admin-only; only admins may ever
+// upload or modify study materials, per course requirements) ----------
+router.get("/courses/:id/curriculum", contentCtrl.getCourseCurriculumForAdmin);
+router.post(
+  "/courses/:id/sections",
+  [body("title").trim().isLength({ min: 1, max: 200 })],
+  validate,
+  contentCtrl.createSection
+);
+router.put("/courses/:id/sections/:sectionId", contentCtrl.updateSection);
+router.delete("/courses/:id/sections/:sectionId", contentCtrl.deleteSection);
+router.post(
+  "/courses/:id/sections/:sectionId/lessons",
+  upload.single("file"),
+  [body("title").trim().isLength({ min: 1, max: 200 })],
+  validate,
+  contentCtrl.uploadLesson
+);
+router.put("/courses/:id/sections/:sectionId/lessons/:lessonId", contentCtrl.updateLesson);
+router.delete("/courses/:id/sections/:sectionId/lessons/:lessonId", contentCtrl.deleteLesson);
+module.exports = router;

src/routes/auth.routes.js CHANGED Viewed

@@ -1,50 +1,50 @@
-const express = require("express");
-const { body } = require("express-validator");
-const { validate } = require("../middleware/validate");
-const { requireAuth } = require("../middleware/auth");
-const { authLimiter } = require("../middleware/rateLimiters");
-const ctrl = require("../controllers/auth.controller");
-const router = express.Router();
-router.post(
-  "/signup",
-  authLimiter,
-  [
-    body("name").trim().isLength({ min: 2, max: 120 }).withMessage("Name must be 2-120 characters."),
-    body("email").isEmail().normalizeEmail().withMessage("A valid email is required."),
-    body("password")
-      .isLength({ min: 10 })
-      .withMessage("Password must be at least 10 characters.")
-      .matches(/[A-Z]/)
-      .withMessage("Password must include an uppercase letter.")
-      .matches(/[a-z]/)
-      .withMessage("Password must include a lowercase letter.")
-      .matches(/[0-9]/)
-      .withMessage("Password must include a number."),
-  ],
-  validate,
-  ctrl.signup
-);
-router.post(
-  "/login",
-  authLimiter,
-  [
-    body("email").isEmail().normalizeEmail().withMessage("A valid email is required."),
-    body("password").notEmpty().withMessage("Password is required."),
-  ],
-  validate,
-  ctrl.login
-);
-router.post(
-  "/refresh",
-  [body("refreshToken").notEmpty().withMessage("A refresh token is required.")],
-  validate,
-  ctrl.refresh
-);
-router.post("/logout", [body("refreshToken").optional({ nullable: true }).isString()], validate, ctrl.logout);
-router.get("/me", requireAuth, ctrl.me);
-module.exports = router;

+const express = require("express");
+const { body } = require("express-validator");
+const { validate } = require("../middleware/validate");
+const { requireAuth } = require("../middleware/auth");
+const { authLimiter } = require("../middleware/rateLimiters");
+const ctrl = require("../controllers/auth.controller");
+const router = express.Router();
+router.post(
+  "/signup",
+  authLimiter,
+  [
+    body("name").trim().isLength({ min: 2, max: 120 }).withMessage("Name must be 2-120 characters."),
+    body("email").isEmail().normalizeEmail().withMessage("A valid email is required."),
+    body("password")
+      .isLength({ min: 10 })
+      .withMessage("Password must be at least 10 characters.")
+      .matches(/[A-Z]/)
+      .withMessage("Password must include an uppercase letter.")
+      .matches(/[a-z]/)
+      .withMessage("Password must include a lowercase letter.")
+      .matches(/[0-9]/)
+      .withMessage("Password must include a number."),
+  ],
+  validate,
+  ctrl.signup
+);
+router.post(
+  "/login",
+  authLimiter,
+  [
+    body("email").isEmail().normalizeEmail().withMessage("A valid email is required."),
+    body("password").notEmpty().withMessage("Password is required."),
+  ],
+  validate,
+  ctrl.login
+);
+router.post(
+  "/refresh",
+  [body("refreshToken").notEmpty().withMessage("A refresh token is required.")],
+  validate,
+  ctrl.refresh
+);
+router.post("/logout", [body("refreshToken").optional({ nullable: true }).isString()], validate, ctrl.logout);
+router.get("/me", requireAuth, ctrl.me);
+module.exports = router;

src/routes/course.routes.js CHANGED Viewed

@@ -1,33 +1,33 @@
-const express = require("express");
-const { body } = require("express-validator");
-const { validate } = require("../middleware/validate");
-const { requireAuth, requireRole } = require("../middleware/auth");
-const ctrl = require("../controllers/course.controller");
-const contentCtrl = require("../controllers/content.controller");
-const router = express.Router();
-router.get("/", ctrl.listCourses);
-router.get("/:id", ctrl.getCourse);
-// Curriculum viewing / lesson playback (learner-facing, requires login;
-// access to actual lesson files is enforced per-lesson in the controller
-// based on confirmed purchase, not just being logged in).
-router.get("/:id/curriculum", requireAuth, contentCtrl.getCourseCurriculum);
-router.get("/:id/sections/:sectionId/lessons/:lessonId/access", requireAuth, contentCtrl.getLessonAccess);
-const courseValidators = [
-  body("title").trim().isLength({ min: 2, max: 200 }),
-  body("slug").trim().isSlug().withMessage("Slug must be URL-safe (lowercase, hyphens)."),
-  body("price").isFloat({ min: 0 }),
-  body("duration").trim().notEmpty(),
-  body("level").trim().notEmpty(),
-  body("description").trim().notEmpty(),
-];
-router.post("/", requireAuth, requireRole("admin"), courseValidators, validate, ctrl.createCourse);
-router.put("/:id", requireAuth, requireRole("admin"), ctrl.updateCourse);
-router.delete("/:id", requireAuth, requireRole("admin"), ctrl.deleteCourse);
-module.exports = router;

+const express = require("express");
+const { body } = require("express-validator");
+const { validate } = require("../middleware/validate");
+const { requireAuth, requireRole } = require("../middleware/auth");
+const ctrl = require("../controllers/course.controller");
+const contentCtrl = require("../controllers/content.controller");
+const router = express.Router();
+router.get("/", ctrl.listCourses);
+router.get("/:id", ctrl.getCourse);
+// Curriculum viewing / lesson playback (learner-facing, requires login;
+// access to actual lesson files is enforced per-lesson in the controller
+// based on confirmed purchase, not just being logged in).
+router.get("/:id/curriculum", requireAuth, contentCtrl.getCourseCurriculum);
+router.get("/:id/sections/:sectionId/lessons/:lessonId/access", requireAuth, contentCtrl.getLessonAccess);
+const courseValidators = [
+  body("title").trim().isLength({ min: 2, max: 200 }),
+  body("slug").trim().isSlug().withMessage("Slug must be URL-safe (lowercase, hyphens)."),
+  body("price").isFloat({ min: 0 }),
+  body("duration").trim().notEmpty(),
+  body("level").trim().notEmpty(),
+  body("description").trim().notEmpty(),
+];
+router.post("/", requireAuth, requireRole("admin"), courseValidators, validate, ctrl.createCourse);
+router.put("/:id", requireAuth, requireRole("admin"), ctrl.updateCourse);
+router.delete("/:id", requireAuth, requireRole("admin"), ctrl.deleteCourse);
+module.exports = router;

src/routes/order.routes.js CHANGED Viewed

@@ -1,40 +1,40 @@
-const express = require("express");
-const { body } = require("express-validator");
-const { validate } = require("../middleware/validate");
-const { requireAuth } = require("../middleware/auth");
-const { orderLimiter } = require("../middleware/rateLimiters");
-const { PAYMENT_METHODS } = require("../models/Order");
-const ctrl = require("../controllers/order.controller");
-const router = express.Router();
-router.get("/payment-options", ctrl.getPaymentOptions);
-router.use(requireAuth);
-router.get("/", ctrl.listMyOrders);
-router.get("/:id", ctrl.getMyOrder);
-router.post(
-  "/",
-  orderLimiter,
-  [
-    body("courseId").isMongoId().withMessage("A valid course must be selected."),
-    body("paymentMethod").isIn(PAYMENT_METHODS).withMessage("Choose bank_wire or payoneer."),
-  ],
-  validate,
-  ctrl.createOrder
-);
-router.post(
-  "/:id/payment-proof",
-  orderLimiter,
-  [
-    body("reference").trim().isLength({ min: 3, max: 200 }).withMessage("Enter your payment reference/transaction ID."),
-    body("note").optional({ nullable: true }).trim().isLength({ max: 500 }),
-  ],
-  validate,
-  ctrl.submitPaymentProof
-);
-module.exports = router;

+const express = require("express");
+const { body } = require("express-validator");
+const { validate } = require("../middleware/validate");
+const { requireAuth } = require("../middleware/auth");
+const { orderLimiter } = require("../middleware/rateLimiters");
+const { PAYMENT_METHODS } = require("../models/Order");
+const ctrl = require("../controllers/order.controller");
+const router = express.Router();
+router.get("/payment-options", ctrl.getPaymentOptions);
+router.use(requireAuth);
+router.get("/", ctrl.listMyOrders);
+router.get("/:id", ctrl.getMyOrder);
+router.post(
+  "/",
+  orderLimiter,
+  [
+    body("courseId").isMongoId().withMessage("A valid course must be selected."),
+    body("paymentMethod").isIn(PAYMENT_METHODS).withMessage("Choose bank_wire or payoneer."),
+  ],
+  validate,
+  ctrl.createOrder
+);
+router.post(
+  "/:id/payment-proof",
+  orderLimiter,
+  [
+    body("reference").trim().isLength({ min: 3, max: 200 }).withMessage("Enter your payment reference/transaction ID."),
+    body("note").optional({ nullable: true }).trim().isLength({ max: 500 }),
+  ],
+  validate,
+  ctrl.submitPaymentProof
+);
+module.exports = router;

src/seed/seed.js CHANGED Viewed

@@ -1,128 +1,128 @@
-/* eslint-disable no-console */
-const { env } = require("../config/env");
-const { connectDB, disconnectDB } = require("../config/db");
-const User = require("../models/User");
-const Course = require("../models/Course");
-const courses = [
-  {
-    title: "Artificial Intelligence Essentials",
-    slug: "artificial-intelligence-essentials",
-    price: 350,
-    duration: "8 weeks",
-    level: "Beginner",
-    description:
-      "A practical introduction to AI: learn what AI can (and cannot) do, work with real datasets, and build your first machine-learning models.",
-    highlights: [
-      "AI concepts, terminology and real-world use cases",
-      "Hands-on Python & ML experiments",
-      "Build a simple predictive model end-to-end",
-    ],
-  },
-  {
-    title: "Cyber Security Essentials",
-    slug: "cyber-security-essentials",
-    price: 300,
-    duration: "6 weeks",
-    level: "Beginner",
-    description:
-      "Learn the foundations of cyber defense: protect devices, networks, and data against the most common digital threats.",
-    highlights: [
-      "Threat landscape and attacker tactics",
-      "Secure browsing, password & identity hygiene",
-      "Basic network and endpoint protection",
-    ],
-  },
-  {
-    title: "AI-Powered Cybersecurity",
-    slug: "ai-powered-cybersecurity",
-    price: 550,
-    duration: "10 weeks",
-    level: "Intermediate to Advanced",
-    description:
-      "Combine AI with security operations: deploy intelligent threat detection, automate incident response, and build resilient SOC workflows.",
-    highlights: [
-      "ML-based threat detection and anomaly analytics",
-      "Automated incident response playbooks",
-      "AI governance, ethics and adversarial risks",
-    ],
-  },
-  {
-    title: "The AI Career Guidance",
-    slug: "the-ai-career-guidance",
-    price: 200,
-    duration: "4 weeks",
-    level: "Career Foundations",
-    description:
-      "Map your path into the AI economy. Discover roles, build a portfolio, and prepare for interviews with guided mentorship.",
-    highlights: [
-      "AI career landscape and skill roadmap",
-      "Portfolio project planning and resume review",
-      "Mock interviews and mentorship sessions",
-    ],
-  },
-  {
-    title: "AI for Business Managers",
-    slug: "ai-for-business-managers",
-    price: 450,
-    duration: "6 weeks",
-    level: "Manager Level",
-    description:
-      "Learn how to evaluate, procure, and manage AI projects that drive real business value without needing to code.",
-    highlights: [
-      "AI strategy, ROI and use-case prioritisation",
-      "Managing data, vendors and project risk",
-      "Leading AI-enabled teams and change",
-    ],
-  },
-  {
-    title: "AI for Business Executives",
-    slug: "ai-for-business-executives",
-    price: 650,
-    duration: "5 weeks",
-    level: "Executive Level",
-    description:
-      "A leadership-level course on AI governance, competitive strategy, and building an AI-ready organisation.",
-    highlights: [
-      "Board-level AI vision and investment decisions",
-      "Regulatory, ethical and governance frameworks",
-      "Building an AI culture and Centre of Excellence",
-    ],
-  },
-];
-async function seed() {
-  await connectDB();
-  for (const c of courses) {
-    await Course.findOneAndUpdate({ slug: c.slug }, c, { upsert: true, new: true, setDefaultsOnInsert: true });
-  }
-  console.log(`Seeded ${courses.length} courses.`);
-  if (env.seedAdmin.email && env.seedAdmin.password) {
-    const existingAdmin = await User.findOne({ email: env.seedAdmin.email.toLowerCase() });
-    if (existingAdmin) {
-      console.log(`Admin account already exists for ${env.seedAdmin.email}, skipping.`);
-    } else {
-      const admin = new User({
-        name: env.seedAdmin.name,
-        email: env.seedAdmin.email.toLowerCase(),
-        role: "admin",
-      });
-      await admin.setPassword(env.seedAdmin.password);
-      await admin.save();
-      console.log(`Created admin account: ${env.seedAdmin.email}`);
-      console.log("IMPORTANT: log in and change this password immediately.");
-    }
-  } else {
-    console.log("SEED_ADMIN_EMAIL / SEED_ADMIN_PASSWORD not set — skipping admin creation.");
-  }
-  await disconnectDB();
-  process.exit(0);
-}
-seed().catch((err) => {
-  console.error("Seeding failed:", err);
-  process.exit(1);
-});

+/* eslint-disable no-console */
+const { env } = require("../config/env");
+const { connectDB, disconnectDB } = require("../config/db");
+const User = require("../models/User");
+const Course = require("../models/Course");
+const courses = [
+  {
+    title: "Artificial Intelligence Essentials",
+    slug: "artificial-intelligence-essentials",
+    price: 350,
+    duration: "8 weeks",
+    level: "Beginner",
+    description:
+      "A practical introduction to AI: learn what AI can (and cannot) do, work with real datasets, and build your first machine-learning models.",
+    highlights: [
+      "AI concepts, terminology and real-world use cases",
+      "Hands-on Python & ML experiments",
+      "Build a simple predictive model end-to-end",
+    ],
+  },
+  {
+    title: "Cyber Security Essentials",
+    slug: "cyber-security-essentials",
+    price: 300,
+    duration: "6 weeks",
+    level: "Beginner",
+    description:
+      "Learn the foundations of cyber defense: protect devices, networks, and data against the most common digital threats.",
+    highlights: [
+      "Threat landscape and attacker tactics",
+      "Secure browsing, password & identity hygiene",
+      "Basic network and endpoint protection",
+    ],
+  },
+  {
+    title: "AI-Powered Cybersecurity",
+    slug: "ai-powered-cybersecurity",
+    price: 550,
+    duration: "10 weeks",
+    level: "Intermediate to Advanced",
+    description:
+      "Combine AI with security operations: deploy intelligent threat detection, automate incident response, and build resilient SOC workflows.",
+    highlights: [
+      "ML-based threat detection and anomaly analytics",
+      "Automated incident response playbooks",
+      "AI governance, ethics and adversarial risks",
+    ],
+  },
+  {
+    title: "The AI Career Guidance",
+    slug: "the-ai-career-guidance",
+    price: 200,
+    duration: "4 weeks",
+    level: "Career Foundations",
+    description:
+      "Map your path into the AI economy. Discover roles, build a portfolio, and prepare for interviews with guided mentorship.",
+    highlights: [
+      "AI career landscape and skill roadmap",
+      "Portfolio project planning and resume review",
+      "Mock interviews and mentorship sessions",
+    ],
+  },
+  {
+    title: "AI for Business Managers",
+    slug: "ai-for-business-managers",
+    price: 450,
+    duration: "6 weeks",
+    level: "Manager Level",
+    description:
+      "Learn how to evaluate, procure, and manage AI projects that drive real business value without needing to code.",
+    highlights: [
+      "AI strategy, ROI and use-case prioritisation",
+      "Managing data, vendors and project risk",
+      "Leading AI-enabled teams and change",
+    ],
+  },
+  {
+    title: "AI for Business Executives",
+    slug: "ai-for-business-executives",
+    price: 650,
+    duration: "5 weeks",
+    level: "Executive Level",
+    description:
+      "A leadership-level course on AI governance, competitive strategy, and building an AI-ready organisation.",
+    highlights: [
+      "Board-level AI vision and investment decisions",
+      "Regulatory, ethical and governance frameworks",
+      "Building an AI culture and Centre of Excellence",
+    ],
+  },
+];
+async function seed() {
+  await connectDB();
+  for (const c of courses) {
+    await Course.findOneAndUpdate({ slug: c.slug }, c, { upsert: true, new: true, setDefaultsOnInsert: true });
+  }
+  console.log(`Seeded ${courses.length} courses.`);
+  if (env.seedAdmin.email && env.seedAdmin.password) {
+    const existingAdmin = await User.findOne({ email: env.seedAdmin.email.toLowerCase() });
+    if (existingAdmin) {
+      console.log(`Admin account already exists for ${env.seedAdmin.email}, skipping.`);
+    } else {
+      const admin = new User({
+        name: env.seedAdmin.name,
+        email: env.seedAdmin.email.toLowerCase(),
+        role: "admin",
+      });
+      await admin.setPassword(env.seedAdmin.password);
+      await admin.save();
+      console.log(`Created admin account: ${env.seedAdmin.email}`);
+      console.log("IMPORTANT: log in and change this password immediately.");
+    }
+  } else {
+    console.log("SEED_ADMIN_EMAIL / SEED_ADMIN_PASSWORD not set — skipping admin creation.");
+  }
+  await disconnectDB();
+  process.exit(0);
+}
+seed().catch((err) => {
+  console.error("Seeding failed:", err);
+  process.exit(1);
+});

src/server.js CHANGED Viewed

@@ -1,53 +1,53 @@
-const { env, assertProductionSafety } = require("./config/env");
-const { connectDB, disconnectDB } = require("./config/db");
-const logger = require("./utils/logger");
-const app = require("./app");
-assertProductionSafety();
-let server;
-async function start() {
-  try {
-    await connectDB();
-    server = app.listen(env.port, () => {
-      logger.info(`Aynwerd API listening on port ${env.port} [${env.nodeEnv}]`);
-      // Logged deliberately at startup: this is the #1 source of CORS
-      // support confusion (a typo'd env var name, stray quotes, a
-      // trailing slash, or the value falling back to its localhost
-      // default because it was never actually set). Seeing the parsed
-      // array here removes all guesswork versus staring at the raw
-      // dashboard value.
-      logger.info(`CORS allow-list (CLIENT_ORIGINS parsed as): ${JSON.stringify(env.clientOrigins)}`);
-    });
-  } catch (err) {
-    logger.error("Failed to start server", { error: err.message });
-    process.exit(1);
-  }
-}
-async function shutdown(signal) {
-  logger.info(`Received ${signal}, shutting down gracefully...`);
-  if (server) {
-    server.close(async () => {
-      await disconnectDB();
-      process.exit(0);
-    });
-    // Force-exit if something hangs
-    setTimeout(() => process.exit(1), 10000).unref();
-  } else {
-    process.exit(0);
-  }
-}
-process.on("SIGINT", () => shutdown("SIGINT"));
-process.on("SIGTERM", () => shutdown("SIGTERM"));
-process.on("unhandledRejection", (reason) => {
-  logger.error("Unhandled promise rejection", { reason: reason?.message || reason });
-});
-process.on("uncaughtException", (err) => {
-  logger.error("Uncaught exception", { error: err.message, stack: err.stack });
-  process.exit(1);
-});
-start();

+const { env, assertProductionSafety } = require("./config/env");
+const { connectDB, disconnectDB } = require("./config/db");
+const logger = require("./utils/logger");
+const app = require("./app");
+assertProductionSafety();
+let server;
+async function start() {
+  try {
+    await connectDB();
+    server = app.listen(env.port, () => {
+      logger.info(`Aynwerd API listening on port ${env.port} [${env.nodeEnv}]`);
+      // Logged deliberately at startup: this is the #1 source of CORS
+      // support confusion (a typo'd env var name, stray quotes, a
+      // trailing slash, or the value falling back to its localhost
+      // default because it was never actually set). Seeing the parsed
+      // array here removes all guesswork versus staring at the raw
+      // dashboard value.
+      logger.info(`CORS allow-list (CLIENT_ORIGINS parsed as): ${JSON.stringify(env.clientOrigins)}`);
+    });
+  } catch (err) {
+    logger.error("Failed to start server", { error: err.message });
+    process.exit(1);
+  }
+}
+async function shutdown(signal) {
+  logger.info(`Received ${signal}, shutting down gracefully...`);
+  if (server) {
+    server.close(async () => {
+      await disconnectDB();
+      process.exit(0);
+    });
+    // Force-exit if something hangs
+    setTimeout(() => process.exit(1), 10000).unref();
+  } else {
+    process.exit(0);
+  }
+}
+process.on("SIGINT", () => shutdown("SIGINT"));
+process.on("SIGTERM", () => shutdown("SIGTERM"));
+process.on("unhandledRejection", (reason) => {
+  logger.error("Unhandled promise rejection", { reason: reason?.message || reason });
+});
+process.on("uncaughtException", (err) => {
+  logger.error("Uncaught exception", { error: err.message, stack: err.stack });
+  process.exit(1);
+});
+start();

src/utils/cloudinaryUpload.js CHANGED Viewed

@@ -1,61 +1,61 @@
-const cloudinary = require("../config/cloudinary");
-const FOLDER = "aynwerd-courses";
-/**
- * Uploads a file from a local temp path to Cloudinary under private,
- * signed-only access. `type: "authenticated"` means the asset can
- * NEVER be fetched by its plain URL or by guessing the public ID —
- * every request must carry a valid signature that we only ever mint
- * for a verified, paying learner (see getSignedPlaybackUrl below).
- *
- * Videos use `upload_large`, which chunks the upload — required for
- * anything beyond a small size and generally more reliable for video
- * regardless of size. Everything else uses a normal upload.
- */
-function uploadFromPath(filePath, { resourceType, filenameHint }) {
-  const options = {
-    folder: FOLDER,
-    resource_type: resourceType, // "video" | "image" | "raw"
-    type: "authenticated",
-    use_filename: true,
-    unique_filename: true,
-    filename_override: filenameHint,
-  };
-  if (resourceType === "video") {
-    return cloudinary.uploader.upload_large(filePath, { ...options, chunk_size: 6 * 1024 * 1024 });
-  }
-  return cloudinary.uploader.upload(filePath, options);
-}
-function deleteAsset(publicId, resourceType) {
-  return cloudinary.uploader.destroy(publicId, { resource_type: resourceType, type: "authenticated" });
-}
-/**
- * Mints a short-lived, signed URL for a specific lesson asset. Valid for
- * a couple of hours only, so a leaked link stops working quickly and
- * cannot be redistributed as a permanent download.
- */
-function getSignedPlaybackUrl(publicId, resourceType, { format, expiresInSeconds = 2 * 60 * 60 } = {}) {
-  const expiresAt = Math.floor(Date.now() / 1000) + expiresInSeconds;
-  const url = cloudinary.url(publicId, {
-    resource_type: resourceType,
-    type: "authenticated",
-    sign_url: true,
-    secure: true,
-    expires_at: expiresAt,
-    format: format || undefined,
-  });
-  return { url, expiresAt };
-}
-/** Maps an uploaded file's mimetype to the Cloudinary resource_type bucket it belongs in. */
-function resourceTypeForMimetype(mimetype) {
-  if (mimetype.startsWith("video/")) return "video";
-  if (mimetype.startsWith("image/")) return "image";
-  return "raw"; // PDFs, docs, slides, zips, etc.
-}
-module.exports = { uploadFromPath, deleteAsset, getSignedPlaybackUrl, resourceTypeForMimetype };

+const cloudinary = require("../config/cloudinary");
+const FOLDER = "aynwerd-courses";
+/**
+ * Uploads a file from a local temp path to Cloudinary under private,
+ * signed-only access. `type: "authenticated"` means the asset can
+ * NEVER be fetched by its plain URL or by guessing the public ID —
+ * every request must carry a valid signature that we only ever mint
+ * for a verified, paying learner (see getSignedPlaybackUrl below).
+ *
+ * Videos use `upload_large`, which chunks the upload — required for
+ * anything beyond a small size and generally more reliable for video
+ * regardless of size. Everything else uses a normal upload.
+ */
+function uploadFromPath(filePath, { resourceType, filenameHint }) {
+  const options = {
+    folder: FOLDER,
+    resource_type: resourceType, // "video" | "image" | "raw"
+    type: "authenticated",
+    use_filename: true,
+    unique_filename: true,
+    filename_override: filenameHint,
+  };
+  if (resourceType === "video") {
+    return cloudinary.uploader.upload_large(filePath, { ...options, chunk_size: 6 * 1024 * 1024 });
+  }
+  return cloudinary.uploader.upload(filePath, options);
+}
+function deleteAsset(publicId, resourceType) {
+  return cloudinary.uploader.destroy(publicId, { resource_type: resourceType, type: "authenticated" });
+}
+/**
+ * Mints a short-lived, signed URL for a specific lesson asset. Valid for
+ * a couple of hours only, so a leaked link stops working quickly and
+ * cannot be redistributed as a permanent download.
+ */
+function getSignedPlaybackUrl(publicId, resourceType, { format, expiresInSeconds = 2 * 60 * 60 } = {}) {
+  const expiresAt = Math.floor(Date.now() / 1000) + expiresInSeconds;
+  const url = cloudinary.url(publicId, {
+    resource_type: resourceType,
+    type: "authenticated",
+    sign_url: true,
+    secure: true,
+    expires_at: expiresAt,
+    format: format || undefined,
+  });
+  return { url, expiresAt };
+}
+/** Maps an uploaded file's mimetype to the Cloudinary resource_type bucket it belongs in. */
+function resourceTypeForMimetype(mimetype) {
+  if (mimetype.startsWith("video/")) return "video";
+  if (mimetype.startsWith("image/")) return "image";
+  return "raw"; // PDFs, docs, slides, zips, etc.
+}
+module.exports = { uploadFromPath, deleteAsset, getSignedPlaybackUrl, resourceTypeForMimetype };

src/utils/crypto.js CHANGED Viewed

@@ -1,56 +1,56 @@
-const crypto = require("crypto");
-const { env } = require("../config/env");
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 12; // 96-bit IV recommended for GCM
-function getKey() {
-  const key = Buffer.from(env.fieldEncryptionKey || "", "hex");
-  if (key.length !== 32) {
-    throw new Error(
-      "FIELD_ENCRYPTION_KEY must be a 32-byte value encoded as 64 hex characters. " +
-        "Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\""
-    );
-  }
-  return key;
-}
-/**
- * Encrypts a plaintext string for storage at rest (e.g. bank wire
- * reference numbers, Payoneer transaction IDs). Returns a single
- * base64 payload containing iv + authTag + ciphertext so it can be
- * stored as one string field in MongoDB.
- */
-function encryptField(plaintext) {
-  if (plaintext === undefined || plaintext === null || plaintext === "") return null;
-  const iv = crypto.randomBytes(IV_LENGTH);
-  const cipher = crypto.createCipheriv(ALGORITHM, getKey(), iv);
-  const ciphertext = Buffer.concat([cipher.update(String(plaintext), "utf8"), cipher.final()]);
-  const authTag = cipher.getAuthTag();
-  return Buffer.concat([iv, authTag, ciphertext]).toString("base64");
-}
-/**
- * Decrypts a payload produced by encryptField. Returns null if the
- * input is empty rather than throwing, so callers can treat "no
- * payment reference yet" gracefully.
- */
-function decryptField(payload) {
-  if (!payload) return null;
-  const raw = Buffer.from(payload, "base64");
-  const iv = raw.subarray(0, IV_LENGTH);
-  const authTag = raw.subarray(IV_LENGTH, IV_LENGTH + 16);
-  const ciphertext = raw.subarray(IV_LENGTH + 16);
-  const decipher = crypto.createDecipheriv(ALGORITHM, getKey(), iv);
-  decipher.setAuthTag(authTag);
-  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-  return plaintext.toString("utf8");
-}
-/** One-way hash used for equality lookups on encrypted fields (e.g. duplicate detection) without decrypting. */
-function hmacIndex(value) {
-  if (!value) return null;
-  return crypto.createHmac("sha256", getKey()).update(String(value)).digest("hex");
-}
-module.exports = { encryptField, decryptField, hmacIndex };

+const crypto = require("crypto");
+const { env } = require("../config/env");
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12; // 96-bit IV recommended for GCM
+function getKey() {
+  const key = Buffer.from(env.fieldEncryptionKey || "", "hex");
+  if (key.length !== 32) {
+    throw new Error(
+      "FIELD_ENCRYPTION_KEY must be a 32-byte value encoded as 64 hex characters. " +
+        "Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\""
+    );
+  }
+  return key;
+}
+/**
+ * Encrypts a plaintext string for storage at rest (e.g. bank wire
+ * reference numbers, Payoneer transaction IDs). Returns a single
+ * base64 payload containing iv + authTag + ciphertext so it can be
+ * stored as one string field in MongoDB.
+ */
+function encryptField(plaintext) {
+  if (plaintext === undefined || plaintext === null || plaintext === "") return null;
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, getKey(), iv);
+  const ciphertext = Buffer.concat([cipher.update(String(plaintext), "utf8"), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return Buffer.concat([iv, authTag, ciphertext]).toString("base64");
+}
+/**
+ * Decrypts a payload produced by encryptField. Returns null if the
+ * input is empty rather than throwing, so callers can treat "no
+ * payment reference yet" gracefully.
+ */
+function decryptField(payload) {
+  if (!payload) return null;
+  const raw = Buffer.from(payload, "base64");
+  const iv = raw.subarray(0, IV_LENGTH);
+  const authTag = raw.subarray(IV_LENGTH, IV_LENGTH + 16);
+  const ciphertext = raw.subarray(IV_LENGTH + 16);
+  const decipher = crypto.createDecipheriv(ALGORITHM, getKey(), iv);
+  decipher.setAuthTag(authTag);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return plaintext.toString("utf8");
+}
+/** One-way hash used for equality lookups on encrypted fields (e.g. duplicate detection) without decrypting. */
+function hmacIndex(value) {
+  if (!value) return null;
+  return crypto.createHmac("sha256", getKey()).update(String(value)).digest("hex");
+}
+module.exports = { encryptField, decryptField, hmacIndex };

src/utils/email.js CHANGED Viewed

@@ -1,147 +1,147 @@
-const nodemailer = require("nodemailer");
-const { env } = require("../config/env");
-const logger = require("./logger");
-let transporter = null;
-function getTransporter() {
-  if (transporter) return transporter;
-  transporter = nodemailer.createTransport({
-    host: env.smtp.host,
-    port: env.smtp.port,
-    secure: env.smtp.secure, // true for 465, false for other ports (STARTTLS)
-    auth: env.smtp.user ? { user: env.smtp.user, pass: env.smtp.pass } : undefined,
-    requireTLS: !env.smtp.secure, // enforce STARTTLS when not already on a TLS port
-  });
-  return transporter;
-}
-async function sendMail({ to, subject, html, text }) {
-  try {
-    const info = await getTransporter().sendMail({
-      from: env.emailFrom,
-      to,
-      subject,
-      html,
-      text,
-    });
-    return info;
-  } catch (err) {
-    // Email failures must never crash a request or leak SMTP credentials.
-    logger.error("Failed to send email", { subject, error: err.message });
-    return null;
-  }
-}
-function baseLayout(bodyHtml) {
-  return `
-  <div style="font-family:Arial,Helvetica,sans-serif;max-width:600px;margin:0 auto;color:#1a1a1a;">
-    <div style="padding:24px 0;border-bottom:2px solid #eee;">
-      <h2 style="margin:0;color:#111;">Aynwerd Academy</h2>
-    </div>
-    <div style="padding:24px 0;">${bodyHtml}</div>
-    <div style="padding:16px 0;border-top:1px solid #eee;font-size:12px;color:#777;">
-      This is an automated message regarding your order. Never share your password or
-      full payment reference by email. If you didn't make this request, contact
-      support immediately.
-    </div>
-  </div>`;
-}
-async function sendOrderPlacedEmail({ to, name, order, courseTitle, bankDetails, payoneerDetails }) {
-  const methodBlock =
-    order.paymentMethod === "bank_wire"
-      ? `<h3>Bank wire transfer instructions</h3>
-         <table style="border-collapse:collapse;width:100%;font-size:14px;">
-           <tr><td style="padding:4px 0;color:#555;">Bank name</td><td><strong>${bankDetails.name}</strong></td></tr>
-           <tr><td style="padding:4px 0;color:#555;">Account name</td><td><strong>${bankDetails.accountName}</strong></td></tr>
-           <tr><td style="padding:4px 0;color:#555;">Account number</td><td><strong>${bankDetails.accountNumber}</strong></td></tr>
-           <tr><td style="padding:4px 0;color:#555;">Routing number</td><td><strong>${bankDetails.routingNumber}</strong></td></tr>
-           <tr><td style="padding:4px 0;color:#555;">SWIFT/BIC</td><td><strong>${bankDetails.swiftBic}</strong></td></tr>
-           <tr><td style="padding:4px 0;color:#555;">Bank address</td><td><strong>${bankDetails.address}</strong></td></tr>
-         </table>
-         <p>Please use order number <strong>${order.orderNumber}</strong> as your payment reference.</p>`
-      : `<h3>Payoneer payment instructions</h3>
-         <p>Send payment to Payoneer account <strong>${payoneerDetails.accountEmail}</strong>
-         or use your Payoneer app's "Request a Payment" link: <a href="${payoneerDetails.paymentUrl}">${payoneerDetails.paymentUrl}</a>.</p>
-         <p>Please use order number <strong>${order.orderNumber}</strong> as your payment note.</p>`;
-  const html = baseLayout(`
-    <p>Hi ${name},</p>
-    <p>Thanks for enrolling in <strong>${courseTitle}</strong>. Your order has been created and is
-    awaiting payment${order.status === "awaiting_confirmation" ? " confirmation" : ""}.</p>
-    <p><strong>Order number:</strong> ${order.orderNumber}<br/>
-       <strong>Amount due:</strong> ${order.currency} ${order.amount.toFixed(2)}<br/>
-       <strong>Payment method:</strong> ${order.paymentMethod === "bank_wire" ? "Bank wire transfer" : "Payoneer"}</p>
-    ${methodBlock}
-    <p>Once our team confirms your payment, you'll receive a separate email and full course access
-    will be unlocked automatically on your account.</p>
-  `);
-  return sendMail({
-    to,
-    subject: `Your Aynwerd order ${order.orderNumber} — payment instructions`,
-    html,
-    text: `Order ${order.orderNumber} created for ${courseTitle}. Amount due: ${order.currency} ${order.amount.toFixed(2)}.`,
-  });
-}
-async function sendPaymentConfirmedEmail({ to, name, order, courseTitle }) {
-  const html = baseLayout(`
-    <p>Hi ${name},</p>
-    <p>Great news — we've confirmed your payment for <strong>${courseTitle}</strong>.</p>
-    <p><strong>Order number:</strong> ${order.orderNumber}<br/>
-       <strong>Amount paid:</strong> ${order.currency} ${order.amount.toFixed(2)}<br/>
-       <strong>Confirmed on:</strong> ${new Date(order.confirmedAt).toUTCString()}</p>
-    <p>Full access to the course has been unlocked on your account. Log in any time to get started.</p>
-  `);
-  return sendMail({
-    to,
-    subject: `Payment confirmed — order ${order.orderNumber}`,
-    html,
-    text: `Payment confirmed for order ${order.orderNumber}. Course access unlocked.`,
-  });
-}
-async function sendPaymentRejectedEmail({ to, name, order, courseTitle, reason }) {
-  const html = baseLayout(`
-    <p>Hi ${name},</p>
-    <p>We were unable to confirm your payment for <strong>${courseTitle}</strong> (order
-    <strong>${order.orderNumber}</strong>).</p>
-    ${reason ? `<p><strong>Reason:</strong> ${reason}</p>` : ""}
-    <p>Please reply to this email or contact support so we can help resolve this.</p>
-  `);
-  return sendMail({
-    to,
-    subject: `Action needed on order ${order.orderNumber}`,
-    html,
-    text: `We could not confirm payment for order ${order.orderNumber}.${reason ? ` Reason: ${reason}` : ""}`,
-  });
-}
-async function sendAdminNewOrderAlert({ order, courseTitle, customerEmail }) {
-  if (!env.adminNotifyEmail) return null;
-  const html = baseLayout(`
-    <p>New order awaiting confirmation.</p>
-    <p><strong>Order:</strong> ${order.orderNumber}<br/>
-       <strong>Customer:</strong> ${customerEmail}<br/>
-       <strong>Course:</strong> ${courseTitle}<br/>
-       <strong>Amount:</strong> ${order.currency} ${order.amount.toFixed(2)}<br/>
-       <strong>Method:</strong> ${order.paymentMethod}</p>
-    <p>Review and confirm it from the admin dashboard.</p>
-  `);
-  return sendMail({
-    to: env.adminNotifyEmail,
-    subject: `New order ${order.orderNumber} awaiting confirmation`,
-    html,
-  });
-}
-module.exports = {
-  sendOrderPlacedEmail,
-  sendPaymentConfirmedEmail,
-  sendPaymentRejectedEmail,
-  sendAdminNewOrderAlert,
-};

+const nodemailer = require("nodemailer");
+const { env } = require("../config/env");
+const logger = require("./logger");
+let transporter = null;
+function getTransporter() {
+  if (transporter) return transporter;
+  transporter = nodemailer.createTransport({
+    host: env.smtp.host,
+    port: env.smtp.port,
+    secure: env.smtp.secure, // true for 465, false for other ports (STARTTLS)
+    auth: env.smtp.user ? { user: env.smtp.user, pass: env.smtp.pass } : undefined,
+    requireTLS: !env.smtp.secure, // enforce STARTTLS when not already on a TLS port
+  });
+  return transporter;
+}
+async function sendMail({ to, subject, html, text }) {
+  try {
+    const info = await getTransporter().sendMail({
+      from: env.emailFrom,
+      to,
+      subject,
+      html,
+      text,
+    });
+    return info;
+  } catch (err) {
+    // Email failures must never crash a request or leak SMTP credentials.
+    logger.error("Failed to send email", { subject, error: err.message });
+    return null;
+  }
+}
+function baseLayout(bodyHtml) {
+  return `
+  <div style="font-family:Arial,Helvetica,sans-serif;max-width:600px;margin:0 auto;color:#1a1a1a;">
+    <div style="padding:24px 0;border-bottom:2px solid #eee;">
+      <h2 style="margin:0;color:#111;">Aynwerd Academy</h2>
+    </div>
+    <div style="padding:24px 0;">${bodyHtml}</div>
+    <div style="padding:16px 0;border-top:1px solid #eee;font-size:12px;color:#777;">
+      This is an automated message regarding your order. Never share your password or
+      full payment reference by email. If you didn't make this request, contact
+      support immediately.
+    </div>
+  </div>`;
+}
+async function sendOrderPlacedEmail({ to, name, order, courseTitle, bankDetails, payoneerDetails }) {
+  const methodBlock =
+    order.paymentMethod === "bank_wire"
+      ? `<h3>Bank wire transfer instructions</h3>
+         <table style="border-collapse:collapse;width:100%;font-size:14px;">
+           <tr><td style="padding:4px 0;color:#555;">Bank name</td><td><strong>${bankDetails.name}</strong></td></tr>
+           <tr><td style="padding:4px 0;color:#555;">Account name</td><td><strong>${bankDetails.accountName}</strong></td></tr>
+           <tr><td style="padding:4px 0;color:#555;">Account number</td><td><strong>${bankDetails.accountNumber}</strong></td></tr>
+           <tr><td style="padding:4px 0;color:#555;">Routing number</td><td><strong>${bankDetails.routingNumber}</strong></td></tr>
+           <tr><td style="padding:4px 0;color:#555;">SWIFT/BIC</td><td><strong>${bankDetails.swiftBic}</strong></td></tr>
+           <tr><td style="padding:4px 0;color:#555;">Bank address</td><td><strong>${bankDetails.address}</strong></td></tr>
+         </table>
+         <p>Please use order number <strong>${order.orderNumber}</strong> as your payment reference.</p>`
+      : `<h3>Payoneer payment instructions</h3>
+         <p>Send payment to Payoneer account <strong>${payoneerDetails.accountEmail}</strong>
+         or use your Payoneer app's "Request a Payment" link: <a href="${payoneerDetails.paymentUrl}">${payoneerDetails.paymentUrl}</a>.</p>
+         <p>Please use order number <strong>${order.orderNumber}</strong> as your payment note.</p>`;
+  const html = baseLayout(`
+    <p>Hi ${name},</p>
+    <p>Thanks for enrolling in <strong>${courseTitle}</strong>. Your order has been created and is
+    awaiting payment${order.status === "awaiting_confirmation" ? " confirmation" : ""}.</p>
+    <p><strong>Order number:</strong> ${order.orderNumber}<br/>
+       <strong>Amount due:</strong> ${order.currency} ${order.amount.toFixed(2)}<br/>
+       <strong>Payment method:</strong> ${order.paymentMethod === "bank_wire" ? "Bank wire transfer" : "Payoneer"}</p>
+    ${methodBlock}
+    <p>Once our team confirms your payment, you'll receive a separate email and full course access
+    will be unlocked automatically on your account.</p>
+  `);
+  return sendMail({
+    to,
+    subject: `Your Aynwerd order ${order.orderNumber} — payment instructions`,
+    html,
+    text: `Order ${order.orderNumber} created for ${courseTitle}. Amount due: ${order.currency} ${order.amount.toFixed(2)}.`,
+  });
+}
+async function sendPaymentConfirmedEmail({ to, name, order, courseTitle }) {
+  const html = baseLayout(`
+    <p>Hi ${name},</p>
+    <p>Great news — we've confirmed your payment for <strong>${courseTitle}</strong>.</p>
+    <p><strong>Order number:</strong> ${order.orderNumber}<br/>
+       <strong>Amount paid:</strong> ${order.currency} ${order.amount.toFixed(2)}<br/>
+       <strong>Confirmed on:</strong> ${new Date(order.confirmedAt).toUTCString()}</p>
+    <p>Full access to the course has been unlocked on your account. Log in any time to get started.</p>
+  `);
+  return sendMail({
+    to,
+    subject: `Payment confirmed — order ${order.orderNumber}`,
+    html,
+    text: `Payment confirmed for order ${order.orderNumber}. Course access unlocked.`,
+  });
+}
+async function sendPaymentRejectedEmail({ to, name, order, courseTitle, reason }) {
+  const html = baseLayout(`
+    <p>Hi ${name},</p>
+    <p>We were unable to confirm your payment for <strong>${courseTitle}</strong> (order
+    <strong>${order.orderNumber}</strong>).</p>
+    ${reason ? `<p><strong>Reason:</strong> ${reason}</p>` : ""}
+    <p>Please reply to this email or contact support so we can help resolve this.</p>
+  `);
+  return sendMail({
+    to,
+    subject: `Action needed on order ${order.orderNumber}`,
+    html,
+    text: `We could not confirm payment for order ${order.orderNumber}.${reason ? ` Reason: ${reason}` : ""}`,
+  });
+}
+async function sendAdminNewOrderAlert({ order, courseTitle, customerEmail }) {
+  if (!env.adminNotifyEmail) return null;
+  const html = baseLayout(`
+    <p>New order awaiting confirmation.</p>
+    <p><strong>Order:</strong> ${order.orderNumber}<br/>
+       <strong>Customer:</strong> ${customerEmail}<br/>
+       <strong>Course:</strong> ${courseTitle}<br/>
+       <strong>Amount:</strong> ${order.currency} ${order.amount.toFixed(2)}<br/>
+       <strong>Method:</strong> ${order.paymentMethod}</p>
+    <p>Review and confirm it from the admin dashboard.</p>
+  `);
+  return sendMail({
+    to: env.adminNotifyEmail,
+    subject: `New order ${order.orderNumber} awaiting confirmation`,
+    html,
+  });
+}
+module.exports = {
+  sendOrderPlacedEmail,
+  sendPaymentConfirmedEmail,
+  sendPaymentRejectedEmail,
+  sendAdminNewOrderAlert,
+};

src/utils/jwt.js CHANGED Viewed

@@ -1,33 +1,33 @@
-const jwt = require("jsonwebtoken");
-const crypto = require("crypto");
-const { env } = require("../config/env");
-function signAccessToken(user) {
-  return jwt.sign(
-    { sub: user._id.toString(), role: user.role, tokenVersion: user.tokenVersion },
-    env.jwtAccessSecret,
-    { expiresIn: env.jwtAccessExpiresIn, issuer: "aynwerd-api", audience: "aynwerd-client" }
-  );
-}
-function signRefreshToken(user) {
-  // A random jti lets us revoke a single refresh token (e.g. on logout /
-  // password change) without invalidating every session at once.
-  const jti = crypto.randomUUID();
-  const token = jwt.sign(
-    { sub: user._id.toString(), tokenVersion: user.tokenVersion, jti },
-    env.jwtRefreshSecret,
-    { expiresIn: env.jwtRefreshExpiresIn, issuer: "aynwerd-api", audience: "aynwerd-client" }
-  );
-  return { token, jti };
-}
-function verifyAccessToken(token) {
-  return jwt.verify(token, env.jwtAccessSecret, { issuer: "aynwerd-api", audience: "aynwerd-client" });
-}
-function verifyRefreshToken(token) {
-  return jwt.verify(token, env.jwtRefreshSecret, { issuer: "aynwerd-api", audience: "aynwerd-client" });
-}
-module.exports = { signAccessToken, signRefreshToken, verifyAccessToken, verifyRefreshToken };

+const jwt = require("jsonwebtoken");
+const crypto = require("crypto");
+const { env } = require("../config/env");
+function signAccessToken(user) {
+  return jwt.sign(
+    { sub: user._id.toString(), role: user.role, tokenVersion: user.tokenVersion },
+    env.jwtAccessSecret,
+    { expiresIn: env.jwtAccessExpiresIn, issuer: "aynwerd-api", audience: "aynwerd-client" }
+  );
+}
+function signRefreshToken(user) {
+  // A random jti lets us revoke a single refresh token (e.g. on logout /
+  // password change) without invalidating every session at once.
+  const jti = crypto.randomUUID();
+  const token = jwt.sign(
+    { sub: user._id.toString(), tokenVersion: user.tokenVersion, jti },
+    env.jwtRefreshSecret,
+    { expiresIn: env.jwtRefreshExpiresIn, issuer: "aynwerd-api", audience: "aynwerd-client" }
+  );
+  return { token, jti };
+}
+function verifyAccessToken(token) {
+  return jwt.verify(token, env.jwtAccessSecret, { issuer: "aynwerd-api", audience: "aynwerd-client" });
+}
+function verifyRefreshToken(token) {
+  return jwt.verify(token, env.jwtRefreshSecret, { issuer: "aynwerd-api", audience: "aynwerd-client" });
+}
+module.exports = { signAccessToken, signRefreshToken, verifyAccessToken, verifyRefreshToken };

src/utils/logger.js CHANGED Viewed

@@ -1,29 +1,29 @@
-const winston = require("winston");
-// Structured JSON logging so records can be shipped to a log aggregator.
-// Never log secrets, raw passwords, tokens, or full payment identifiers —
-// see redact() usage in controllers.
-const logger = winston.createLogger({
-  level: process.env.LOG_LEVEL || "info",
-  format: winston.format.combine(
-    winston.format.timestamp(),
-    winston.format.errors({ stack: true }),
-    winston.format.json()
-  ),
-  defaultMeta: { service: "aynwerd-api" },
-  transports: [new winston.transports.Console()],
-});
-/**
- * Redact all but the last `keep` characters of a sensitive string, e.g.
- * for logging a payment reference without exposing it in full.
- */
-function redact(value, keep = 4) {
-  if (!value) return value;
-  const str = String(value);
-  if (str.length <= keep) return "*".repeat(str.length);
-  return `${"*".repeat(str.length - keep)}${str.slice(-keep)}`;
-}
-module.exports = logger;
-module.exports.redact = redact;

+const winston = require("winston");
+// Structured JSON logging so records can be shipped to a log aggregator.
+// Never log secrets, raw passwords, tokens, or full payment identifiers —
+// see redact() usage in controllers.
+const logger = winston.createLogger({
+  level: process.env.LOG_LEVEL || "info",
+  format: winston.format.combine(
+    winston.format.timestamp(),
+    winston.format.errors({ stack: true }),
+    winston.format.json()
+  ),
+  defaultMeta: { service: "aynwerd-api" },
+  transports: [new winston.transports.Console()],
+});
+/**
+ * Redact all but the last `keep` characters of a sensitive string, e.g.
+ * for logging a payment reference without exposing it in full.
+ */
+function redact(value, keep = 4) {
+  if (!value) return value;
+  const str = String(value);
+  if (str.length <= keep) return "*".repeat(str.length);
+  return `${"*".repeat(str.length - keep)}${str.slice(-keep)}`;
+}
+module.exports = logger;
+module.exports.redact = redact;

src/utils/orderNumber.js CHANGED Viewed

@@ -1,15 +1,15 @@
-const crypto = require("crypto");
-/**
- * Human-friendly, hard-to-guess order number, e.g. AYN-20260825-4F9K2C.
- * Not used as a security token (the order is always looked up by its
- * MongoDB _id + the requesting user's identity), just a reference the
- * customer can quote in support emails.
- */
-function generateOrderNumber() {
-  const date = new Date().toISOString().slice(0, 10).replace(/-/g, "");
-  const random = crypto.randomBytes(4).toString("hex").toUpperCase().slice(0, 6);
-  return `AYN-${date}-${random}`;
-}
-module.exports = { generateOrderNumber };

+const crypto = require("crypto");
+/**
+ * Human-friendly, hard-to-guess order number, e.g. AYN-20260825-4F9K2C.
+ * Not used as a security token (the order is always looked up by its
+ * MongoDB _id + the requesting user's identity), just a reference the
+ * customer can quote in support emails.
+ */
+function generateOrderNumber() {
+  const date = new Date().toISOString().slice(0, 10).replace(/-/g, "");
+  const random = crypto.randomBytes(4).toString("hex").toUpperCase().slice(0, 6);
+  return `AYN-${date}-${random}`;
+}
+module.exports = { generateOrderNumber };