Spaces:
Sleeping
Sleeping
Commit History
-
deploy: claim/evidence scoring, CV integrity, upload safety, leak fixes
d209291
-
deploy: fill the profile from the CV, and rank courses on measured skill gaps
c3b8f02
-
Restore AI: Groq retired the Llama models
2f666f7 -
Repair the campaign flow end to end
3f14d37
-
deploy: campaign flow + location verification check
Ports the location-poc verification rules verbatim (27/27 VPN exits caught, 0/18 false positives, re-verified through the new endpoint) and adds the campaign flow on top: public apply page, shortlisting, invite tokens stored hashed, and the admin surface. Client IP is read via a trust-proxy HOP COUNT (TRUSTED_PROXY_HOPS, default 1) rather than trusting the whole chain — the leftmost X-Forwarded-For value is client-supplied and would defeat every network rule. If the Space turns out to sit behind more than one proxy, set TRUSTED_PROXY_HOPS accordingly: that value being wrong misjudges every candidate. New tables are created by TypeORM synchronize on boot (campaigns, campaign_candidates, campaign_application_drafts, verification_sessions), plus nullable/defaulted columns on user and interview_sessions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>86063f3
-
security: close unauthenticated routes, IDOR, and log leaks
Deploy of the pre-launch hardening pass (GitHub main 4e15bea). - Remove UsersController: GET /users/:id returned the full User entity including password and token hashes with no auth; POST /users wrote passwords unhashed. - AdminKeyGuard (x-admin-key, constant-time, fails closed) on the six previously-open admin routes. @Cron automation is unaffected — it calls the services in-process, not over HTTP. - Scope /scraper/results and the custom-search poll to the caller. - helmet, global exception filter (correlation id, no stack traces), Swagger disabled in production unless ENABLE_SWAGGER=1. - x-service-key on all Python bridge calls + 60s timeout on /extract-resume, which previously had none. - Remove login/forgot-password account enumeration (constant-time). - Revoke session chain on refresh-token replay. - Stop logging reset tokens, OTPs, and full axios/nodemailer errors. Requires SERVICE_API_KEY and ADMIN_API_KEY (already set on the Space).6cd3ae1
-
feat(resume): add targeted analysis and editing workflow
mahrooshishaqa1af4d9
-
Job APIs done
unprecedented-cress53dc52c
-
Merge branch 'main' of https://github.com/asnaatif/smartfolio-backend
unprecedented-cress9eb0445
-
new commit by Mahroosh
mahrooshishaq9a951d7
-
updated scrapers
unprecedented-cress277eb5d
-
OTP logic + advanced authentication
unprecedented-cressSession storage, login required every 15 days. OTP verification and email sent. User must be verified to login.b4d141a
-
authenticate user for protected routes
unprecedented-cressneed to grab user access token to access routes.ensures all pages are accessible to only logged in users6f49b87 -
login signup complete
unprecedented-cressSignup Login apis are tested + Error messages are added + Swagger implemeted + Access and Refresh Tokens doneaa95439
-
signup api done
unprecedented-cress8a24f2c