Spaces:
Sleeping
Sleeping
Commit History
-
deploy: pool-first course search and text repair
d03b460
-
deploy: activity-gated scraping, rescore on profile change, job-query cache
Nightly refresh now picks users by users.lastActiveAt instead of by rows in scrape_runs, which the cron itself writes — the old gate re-qualified users forever. Login refreshes a stale feed so quiet users cost nothing while away. Profile edits rescore existing jobs and courses. Job-board results cache for 12h. Salary filters run in SQL.a0eafe5
-
security: close unauthenticated routes, IDOR, and log leaks
Deploy of the pre-launch hardening pass (GitHub main 4e15bea). - Remove UsersController: GET /users/:id returned the full User entity including password and token hashes with no auth; POST /users wrote passwords unhashed. - AdminKeyGuard (x-admin-key, constant-time, fails closed) on the six previously-open admin routes. @Cron automation is unaffected — it calls the services in-process, not over HTTP. - Scope /scraper/results and the custom-search poll to the caller. - helmet, global exception filter (correlation id, no stack traces), Swagger disabled in production unless ENABLE_SWAGGER=1. - x-service-key on all Python bridge calls + 60s timeout on /extract-resume, which previously had none. - Remove login/forgot-password account enumeration (constant-time). - Revoke session chain on refresh-token replay. - Stop logging reset tokens, OTPs, and full axios/nodemailer errors. Requires SERVICE_API_KEY and ADMIN_API_KEY (already set on the Space).6cd3ae1
-
feat(courses): structured extraction, global pool, ranking, richer cards
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>a1056d7 -
deploy: scraper pipeline (Postgres storage, ranking, expiry, tracker, hardened LLM plumbing)
6fb7573
-
weewoo
unprecedented-cressJobs and courses module COMPLETED khikhikhi910c878