Spaces:
Sleeping
Sleeping
Commit History
-
deploy: rotate across all Groq keys, alert admins at 80/100%
edc0702
-
Say what opens ready
3be32ab -
Carry the role through the email links
b697865 -
Finish the rating plan
82bfe82
-
Restore AI: Groq retired the Llama models
2f666f7 -
Correct the interview duration copy
087fcdf -
Design the emails
089da8b -
Repair the campaign flow end to end
3f14d37
-
deploy: campaign flow + location verification check
Ports the location-poc verification rules verbatim (27/27 VPN exits caught, 0/18 false positives, re-verified through the new endpoint) and adds the campaign flow on top: public apply page, shortlisting, invite tokens stored hashed, and the admin surface. Client IP is read via a trust-proxy HOP COUNT (TRUSTED_PROXY_HOPS, default 1) rather than trusting the whole chain — the leftmost X-Forwarded-For value is client-supplied and would defeat every network rule. If the Space turns out to sit behind more than one proxy, set TRUSTED_PROXY_HOPS accordingly: that value being wrong misjudges every candidate. New tables are created by TypeORM synchronize on boot (campaigns, campaign_candidates, campaign_application_drafts, verification_sessions), plus nullable/defaulted columns on user and interview_sessions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>86063f3
-
security: close unauthenticated routes, IDOR, and log leaks
Deploy of the pre-launch hardening pass (GitHub main 4e15bea). - Remove UsersController: GET /users/:id returned the full User entity including password and token hashes with no auth; POST /users wrote passwords unhashed. - AdminKeyGuard (x-admin-key, constant-time, fails closed) on the six previously-open admin routes. @Cron automation is unaffected — it calls the services in-process, not over HTTP. - Scope /scraper/results and the custom-search poll to the caller. - helmet, global exception filter (correlation id, no stack traces), Swagger disabled in production unless ENABLE_SWAGGER=1. - x-service-key on all Python bridge calls + 60s timeout on /extract-resume, which previously had none. - Remove login/forgot-password account enumeration (constant-time). - Revoke session chain on refresh-token replay. - Stop logging reset tokens, OTPs, and full axios/nodemailer errors. Requires SERVICE_API_KEY and ADMIN_API_KEY (already set on the Space).6cd3ae1
-
smtp port issues fixed
mahrooshishaq8bb838e
-
final backend
mahrooshishaqd8ea863
-
Merge branch 'main' of https://github.com/asnaatif/smartfolio-backend
unprecedented-cress9eb0445
-
new commit by Mahroosh
mahrooshishaq9a951d7
-
reset password connected to frontend
unprecedented-cressf838735
-
Backend updated
unprecedented-cressIncludes userLoggedIn status Forgot Password Swagger Implementation90c9777
-
forgot + reset password implemented
unprecedented-cress9ca537f
-
OTP logic + advanced authentication
unprecedented-cressSession storage, login required every 15 days. OTP verification and email sent. User must be verified to login.b4d141a