Spaces:
Sleeping
Sleeping
Commit History
-
deploy: recover signup dates from the admin page
d5ba26c -
deploy: fix the empty user list
5d4b547 -
deploy: users admin tab, signup dates, campaign vs direct source
fe607c0
-
deploy: operator endpoint for granting the admin role
Guarded by the existing ADMIN_API_KEY shared secret, rate limited to 5/min, and not reachable with a JWT — an admin able to mint admins would turn one stolen session into permanent access. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>909a81a -
deploy: campaign flow + location verification check
Ports the location-poc verification rules verbatim (27/27 VPN exits caught, 0/18 false positives, re-verified through the new endpoint) and adds the campaign flow on top: public apply page, shortlisting, invite tokens stored hashed, and the admin surface. Client IP is read via a trust-proxy HOP COUNT (TRUSTED_PROXY_HOPS, default 1) rather than trusting the whole chain — the leftmost X-Forwarded-For value is client-supplied and would defeat every network rule. If the Space turns out to sit behind more than one proxy, set TRUSTED_PROXY_HOPS accordingly: that value being wrong misjudges every candidate. New tables are created by TypeORM synchronize on boot (campaigns, campaign_candidates, campaign_application_drafts, verification_sessions), plus nullable/defaulted columns on user and interview_sessions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>86063f3
-
deploy: activity-gated scraping, rescore on profile change, job-query cache
Nightly refresh now picks users by users.lastActiveAt instead of by rows in scrape_runs, which the cron itself writes — the old gate re-qualified users forever. Login refreshes a stale feed so quiet users cost nothing while away. Profile edits rescore existing jobs and courses. Job-board results cache for 12h. Salary filters run in SQL.a0eafe5
-
security: close unauthenticated routes, IDOR, and log leaks
Deploy of the pre-launch hardening pass (GitHub main 4e15bea). - Remove UsersController: GET /users/:id returned the full User entity including password and token hashes with no auth; POST /users wrote passwords unhashed. - AdminKeyGuard (x-admin-key, constant-time, fails closed) on the six previously-open admin routes. @Cron automation is unaffected — it calls the services in-process, not over HTTP. - Scope /scraper/results and the custom-search poll to the caller. - helmet, global exception filter (correlation id, no stack traces), Swagger disabled in production unless ENABLE_SWAGGER=1. - x-service-key on all Python bridge calls + 60s timeout on /extract-resume, which previously had none. - Remove login/forgot-password account enumeration (constant-time). - Revoke session chain on refresh-token replay. - Stop logging reset tokens, OTPs, and full axios/nodemailer errors. Requires SERVICE_API_KEY and ADMIN_API_KEY (already set on the Space).6cd3ae1
-
new commit by Mahroosh
mahrooshishaq9a951d7
-
Backend updated
unprecedented-cressIncludes userLoggedIn status Forgot Password Swagger Implementation90c9777
-
forgot + reset password implemented
unprecedented-cress9ca537f -
updated google login logout
unprecedented-cressb71723a -
google login + signup done
unprecedented-cressec9da6a
-
OTP logic + advanced authentication
unprecedented-cressSession storage, login required every 15 days. OTP verification and email sent. User must be verified to login.b4d141a
-
login signup complete
unprecedented-cressSignup Login apis are tested + Error messages are added + Swagger implemeted + Access and Refresh Tokens doneaa95439
-
signup api done
unprecedented-cress8a24f2c