Spaces:
Sleeping
Sleeping
Commit History
-
deploy: fix the empty user list
5d4b547 -
deploy: users admin tab, signup dates, campaign vs direct source
fe607c0
-
deploy: operator endpoint for granting the admin role
Guarded by the existing ADMIN_API_KEY shared secret, rate limited to 5/min, and not reachable with a JWT — an admin able to mint admins would turn one stolen session into permanent access. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>909a81a
-
security: close unauthenticated routes, IDOR, and log leaks
Deploy of the pre-launch hardening pass (GitHub main 4e15bea). - Remove UsersController: GET /users/:id returned the full User entity including password and token hashes with no auth; POST /users wrote passwords unhashed. - AdminKeyGuard (x-admin-key, constant-time, fails closed) on the six previously-open admin routes. @Cron automation is unaffected — it calls the services in-process, not over HTTP. - Scope /scraper/results and the custom-search poll to the caller. - helmet, global exception filter (correlation id, no stack traces), Swagger disabled in production unless ENABLE_SWAGGER=1. - x-service-key on all Python bridge calls + 60s timeout on /extract-resume, which previously had none. - Remove login/forgot-password account enumeration (constant-time). - Revoke session chain on refresh-token replay. - Stop logging reset tokens, OTPs, and full axios/nodemailer errors. Requires SERVICE_API_KEY and ADMIN_API_KEY (already set on the Space).6cd3ae1
-
signup api done
unprecedented-cress8a24f2c